Thanks Andreas, will take a look at it. Is there any reason why UDP checksum in
the packet shows as wrong in the wireshark?
From: Andreas Steffen [mailto:andreas.stef...@strongswan.org]
Sent: Monday, April 16, 2018 5:04 AM
To: Balaji Thoguluva Bapulal <balaji.thoguluva.bapu...@oracle.com>;
Subject: Re: [strongSwan] IKE_SA_INIT response with notification data missing
RFC 4739 "Multiple Authenticaton Exchanges in IKEv2"
defines the format of the MULTIPLE_AUTH_SUPPORT Notify Payload as
3.1. MULTIPLE_AUTH_SUPPORTED Notify Payload
The MULTIPLE_AUTH_SUPPORTED notification is included in the
IKE_SA_INIT response or the first IKE_AUTH request to indicate that
the peer supports this specification. The Notify Message Type is
MULTIPLE_AUTH_SUPPORTED (16404). The Protocol ID and SPI Size fields
MUST be set to zero, and there is no data associated with this Notify
So I don't understand why you expect notification data?
On 15.04.2018 04:42, Balaji Thoguluva Bapulal wrote:
> Dear users,
> I am trying to establish a IKEv2/IPsec tunnel from a security gateway
> towards strongswan with strongswan acting as a responder. In response
> to IKE_SA_INIT request packet, strongswan sends back IKE_SA_INIT
> response with a Notify payload of MULTIPLE_AUTH_SUPPORTED with
> notification data missing. I have attached the wireshark. It would be
> great if someone can explain why this behavior.
> [IKEv2]$ ipsec --version
> Linux strongSwan U5.3.0/K3.8.13-16.2.1.el6uek.x86_64
> Institute for Internet Technologies and Applications
> University of Applied Sciences Rapperswil, Switzerland
> See 'ipsec --copyright' for copyright information.
> The following is the configuration.
> config setup
> conn %default
> conn psk
Andreas Steffen andreas.stef...@strongswan.org
strongSwan - the Open Source VPN Solution! www.strongswan.org
Institute for Networked Solutions
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)