Re: OpenIKED and Strongswan

Ok. I've reduced the strongswan configuration. By the way when connecting
to an OpenIKED as initiator I've got a lot of errors. Now I've got a couple
of scripts that control the PTP IPSEC IKE2 connections and I can work, but
I'm preparing an ISP based upon IPSEC and it's very important to me got a
solution.
What I can add is that I've searched in *BSD based router/firewall
distribution like OPNsense and what I've found is that they don't use
OpenIKED but strongswan. Strongswan seems to be the piece of software more
tunable. Now this is my configuration:

ca XXX
cacert=/etc/ipsec.d/cacerts/ca.XXX.crt
auto=add

conn %default
keyexchange=ikev2
auto=start
reauth=no
dpdaction=clear
closeaction=clear
type=transport

conn telecomlobby-jp
left=%defaultroute
leftsourceip=%config4
leftauth=pubkey
leftid=%indra@ca.XXX
leftprotoport=gre
leftupdown=/config/ipsec/ESJP-updown.sh

right=YYY
rightsubnet=YYY
rightauth=pubkey
rightid=%jp.XXX
rightcert=/etc/ipsec.d/certs/jp.XXX.crt
rightprotoport=gre

This is my updown:

#!/bin/bash

set -o nounset
set -o errexit

TUN_IFACE="tun2"

case "${PLUTO_VERB}" in
up-host)
echo "Putting interface ${TUN_IFACE} up"
ifconfig $TUN_IFACE up
echo "Disabling IPsec policy (SPD) for ${TUN_IFACE}"
sysctl -w "net.ipv4.conf.${TUN_IFACE}.disable_policy=1"
echo "Accepting gre keepalive"
sysctl -w "net.ipv4.conf.${TUN_IFACE}.accept_local=1"
;;
down-host)
ifconfig $TUN_IFACE down
;;
esac

And this is my crontab script in the linux box that control the endpoint on
the GRE interface:

#!/bin/bash
ROUTER_IP=YYY
IPSEC="telecomlobby-jp"
GRE="tun2"

PING_RESULT=$(/usr/bin/fping -I$GRE $ROUTER_IP 2>&1)
ALIVE="alive"
STATUS=$(/usr/sbin/ipsec status $IPSEC)
ESTABLISHED="INSTALLED"

if [[ "$PING_RESULT" != *"$ALIVE"* ]]; then
if [[ "$STATUS" == *"$ESTABLISHED"* ]]; then
/usr/sbin/ipsec stroke down-nb $IPSEC
/usr/sbin/ipsec up $IPSEC
else
/usr/sbin/ipsec up $IPSEC
fi
fi

This is the OpenBSD part:

set dpd_check_interval 15
#set cert_partial_chain

ikev2 "RT-01.cat.telecomlobby.com" passive transport \
proto gre \
from XXX to ZZZ \
local jp.telecomlobby.com peer any \
ikesa auth hmac-sha2-256 enc aes-256 group ecp256 \
childsa auth hmac-sha2-256 enc aes-256 group ecp256 \
srcid "shiva@ca.telecomlobby.com" \
ikelifetime 86400 lifetime 3600

Next there is some control about the other side public address because it
is a dynamic one:

# Global Configuration

init-state auto

JPES_up = "gre1.link.up"
newip = '( "[[ $(dig +short @8.8.8.8 cat-01.ZZZ) != $(ifconfig gre1 | grep
tunnel | cut -d ' ' -f5;exit;}\') ]]" every 126)'

# States

state auto {
if (! $JPES_up) {
run "logger -t ifstated '(auto) US-ES down'"
set-state JPES_down
}
}


state JPES_down {
run "mail -s 'JPES down' root@localhost"
run "logger JPES down"
if ($newip) {
run "/root/Bin/change_endpoint.sh gre1"
run "rcctl restart ospfd"
}
}

root@shiva:/root/Bin# cat change_endpoint.sh



#!/bin/ksh

NEWIP=$(dig +short @8.8.8.8 cat-01.ZZZ)
OLDIP=$(ifconfig $1 | grep tunnel | cut -d ' ' -f5)

echo "updating PF"
sed -i 's/$OLDIP/$NEWIP/g' /etc/pf.conf
pfctl -f /etc/pf.conf
echo "updating IKED"
sed -i 's/$OLDIP/$NEWIP/g' /etc/iked.conf
ipsecctl -f /etc/iked.conf
echo "updating GRE"
sed -i 's/$OLDIP/$NEWIP/g' /etc/hostname.$1
ifconfig $1 destroy
sh /etc/netstart $1

Connection simply drop, in log you can appreciate in the charon side:

Mar 1 10:27:06 06[IKE] <telecomlobby-jp|842> establishing CHILD_SA
telecomlobby-jp{50065}
Mar 1 10:28:05 14[IKE] <telecomlobby-uk|841> establishing CHILD_SA
telecomlobby-uk{50066}
Mar 1 10:28:05 09[IKE] <telecomlobby-jp|842> establishing CHILD_SA
telecomlobby-jp{50067}
Mar 1 10:29:05 13[IKE] <telecomlobby-jp|842> establishing CHILD_SA
telecomlobby-jp{50068}
Mar 1 10:29:05 11[IKE] <telecomlobby-uk|841> establishing CHILD_SA
telecomlobby-uk{50069}
Mar 1 10:30:05 06[IKE] <telecomlobby-uk|841> establishing CHILD_SA
telecomlobby-uk{50070}
Mar 1 10:30:05 08[IKE] <telecomlobby-jp|842> establishing CHILD_SA
telecomlobby-jp{50071}
Mar 1 10:31:06 08[IKE] <telecomlobby-jp|842> establishing CHILD_SA
telecomlobby-jp{50072}
Mar 1 10:31:06 14[IKE] <telecomlobby-uk|841> establishing CHILD_SA
telecomlobby-uk{50073}
Mar 1 10:32:05 08[IKE] <telecomlobby-uk|841> establishing CHILD_SA
telecomlobby-uk{50074}
Mar 1 10:32:05 05[IKE] <telecomlobby-jp|842> establishing CHILD_SA
telecomlobby-jp{50075}
Mar 1 10:33:06 09[IKE] <telecomlobby-jp|842> establishing CHILD_SA
telecomlobby-jp{50076}
Mar 1 10:33:06 14[IKE] <telecomlobby-uk|841> establishing CHILD_SA
telecomlobby-uk{50077}
Mar 1 10:34:05 07[IKE] <telecomlobby-jp|842> establishing CHILD_SA
telecomlobby-jp{50078}
Mar 1 10:34:05 09[IKE] <telecomlobby-uk|841> establishing CHILD_SA
telecomlobby-uk{50079}
Mar 1 10:35:06 13[IKE] <telecomlobby-uk|841> establishing CHILD_SA
telecomlobby-uk{50080}
Mar 1 10:35:06 15[IKE] <telecomlobby-jp|842> establishing CHILD_SA
telecomlobby-jp{50081}
Mar 1 10:36:05 15[IKE] <telecomlobby-jp|842> establishing CHILD_SA
telecomlobby-jp{50083}
Mar 1 10:36:05 12[IKE] <telecomlobby-uk|841> establishing CHILD_SA
telecomlobby-uk{50084}
Mar 1 10:37:06 13[IKE] <telecomlobby-uk|841> establishing CHILD_SA
telecomlobby-uk{50085}
Mar 1 10:37:06 08[IKE] <telecomlobby-jp|842> establishing CHILD_SA
telecomlobby-jp{50086}
Mar 1 10:38:05 13[IKE] <telecomlobby-uk|841> establishing CHILD_SA
telecomlobby-uk{50087}
Mar 1 10:38:05 12[IKE] <telecomlobby-jp|842> establishing CHILD_SA
telecomlobby-jp{50088}

has you can see those are two of the three PTP.

If you want I've got a pcap or access but in private.

Nice regards,




On Mon, Feb 22, 2021 at 8:06 PM Tobias Heider <tobias.heider@stusta.de>
wrote:

> On Mon, Feb 22, 2021 at 03:59:53PM +0100, Riccardo Giuntoli wrote:
> > Ok. In the log you can appreciate.
> >
> > UK-HOST one OpenBSD machine connected to three openbsd, one mikrotik and
> > one VyOS. The VyOS is CAT-HOST
> >
> > Kind regards
>
> The log looks fine but it doesn't seem to contain the error message you
> sent earlier.
> Can you try reproducing the bug and then send a log containing the error
> message and everything that happened before?
>
> >
> >
> > On Mon, Feb 22, 2021 at 12:02 PM Stuart Henderson <stu@spacehopper.org>
> > wrote:
> >
> > > On 2021-02-22, Riccardo Giuntoli <taglio@gmail.com> wrote:
> > > > Ok I've got the same error on three different OpenBSD, tell me what
> error
> > > > do you want or if you want an access.
> > >
> > > It would be a good start to run iked in the foreground with iked -vvd
> and
> > > show the log from there.
> > >
> > >
> > >
> >
> > --
> > Name: Riccardo Giuntoli
> > Email: taglio@gmail.com
> > Location: sant Pere de Ribes, BCN, Spain
> > PGP Key: 0x67123739
> > PGP Fingerprint: CE75 16B5 D855 842FAB54 FB5C DDC6 4640 6712 3739
> > Key server: hkp://wwwkeys.eu.pgp.net
>
> > create_ike: using signature for peer --FR--
> > create_ike: using signature for peer
> > ikev2 "--CAT-HOST--" passive transport esp proto gre inet from --UK-- to
> --CAT-- local --UK-- peer any ikesa enc aes-256 prf
> hmac-sha2-256,hmac-sha2-384,hmac-sha2-512,hmac-sha1 auth hmac-sha2-256
> group ecp256 childsa enc aes-256 auth hmac-sha2-256 group ecp256 esn,noesn
> srcid --UK-ID-- ikelifetime 86400 lifetime 3600 bytes 536870912 signature
> > /etc/iked.conf: loaded 4 configuration rules
> > ca_privkey_serialize: type RSA_KEY length 1191
> > ca_pubkey_serialize: type RSA_KEY length 270
> > ca_privkey_to_method: type RSA_KEY method RSA_SIG
> > ca_getkey: received private key type RSA_KEY length 1191
> > ca_getkey: received public key type RSA_KEY length 270
> > ca_dispatch_parent: config reset
> > ca_reload: loaded ca file ca.crt
> > ca_reload: /C=FR/ST=Seine-Saint-Denis/L=Aubervilliers/O=Telecom
> Lobby/OU=VPNC/CN=--CA-HOST--
> > ca_reload: loaded 1 ca certificate
> > ca_reload: loaded cert file --FR-HOST--.crt
> > ca_reload: loaded cert file --UK-HOST--.crt
> > config_getpolicy: received policy
> > config_getpolicy: received policy
> > config_getpolicy: received policy
> > config_getpolicy: received policy
> > config_getpfkey: received pfkey fd 3
> > config_getcompile: compilation done
> > config_getsocket: received socket fd 4
> > config_getsocket: received socket fd 5
> > config_getsocket: received socket fd 6
> > config_getsocket: received socket fd 7
> > config_getstatic: dpd_check_interval 15
> > config_getstatic: no enforcesingleikesa
> > config_getstatic: no fragmentation
> > config_getstatic: mobike
> > config_getstatic: nattport 4500
> > ca_validate_cert: /C=FR/ST=Seine-Saint-Denis/L=Aubervilliers/O=Telecom
> Lobby/OU=VPNC/CN=--FR-HOST-- ok
> > ca_validate_cert: /C=UK/ST=England/L=London/O=Telecom
> Lobby/OU=VPNC/CN=--UK-HOST-- ok
> > ca_reload: local cert type X509_CERT
> > config_getocsp: ocsp_url none tolerate 0 maxage -1
> > ikev2_dispatch_cert: updated local CERTREQ type X509_CERT length 20
> > ikev2_dispatch_cert: updated local CERTREQ type X509_CERT length 20
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xc5881d3ed32f5801: recv INFORMATIONAL req 4428 peer --FR--:500
> local --UK--:500, 96 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xc5881d3ed32f5801 rspi 0xfcad33aa65954d8e
> > ikev2_init_recv: unknown SA
> > ikev2_init_ike_sa: initiating "--FR-HOST--"
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > ikev2_add_proposals: length 68
> > ikev2_next_payload: length 72 nextpayload KE
> > ikev2_next_payload: length 104 nextpayload NONCE
> > ikev2_next_payload: length 36 nextpayload NOTIFY
> > ikev2_nat_detection: local source 0xf2043da59221143f 0x0000000000000000
> --UK--:500
> > ikev2_next_payload: length 28 nextpayload NOTIFY
> > ikev2_nat_detection: local destination 0xf2043da59221143f
> 0x0000000000000000 --FR--:500
> > ikev2_next_payload: length 28 nextpayload NOTIFY
> > ikev2_next_payload: length 14 nextpayload NONE
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x0000000000000000
> nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x08 msgid 0 length
> 310 response 0
> > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 72
> > ikev2_pld_sa: more 0 reserved 0 length 68 proposal #1 protoid IKE
> spisize 0 xforms 7 spi 0
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_256_128
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_384
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_384
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_512
> > ikev2_pld_xform: more 0 reserved 0 length 8 type PRF id HMAC_SHA1
> > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 104
> > ikev2_pld_ke: dh group ECP_384 reserved 0
> > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00
> length 36
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type
> NAT_DETECTION_DESTINATION_IP
> > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length
> 14
> > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS
> > spi=0xf2043da59221143f: send IKE_SA_INIT req 0 peer --FR--:500 local
> --UK--:500, 310 bytes
> > spi=0xf2043da59221143f: sa_state: INIT -> SA_INIT
> > ikev2_init_ike_sa: initiating "--US-HOST--"
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > ikev2_add_proposals: length 36
> > ikev2_next_payload: length 40 nextpayload KE
> > ikev2_next_payload: length 136 nextpayload NONCE
> > ikev2_next_payload: length 36 nextpayload NOTIFY
> > ikev2_nat_detection: local source 0x22cd85777285bb53 0x0000000000000000
> --UK--:500
> > ikev2_next_payload: length 28 nextpayload NOTIFY
> > ikev2_nat_detection: local destination 0x22cd85777285bb53
> 0x0000000000000000 --US-IP--:500
> > ikev2_next_payload: length 28 nextpayload NOTIFY
> > ikev2_next_payload: length 14 nextpayload NONE
> > ikev2_pld_parse: header ispi 0x22cd85777285bb53 rspi 0x0000000000000000
> nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x08 msgid 0 length
> 310 response 0
> > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 40
> > ikev2_pld_sa: more 0 reserved 0 length 36 proposal #1 protoid IKE
> spisize 0 xforms 3 spi 0
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P512R1
> > ikev2_pld_xform: more 0 reserved 0 length 8 type PRF id HMAC_SHA2_512
> > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 136
> > ikev2_pld_ke: dh group BRAINPOOL_P512R1 reserved 0
> > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00
> length 36
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type
> NAT_DETECTION_DESTINATION_IP
> > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length
> 14
> > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS
> > spi=0x22cd85777285bb53: send IKE_SA_INIT req 0 peer --US-IP--:500 local
> --UK--:500, 310 bytes
> > spi=0x22cd85777285bb53: sa_state: INIT -> SA_INIT
> > ikev2_init_ike_sa: initiating "--JP-HOST--"
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > ikev2_add_proposals: length 36
> > ikev2_next_payload: length 40 nextpayload KE
> > ikev2_next_payload: length 136 nextpayload NONCE
> > ikev2_next_payload: length 36 nextpayload NOTIFY
> > ikev2_nat_detection: local source 0x67cb9c572ac8b67e 0x0000000000000000
> --UK--:500
> > ikev2_next_payload: length 28 nextpayload NOTIFY
> > ikev2_nat_detection: local destination 0x67cb9c572ac8b67e
> 0x0000000000000000 --JP-IP--:500
> > ikev2_next_payload: length 28 nextpayload NOTIFY
> > ikev2_next_payload: length 14 nextpayload NONE
> > ikev2_pld_parse: header ispi 0x67cb9c572ac8b67e rspi 0x0000000000000000
> nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x08 msgid 0 length
> 310 response 0
> > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 40
> > ikev2_pld_sa: more 0 reserved 0 length 36 proposal #1 protoid IKE
> spisize 0 xforms 3 spi 0
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P512R1
> > ikev2_pld_xform: more 0 reserved 0 length 8 type PRF id HMAC_SHA2_512
> > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 136
> > ikev2_pld_ke: dh group BRAINPOOL_P512R1 reserved 0
> > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00
> length 36
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type
> NAT_DETECTION_DESTINATION_IP
> > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length
> 14
> > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS
> > spi=0x67cb9c572ac8b67e: send IKE_SA_INIT req 0 peer --JP-IP--:500 local
> --UK--:500, 310 bytes
> > spi=0x67cb9c572ac8b67e: sa_state: INIT -> SA_INIT
> > spi=0xf2043da59221143f: recv IKE_SA_INIT res 0 peer --FR--:500 local
> --UK--:500, 213 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x20 msgid 0 length
> 213 response 1
> > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 48
> > ikev2_pld_sa: more 0 reserved 0 length 44 proposal #1 protoid IKE
> spisize 0 xforms 4 spi 0
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_256_128
> > ikev2_pld_xform: more 0 reserved 0 length 8 type DH id ECP_384
> > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 104
> > ikev2_pld_ke: dh group ECP_384 reserved 0
> > ikev2_pld_payloads: payload NONCE nextpayload CERTREQ critical 0x00
> length 28
> > ikev2_pld_payloads: payload CERTREQ nextpayload NONE critical 0x00
> length 5
> > ikev2_pld_certreq: type X509_CERT length 0
> > ikev2_pld_certreq: invalid length 0
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > sa_stateflags: 0x0000 -> 0x0004 certreq (required 0x0009 cert,auth)
> > proposals_negotiate: score 4
> > sa_stateok: SA_INIT flags 0x0000, require 0x0009 cert,auth
> > spi=0xf2043da59221143f: ikev2_sa_keys: DHSECRET with 48 bytes
> > ikev2_sa_keys: SKEYSEED with 32 bytes
> > spi=0xf2043da59221143f: ikev2_sa_keys: S with 72 bytes
> > ikev2_prfplus: T1 with 32 bytes
> > ikev2_prfplus: T2 with 32 bytes
> > ikev2_prfplus: T3 with 32 bytes
> > ikev2_prfplus: T4 with 32 bytes
> > ikev2_prfplus: T5 with 32 bytes
> > ikev2_prfplus: T6 with 32 bytes
> > ikev2_prfplus: T7 with 32 bytes
> > ikev2_prfplus: Tn with 224 bytes
> > ikev2_sa_keys: SK_d with 32 bytes
> > ikev2_sa_keys: SK_ai with 32 bytes
> > ikev2_sa_keys: SK_ar with 32 bytes
> > ikev2_sa_keys: SK_ei with 32 bytes
> > ikev2_sa_keys: SK_er with 32 bytes
> > ikev2_sa_keys: SK_pi with 32 bytes
> > ikev2_sa_keys: SK_pr with 32 bytes
> > ikev2_msg_auth: initiator auth data length 366
> > ca_setauth: switching SIG to RSA_SIG(*)
> > ca_setauth: auth length 366
> > sa_stateok: SA_INIT flags 0x0000, require 0x0009 cert,auth
> > config_free_proposals: free 0x3c27ccfe800
> > ca_getreq: found CA /C=FR/ST=Seine-Saint-Denis/L=Aubervilliers/O=Telecom
> Lobby/OU=VPNC/CN=--CA-HOST--
> > ca_x509_subjectaltname_do: did not find subjectAltName in certificate
> > ca_getreq: found local certificate /C=UK/ST=England/L=London/O=Telecom
> Lobby/OU=VPNC/CN=--UK-HOST--
> > ca_setauth: auth length 256
> > ikev2_getimsgdata: imsg 22 rspi 0x1f43bd64d771a4e5 ispi
> 0xf2043da59221143f initiator 1 sa valid type 4 data length 1064
> > ikev2_dispatch_cert: cert type X509_CERT length 1064, ok
> > sa_stateflags: 0x0004 -> 0x0005 cert,certreq (required 0x0009 cert,auth)
> > sa_stateok: SA_INIT flags 0x0001, require 0x0009 cert,auth
> > ikev2_getimsgdata: imsg 28 rspi 0x1f43bd64d771a4e5 ispi
> 0xf2043da59221143f initiator 1 sa valid type 1 data length 256
> > ikev2_dispatch_cert: AUTH type 1 len 256
> > sa_stateflags: 0x0005 -> 0x000d cert,certreq,auth (required 0x0009
> cert,auth)
> > sa_stateok: SA_INIT flags 0x0009, require 0x0009 cert,auth
> > ikev2_next_payload: length 35 nextpayload CERT
> > ikev2_next_payload: length 1069 nextpayload CERTREQ
> > ikev2_add_certreq: type X509_CERT length 21
> > ikev2_next_payload: length 25 nextpayload AUTH
> > ikev2_next_payload: length 264 nextpayload NOTIFY
> > ikev2_add_notify: done
> > ikev2_next_payload: length 8 nextpayload SA
> > pfkey_sa_getspi: spi 0x8f3bad08
> > pfkey_sa_init: new spi 0x8f3bad08
> > ikev2_add_proposals: length 48
> > ikev2_next_payload: length 52 nextpayload TSi
> > ikev2_next_payload: length 24 nextpayload TSr
> > ikev2_next_payload: length 24 nextpayload NONE
> > ikev2_next_payload: length 1540 nextpayload IDi
> > ikev2_msg_encrypt: decrypted length 1501
> > ikev2_msg_encrypt: padded length 1504
> > ikev2_msg_encrypt: length 1502, padding 2, output length 1536
> > ikev2_msg_integr: message length 1568
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange IKE_AUTH flags 0x08 msgid 1 length
> 1568 response 0
> > ikev2_pld_payloads: payload SK nextpayload IDi critical 0x00 length 1540
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 1504
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 1504/1504 padding 2
> > ikev2_pld_payloads: decrypted payload IDi nextpayload CERT critical 0x00
> length 35
> > ikev2_pld_id: id UFQDN/--UK-ID-- length 31
> > ikev2_pld_payloads: decrypted payload CERT nextpayload CERTREQ critical
> 0x00 length 1069
> > ikev2_pld_cert: type X509_CERT length 1064
> > ikev2_pld_payloads: decrypted payload CERTREQ nextpayload AUTH critical
> 0x00 length 25
> > ikev2_pld_certreq: type X509_CERT length 20
> > ikev2_pld_payloads: decrypted payload AUTH nextpayload NOTIFY critical
> 0x00 length 264
> > ikev2_pld_auth: method RSA_SIG length 256
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload SA critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type USE_TRANSPORT_MODE
> > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00
> length 52
> > ikev2_pld_sa: more 0 reserved 0 length 48 proposal #1 protoid ESP
> spisize 4 xforms 4 spi 0x8f3bad08
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_256_128
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type ESN id ESN
> > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id NONE
> > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --UK-- end --UK--
> > ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --FR-- end --FR--
> > spi=0xf2043da59221143f: send IKE_AUTH req 1 peer --FR--:500 local
> --UK--:500, 1568 bytes
> > spi=0xf2043da59221143f: recv IKE_AUTH res 1 peer --FR--:500 local
> --UK--:500, 1552 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange IKE_AUTH flags 0x20 msgid 1 length
> 1552 response 1
> > ikev2_pld_payloads: payload SK nextpayload CERT critical 0x00 length 1524
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 1488
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 1488/1488 padding 8
> > ikev2_pld_payloads: decrypted payload CERT nextpayload IDr critical 0x00
> length 1084
> > ikev2_pld_cert: type X509_CERT length 1079
> > ikev2_pld_payloads: decrypted payload IDr nextpayload AUTH critical 0x00
> length 31
> > ikev2_pld_id: id UFQDN/uma@--CA-HOST-- length 27
> > ikev2_pld_payloads: decrypted payload AUTH nextpayload TSi critical 0x00
> length 264
> > ikev2_pld_auth: method RSA_SIG length 256
> > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --UK-- end --UK--
> > ikev2_pld_payloads: decrypted payload TSr nextpayload SA critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --FR-- end --FR--
> > ikev2_pld_payloads: decrypted payload SA nextpayload NOTIFY critical
> 0x00 length 44
> > ikev2_pld_sa: more 0 reserved 0 length 40 proposal #1 protoid ESP
> spisize 4 xforms 3 spi 0x066d9db6
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_256_128
> > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id NONE
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload NONE critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type USE_TRANSPORT_MODE
> > spi=0xf2043da59221143f: sa_state: SA_INIT -> AUTH_REQUEST
> > proposals_negotiate: score 4
> > sa_stateflags: 0x000d -> 0x002d cert,certreq,auth,sa (required 0x0032
> certvalid,authvalid,sa)
> > config_free_proposals: free 0x3c27ccfe580
> > ca_validate_pubkey: could not open public key pubkeys/ufqdn/uma@
> --CA-HOST--
> > ca_validate_cert: /C=FR/ST=Seine-Saint-Denis/L=Aubervilliers/O=Telecom
> Lobby/OU=VPNC/CN=--FR-HOST-- ok
> > ikev2_getimsgdata: imsg 23 rspi 0x1f43bd64d771a4e5 ispi
> 0xf2043da59221143f initiator 1 sa valid type 4 data length 1079
> > ikev2_msg_auth: responder auth data length 277
> > ikev2_msg_authverify: method RSA_SIG keylen 1079 type X509_CERT
> > ikev2_msg_authverify: authentication successful
> > spi=0xf2043da59221143f: sa_state: AUTH_REQUEST -> AUTH_SUCCESS
> > sa_stateflags: 0x002d -> 0x003d cert,certreq,auth,authvalid,sa (required
> 0x0032 certvalid,authvalid,sa)
> > ikev2_dispatch_cert: peer certificate is valid
> > sa_stateflags: 0x003d -> 0x003f cert,certvalid,certreq,auth,authvalid,sa
> (required 0x0032 certvalid,authvalid,sa)
> > sa_stateok: VALID flags 0x0032, require 0x0032 certvalid,authvalid,sa
> > spi=0xf2043da59221143f: sa_state: AUTH_SUCCESS -> VALID
> > sa_stateok: VALID flags 0x0032, require 0x0032 certvalid,authvalid,sa
> > sa_stateok: VALID flags 0x0032, require 0x0032 certvalid,authvalid,sa
> > ikev2_sa_tag: (0)
> > ikev2_childsa_negotiate: proposal 1
> > ikev2_childsa_negotiate: key material length 128
> > ikev2_prfplus: T1 with 32 bytes
> > ikev2_prfplus: T2 with 32 bytes
> > ikev2_prfplus: T3 with 32 bytes
> > ikev2_prfplus: T4 with 32 bytes
> > ikev2_prfplus: Tn with 128 bytes
> > pfkey_sa_add: add spi 0x066d9db6
> > ikev2_childsa_enable: loaded CHILD SA spi 0x066d9db6
> > pfkey_sa_add: update spi 0x8f3bad08
> > ikev2_childsa_enable: loaded CHILD SA spi 0x8f3bad08
> > ikev2_childsa_enable: loaded flow 0x3c27dfd9800
> > ikev2_childsa_enable: loaded flow 0x3c27dfda000
> > ikev2_childsa_enable: remember SA peer --FR--:500
> > spi=0xf2043da59221143f: ikev2_childsa_enable: loaded SPIs: 0x066d9db6,
> 0x8f3bad08
> > spi=0xf2043da59221143f: ikev2_childsa_enable: loaded flows:
> ESP---UK--/32=--FR--/32(47)
> > spi=0xf2043da59221143f: sa_state: VALID -> ESTABLISHED from --FR--:500
> to --UK--:500 policy '--FR-HOST--'
> > spi=0xf2043da59221143f: established peer --FR--:500[UFQDN/uma@--CA-HOST--]
> local --UK--:500[UFQDN/--UK-ID--] policy '--FR-HOST--' as initiator
> > spi=0x22cd85777285bb53: recv IKE_SA_INIT res 0 peer --US-IP--:500 local
> --UK--:500, 335 bytes, policy '--US-HOST--'
> > ikev2_recv: ispi 0x22cd85777285bb53 rspi 0x84c59f1c8f60d03f
> > ikev2_recv: updated SA to peer --US-IP--:500 local --UK--:500
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > ikev2_pld_parse: header ispi 0x22cd85777285bb53 rspi 0x84c59f1c8f60d03f
> nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x20 msgid 0 length
> 335 response 1
> > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 40
> > ikev2_pld_sa: more 0 reserved 0 length 36 proposal #1 protoid IKE
> spisize 0 xforms 3 spi 0
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_512
> > ikev2_pld_xform: more 0 reserved 0 length 8 type DH id BRAINPOOL_P512R1
> > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 136
> > ikev2_pld_ke: dh group BRAINPOOL_P512R1 reserved 0
> > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00
> length 36
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP
> > ikev2_nat_detection: peer source 0x22cd85777285bb53 0x84c59f1c8f60d03f
> --US-IP--:500
> > ikev2_pld_payloads: payload NOTIFY nextpayload CERTREQ critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type
> NAT_DETECTION_DESTINATION_IP
> > ikev2_nat_detection: peer destination 0x22cd85777285bb53
> 0x84c59f1c8f60d03f --UK--:500
> > ikev2_pld_payloads: payload CERTREQ nextpayload NOTIFY critical 0x00
> length 25
> > ikev2_pld_certreq: type X509_CERT length 20
> > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length
> 14
> > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS
> > ikev2_pld_notify: signature hash SHA2_256 (2)
> > ikev2_pld_notify: signature hash SHA2_384 (3)
> > ikev2_pld_notify: signature hash SHA2_512 (4)
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > sa_stateflags: 0x0000 -> 0x0004 certreq (required 0x0009 cert,auth)
> > proposals_negotiate: score 3
> > sa_stateok: SA_INIT flags 0x0000, require 0x0009 cert,auth
> > spi=0x22cd85777285bb53: ikev2_sa_keys: DHSECRET with 64 bytes
> > ikev2_sa_keys: SKEYSEED with 64 bytes
> > spi=0x22cd85777285bb53: ikev2_sa_keys: S with 80 bytes
> > ikev2_prfplus: T1 with 64 bytes
> > ikev2_prfplus: T2 with 64 bytes
> > ikev2_prfplus: T3 with 64 bytes
> > ikev2_prfplus: T4 with 64 bytes
> > ikev2_prfplus: T5 with 64 bytes
> > ikev2_prfplus: Tn with 320 bytes
> > ikev2_sa_keys: SK_d with 64 bytes
> > ikev2_sa_keys: SK_ei with 36 bytes
> > ikev2_sa_keys: SK_er with 36 bytes
> > ikev2_sa_keys: SK_pi with 64 bytes
> > ikev2_sa_keys: SK_pr with 64 bytes
> > ikev2_msg_auth: initiator auth data length 406
> > ca_setauth: switching SIG_ANY to SIG
> > ca_setauth: auth length 406
> > sa_stateok: SA_INIT flags 0x0000, require 0x0009 cert,auth
> > config_free_proposals: free 0x3c27dfd8300
> > ca_getreq: found CA /C=FR/ST=Seine-Saint-Denis/L=Aubervilliers/O=Telecom
> Lobby/OU=VPNC/CN=--CA-HOST--
> > ca_x509_subjectaltname_do: did not find subjectAltName in certificate
> > ca_getreq: found local certificate /C=UK/ST=England/L=London/O=Telecom
> Lobby/OU=VPNC/CN=--UK-HOST--
> > _dsa_sign_encode: signature scheme 0 selected
> > _dsa_sign_encode: signature scheme 0 selected
> > _dsa_sign_encode: signature scheme 0 selected
> > ca_setauth: auth length 272
> > ikev2_getimsgdata: imsg 22 rspi 0x84c59f1c8f60d03f ispi
> 0x22cd85777285bb53 initiator 1 sa valid type 4 data length 1064
> > ikev2_dispatch_cert: cert type X509_CERT length 1064, ok
> > sa_stateflags: 0x0004 -> 0x0005 cert,certreq (required 0x0009 cert,auth)
> > sa_stateok: SA_INIT flags 0x0001, require 0x0009 cert,auth
> > ikev2_getimsgdata: imsg 28 rspi 0x84c59f1c8f60d03f ispi
> 0x22cd85777285bb53 initiator 1 sa valid type 14 data length 272
> > ikev2_dispatch_cert: AUTH type 14 len 272
> > sa_stateflags: 0x0005 -> 0x000d cert,certreq,auth (required 0x0009
> cert,auth)
> > sa_stateok: SA_INIT flags 0x0009, require 0x0009 cert,auth
> > ikev2_next_payload: length 35 nextpayload CERT
> > ikev2_next_payload: length 1069 nextpayload CERTREQ
> > ikev2_add_certreq: type X509_CERT length 21
> > ikev2_next_payload: length 25 nextpayload AUTH
> > ikev2_next_payload: length 280 nextpayload NOTIFY
> > ikev2_add_notify: done
> > ikev2_next_payload: length 8 nextpayload SA
> > pfkey_sa_getspi: spi 0xfc41aa70
> > pfkey_sa_init: new spi 0xfc41aa70
> > ikev2_add_proposals: length 40
> > ikev2_next_payload: length 44 nextpayload TSi
> > ikev2_next_payload: length 24 nextpayload TSr
> > ikev2_next_payload: length 24 nextpayload NONE
> > ikev2_next_payload: length 1534 nextpayload IDi
> > ikev2_msg_encrypt: decrypted length 1509
> > ikev2_msg_encrypt: padded length 1510
> > ikev2_msg_encrypt: length 1510, padding 0, output length 1530
> > ikev2_msg_integr: message length 1562
> > ikev2_msg_integr: integrity checksum length 12
> > ikev2_pld_parse: header ispi 0x22cd85777285bb53 rspi 0x84c59f1c8f60d03f
> nextpayload SK version 0x20 exchange IKE_AUTH flags 0x08 msgid 1 length
> 1562 response 0
> > ikev2_pld_payloads: payload SK nextpayload IDi critical 0x00 length 1534
> > ikev2_msg_decrypt: IV length 8
> > ikev2_msg_decrypt: encrypted payload length 1510
> > ikev2_msg_decrypt: integrity checksum length 12
> > ikev2_msg_decrypt: AAD length 32
> > ikev2_msg_decrypt: decrypted payload length 1510/1510 padding 0
> > ikev2_pld_payloads: decrypted payload IDi nextpayload CERT critical 0x00
> length 35
> > ikev2_pld_id: id UFQDN/--UK-ID-- length 31
> > ikev2_pld_payloads: decrypted payload CERT nextpayload CERTREQ critical
> 0x00 length 1069
> > ikev2_pld_cert: type X509_CERT length 1064
> > ikev2_pld_payloads: decrypted payload CERTREQ nextpayload AUTH critical
> 0x00 length 25
> > ikev2_pld_certreq: type X509_CERT length 20
> > ikev2_pld_payloads: decrypted payload AUTH nextpayload NOTIFY critical
> 0x00 length 280
> > ikev2_pld_auth: method SIG length 272
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload SA critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type USE_TRANSPORT_MODE
> > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00
> length 44
> > ikev2_pld_sa: more 0 reserved 0 length 40 proposal #1 protoid ESP
> spisize 4 xforms 3 spi 0xfc41aa70
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id
> CHACHA20_POLY1305
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type ESN id ESN
> > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id NONE
> > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --UK-- end --UK--
> > ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --US-IP-- end --US-IP--
> > spi=0x22cd85777285bb53: send IKE_AUTH req 1 peer --US-IP--:500 local
> --UK--:500, 1562 bytes
> > spi=0x22cd85777285bb53: recv IKE_AUTH res 1 peer --US-IP--:500 local
> --UK--:500, 1532 bytes, policy '--US-HOST--'
> > ikev2_recv: ispi 0x22cd85777285bb53 rspi 0x84c59f1c8f60d03f
> > ikev2_recv: updated SA to peer --US-IP--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0x22cd85777285bb53 rspi 0x84c59f1c8f60d03f
> nextpayload SK version 0x20 exchange IKE_AUTH flags 0x20 msgid 1 length
> 1532 response 1
> > ikev2_pld_payloads: payload SK nextpayload IDr critical 0x00 length 1504
> > ikev2_msg_decrypt: IV length 8
> > ikev2_msg_decrypt: encrypted payload length 1480
> > ikev2_msg_decrypt: integrity checksum length 12
> > ikev2_msg_decrypt: AAD length 32
> > ikev2_msg_decrypt: decrypted payload length 1480/1480 padding 0
> > ikev2_pld_payloads: decrypted payload IDr nextpayload CERT critical 0x00
> length 37
> > ikev2_pld_id: id UFQDN/saraswati@--CA-HOST-- length 33
> > ikev2_pld_payloads: decrypted payload CERT nextpayload AUTH critical
> 0x00 length 1070
> > ikev2_pld_cert: type X509_CERT length 1065
> > ikev2_pld_payloads: decrypted payload AUTH nextpayload NOTIFY critical
> 0x00 length 280
> > ikev2_pld_auth: method SIG length 272
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload SA critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type USE_TRANSPORT_MODE
> > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00
> length 36
> > ikev2_pld_sa: more 0 reserved 0 length 32 proposal #1 protoid ESP
> spisize 4 xforms 2 spi 0xd1bfd520
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id
> CHACHA20_POLY1305
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id ESN
> > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --UK-- end --UK--
> > ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --US-IP-- end --US-IP--
> > spi=0x22cd85777285bb53: sa_state: SA_INIT -> AUTH_REQUEST
> > proposals_negotiate: score 2
> > sa_stateflags: 0x000d -> 0x002d cert,certreq,auth,sa (required 0x0032
> certvalid,authvalid,sa)
> > config_free_proposals: free 0x3c27dfd8980
> > ca_validate_pubkey: could not open public key pubkeys/ufqdn/saraswati@
> --CA-HOST--
> > ca_validate_cert: /C=US/ST=Texas/L=Dallas/O=Telecom
> Lobby/OU=VPNC/CN=--US-HOST-- ok
> > ikev2_getimsgdata: imsg 23 rspi 0x84c59f1c8f60d03f ispi
> 0x22cd85777285bb53 initiator 1 sa valid type 4 data length 1065
> > ikev2_msg_auth: responder auth data length 431
> > ikev2_msg_authverify: method SIG keylen 1065 type X509_CERT
> > _dsa_verify_init: signature scheme 0 selected
> > ikev2_msg_authverify: authentication successful
> > spi=0x22cd85777285bb53: sa_state: AUTH_REQUEST -> AUTH_SUCCESS
> > sa_stateflags: 0x002d -> 0x003d cert,certreq,auth,authvalid,sa (required
> 0x0032 certvalid,authvalid,sa)
> > ikev2_dispatch_cert: peer certificate is valid
> > sa_stateflags: 0x003d -> 0x003f cert,certvalid,certreq,auth,authvalid,sa
> (required 0x0032 certvalid,authvalid,sa)
> > sa_stateok: VALID flags 0x0032, require 0x0032 certvalid,authvalid,sa
> > spi=0x22cd85777285bb53: sa_state: AUTH_SUCCESS -> VALID
> > sa_stateok: VALID flags 0x0032, require 0x0032 certvalid,authvalid,sa
> > sa_stateok: VALID flags 0x0032, require 0x0032 certvalid,authvalid,sa
> > ikev2_sa_tag: (0)
> > ikev2_childsa_negotiate: proposal 1
> > ikev2_childsa_negotiate: key material length 72
> > ikev2_prfplus: T1 with 64 bytes
> > ikev2_prfplus: T2 with 64 bytes
> > ikev2_prfplus: Tn with 128 bytes
> > pfkey_sa_add: add spi 0xd1bfd520
> > ikev2_childsa_enable: loaded CHILD SA spi 0xd1bfd520
> > pfkey_sa_add: update spi 0xfc41aa70
> > ikev2_childsa_enable: loaded CHILD SA spi 0xfc41aa70
> > ikev2_childsa_enable: loaded flow 0x3c2c0b8f800
> > ikev2_childsa_enable: loaded flow 0x3c27dfda400
> > ikev2_childsa_enable: remember SA peer --US-IP--:500
> > spi=0x22cd85777285bb53: ikev2_childsa_enable: loaded SPIs: 0xd1bfd520,
> 0xfc41aa70
> > spi=0x22cd85777285bb53: ikev2_childsa_enable: loaded flows:
> ESP---UK--/32=--US-IP--/32(47)
> > spi=0x22cd85777285bb53: sa_state: VALID -> ESTABLISHED from
> --US-IP--:500 to --UK--:500 policy '--US-HOST--'
> > spi=0x22cd85777285bb53: established peer --US-IP--:500[UFQDN/saraswati@--CA-HOST--]
> local --UK--:500[UFQDN/--UK-ID--] policy '--US-HOST--' as initiator
> > spi=0x67cb9c572ac8b67e: recv IKE_SA_INIT res 0 peer --JP-IP--:500 local
> --UK--:500, 335 bytes, policy '--JP-HOST--'
> > ikev2_recv: ispi 0x67cb9c572ac8b67e rspi 0x2c3aab6ceed004e7
> > ikev2_recv: updated SA to peer --JP-IP--:500 local --UK--:500
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > ikev2_pld_parse: header ispi 0x67cb9c572ac8b67e rspi 0x2c3aab6ceed004e7
> nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x20 msgid 0 length
> 335 response 1
> > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 40
> > ikev2_pld_sa: more 0 reserved 0 length 36 proposal #1 protoid IKE
> spisize 0 xforms 3 spi 0
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_512
> > ikev2_pld_xform: more 0 reserved 0 length 8 type DH id BRAINPOOL_P512R1
> > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 136
> > ikev2_pld_ke: dh group BRAINPOOL_P512R1 reserved 0
> > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00
> length 36
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP
> > ikev2_nat_detection: peer source 0x67cb9c572ac8b67e 0x2c3aab6ceed004e7
> --JP-IP--:500
> > ikev2_pld_payloads: payload NOTIFY nextpayload CERTREQ critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type
> NAT_DETECTION_DESTINATION_IP
> > ikev2_nat_detection: peer destination 0x67cb9c572ac8b67e
> 0x2c3aab6ceed004e7 --UK--:500
> > ikev2_pld_payloads: payload CERTREQ nextpayload NOTIFY critical 0x00
> length 25
> > ikev2_pld_certreq: type X509_CERT length 20
> > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length
> 14
> > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS
> > ikev2_pld_notify: signature hash SHA2_256 (2)
> > ikev2_pld_notify: signature hash SHA2_384 (3)
> > ikev2_pld_notify: signature hash SHA2_512 (4)
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > sa_stateflags: 0x0000 -> 0x0004 certreq (required 0x0009 cert,auth)
> > proposals_negotiate: score 3
> > sa_stateok: SA_INIT flags 0x0000, require 0x0009 cert,auth
> > spi=0x67cb9c572ac8b67e: ikev2_sa_keys: DHSECRET with 64 bytes
> > ikev2_sa_keys: SKEYSEED with 64 bytes
> > spi=0x67cb9c572ac8b67e: ikev2_sa_keys: S with 80 bytes
> > ikev2_prfplus: T1 with 64 bytes
> > ikev2_prfplus: T2 with 64 bytes
> > ikev2_prfplus: T3 with 64 bytes
> > ikev2_prfplus: T4 with 64 bytes
> > ikev2_prfplus: T5 with 64 bytes
> > ikev2_prfplus: Tn with 320 bytes
> > ikev2_sa_keys: SK_d with 64 bytes
> > ikev2_sa_keys: SK_ei with 36 bytes
> > ikev2_sa_keys: SK_er with 36 bytes
> > ikev2_sa_keys: SK_pi with 64 bytes
> > ikev2_sa_keys: SK_pr with 64 bytes
> > ikev2_msg_auth: initiator auth data length 406
> > ca_setauth: switching SIG_ANY to SIG
> > ca_setauth: auth length 406
> > sa_stateok: SA_INIT flags 0x0000, require 0x0009 cert,auth
> > config_free_proposals: free 0x3c2a56dad00
> > ca_getreq: found CA /C=FR/ST=Seine-Saint-Denis/L=Aubervilliers/O=Telecom
> Lobby/OU=VPNC/CN=--CA-HOST--
> > ca_x509_subjectaltname_do: did not find subjectAltName in certificate
> > ca_getreq: found local certificate /C=UK/ST=England/L=London/O=Telecom
> Lobby/OU=VPNC/CN=--UK-HOST--
> > _dsa_sign_encode: signature scheme 0 selected
> > _dsa_sign_encode: signature scheme 0 selected
> > _dsa_sign_encode: signature scheme 0 selected
> > ca_setauth: auth length 272
> > ikev2_getimsgdata: imsg 22 rspi 0x2c3aab6ceed004e7 ispi
> 0x67cb9c572ac8b67e initiator 1 sa valid type 4 data length 1064
> > ikev2_dispatch_cert: cert type X509_CERT length 1064, ok
> > sa_stateflags: 0x0004 -> 0x0005 cert,certreq (required 0x0009 cert,auth)
> > sa_stateok: SA_INIT flags 0x0001, require 0x0009 cert,auth
> > ikev2_getimsgdata: imsg 28 rspi 0x2c3aab6ceed004e7 ispi
> 0x67cb9c572ac8b67e initiator 1 sa valid type 14 data length 272
> > ikev2_dispatch_cert: AUTH type 14 len 272
> > sa_stateflags: 0x0005 -> 0x000d cert,certreq,auth (required 0x0009
> cert,auth)
> > sa_stateok: SA_INIT flags 0x0009, require 0x0009 cert,auth
> > ikev2_next_payload: length 35 nextpayload CERT
> > ikev2_next_payload: length 1069 nextpayload CERTREQ
> > ikev2_add_certreq: type X509_CERT length 21
> > ikev2_next_payload: length 25 nextpayload AUTH
> > ikev2_next_payload: length 280 nextpayload NOTIFY
> > ikev2_add_notify: done
> > ikev2_next_payload: length 8 nextpayload SA
> > pfkey_sa_getspi: spi 0x4701e9b5
> > pfkey_sa_init: new spi 0x4701e9b5
> > ikev2_add_proposals: length 40
> > ikev2_next_payload: length 44 nextpayload TSi
> > ikev2_next_payload: length 24 nextpayload TSr
> > ikev2_next_payload: length 24 nextpayload NONE
> > ikev2_next_payload: length 1534 nextpayload IDi
> > ikev2_msg_encrypt: decrypted length 1509
> > ikev2_msg_encrypt: padded length 1510
> > ikev2_msg_encrypt: length 1510, padding 0, output length 1530
> > ikev2_msg_integr: message length 1562
> > ikev2_msg_integr: integrity checksum length 12
> > ikev2_pld_parse: header ispi 0x67cb9c572ac8b67e rspi 0x2c3aab6ceed004e7
> nextpayload SK version 0x20 exchange IKE_AUTH flags 0x08 msgid 1 length
> 1562 response 0
> > ikev2_pld_payloads: payload SK nextpayload IDi critical 0x00 length 1534
> > ikev2_msg_decrypt: IV length 8
> > ikev2_msg_decrypt: encrypted payload length 1510
> > ikev2_msg_decrypt: integrity checksum length 12
> > ikev2_msg_decrypt: AAD length 32
> > ikev2_msg_decrypt: decrypted payload length 1510/1510 padding 0
> > ikev2_pld_payloads: decrypted payload IDi nextpayload CERT critical 0x00
> length 35
> > ikev2_pld_id: id UFQDN/--UK-ID-- length 31
> > ikev2_pld_payloads: decrypted payload CERT nextpayload CERTREQ critical
> 0x00 length 1069
> > ikev2_pld_cert: type X509_CERT length 1064
> > ikev2_pld_payloads: decrypted payload CERTREQ nextpayload AUTH critical
> 0x00 length 25
> > ikev2_pld_certreq: type X509_CERT length 20
> > ikev2_pld_payloads: decrypted payload AUTH nextpayload NOTIFY critical
> 0x00 length 280
> > ikev2_pld_auth: method SIG length 272
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload SA critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type USE_TRANSPORT_MODE
> > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00
> length 44
> > ikev2_pld_sa: more 0 reserved 0 length 40 proposal #1 protoid ESP
> spisize 4 xforms 3 spi 0x4701e9b5
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id
> CHACHA20_POLY1305
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type ESN id ESN
> > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id NONE
> > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --UK-- end --UK--
> > ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --JP-IP-- end --JP-IP--
> > spi=0x67cb9c572ac8b67e: send IKE_AUTH req 1 peer --JP-IP--:500 local
> --UK--:500, 1562 bytes
> > spi=0x67cb9c572ac8b67e: recv IKE_AUTH res 1 peer --JP-IP--:500 local
> --UK--:500, 1527 bytes, policy '--JP-HOST--'
> > ikev2_recv: ispi 0x67cb9c572ac8b67e rspi 0x2c3aab6ceed004e7
> > ikev2_recv: updated SA to peer --JP-IP--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0x67cb9c572ac8b67e rspi 0x2c3aab6ceed004e7
> nextpayload SK version 0x20 exchange IKE_AUTH flags 0x20 msgid 1 length
> 1527 response 1
> > ikev2_pld_payloads: payload SK nextpayload IDr critical 0x00 length 1499
> > ikev2_msg_decrypt: IV length 8
> > ikev2_msg_decrypt: encrypted payload length 1475
> > ikev2_msg_decrypt: integrity checksum length 12
> > ikev2_msg_decrypt: AAD length 32
> > ikev2_msg_decrypt: decrypted payload length 1475/1475 padding 0
> > ikev2_pld_payloads: decrypted payload IDr nextpayload CERT critical 0x00
> length 33
> > ikev2_pld_id: id UFQDN/shiva@--CA-HOST-- length 29
> > ikev2_pld_payloads: decrypted payload CERT nextpayload AUTH critical
> 0x00 length 1069
> > ikev2_pld_cert: type X509_CERT length 1064
> > ikev2_pld_payloads: decrypted payload AUTH nextpayload NOTIFY critical
> 0x00 length 280
> > ikev2_pld_auth: method SIG length 272
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload SA critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type USE_TRANSPORT_MODE
> > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00
> length 36
> > ikev2_pld_sa: more 0 reserved 0 length 32 proposal #1 protoid ESP
> spisize 4 xforms 2 spi 0xb1bffe2d
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id
> CHACHA20_POLY1305
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id ESN
> > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --UK-- end --UK--
> > ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --JP-IP-- end --JP-IP--
> > spi=0x67cb9c572ac8b67e: sa_state: SA_INIT -> AUTH_REQUEST
> > proposals_negotiate: score 2
> > sa_stateflags: 0x000d -> 0x002d cert,certreq,auth,sa (required 0x0032
> certvalid,authvalid,sa)
> > config_free_proposals: free 0x3c31292ac00
> > ca_validate_pubkey: could not open public key pubkeys/ufqdn/shiva@
> --CA-HOST--
> > ca_validate_cert: /C=JP/ST=Tokyo/L=Heiwajima/O=Telecom
> Lobby/OU=VPNC/CN=--JP-HOST-- ok
> > ikev2_getimsgdata: imsg 23 rspi 0x2c3aab6ceed004e7 ispi
> 0x67cb9c572ac8b67e initiator 1 sa valid type 4 data length 1064
> > ikev2_msg_auth: responder auth data length 431
> > ikev2_msg_authverify: method SIG keylen 1064 type X509_CERT
> > _dsa_verify_init: signature scheme 0 selected
> > ikev2_msg_authverify: authentication successful
> > spi=0x67cb9c572ac8b67e: sa_state: AUTH_REQUEST -> AUTH_SUCCESS
> > sa_stateflags: 0x002d -> 0x003d cert,certreq,auth,authvalid,sa (required
> 0x0032 certvalid,authvalid,sa)
> > ikev2_dispatch_cert: peer certificate is valid
> > sa_stateflags: 0x003d -> 0x003f cert,certvalid,certreq,auth,authvalid,sa
> (required 0x0032 certvalid,authvalid,sa)
> > sa_stateok: VALID flags 0x0032, require 0x0032 certvalid,authvalid,sa
> > spi=0x67cb9c572ac8b67e: sa_state: AUTH_SUCCESS -> VALID
> > sa_stateok: VALID flags 0x0032, require 0x0032 certvalid,authvalid,sa
> > sa_stateok: VALID flags 0x0032, require 0x0032 certvalid,authvalid,sa
> > ikev2_sa_tag: (0)
> > ikev2_childsa_negotiate: proposal 1
> > ikev2_childsa_negotiate: key material length 72
> > ikev2_prfplus: T1 with 64 bytes
> > ikev2_prfplus: T2 with 64 bytes
> > ikev2_prfplus: Tn with 128 bytes
> > pfkey_sa_add: add spi 0xb1bffe2d
> > ikev2_childsa_enable: loaded CHILD SA spi 0xb1bffe2d
> > pfkey_sa_add: update spi 0x4701e9b5
> > ikev2_childsa_enable: loaded CHILD SA spi 0x4701e9b5
> > ikev2_childsa_enable: loaded flow 0x3c2eec20c00
> > ikev2_childsa_enable: loaded flow 0x3c324182000
> > ikev2_childsa_enable: remember SA peer --JP-IP--:500
> > spi=0x67cb9c572ac8b67e: ikev2_childsa_enable: loaded SPIs: 0xb1bffe2d,
> 0x4701e9b5
> > spi=0x67cb9c572ac8b67e: ikev2_childsa_enable: loaded flows:
> ESP---UK--/32=--JP-IP--/32(47)
> > spi=0x67cb9c572ac8b67e: sa_state: VALID -> ESTABLISHED from
> --JP-IP--:500 to --UK--:500 policy '--JP-HOST--'
> > spi=0x67cb9c572ac8b67e: established peer --JP-IP--:500[UFQDN/shiva@--CA-HOST--]
> local --UK--:500[UFQDN/--UK-ID--] policy '--JP-HOST--' as initiator
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xc5881d3ed32f5801: recv INFORMATIONAL req 4428 peer --FR--:500
> local --UK--:500, 96 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xc5881d3ed32f5801 rspi 0xfcad33aa65954d8e
> > ikev2_init_recv: unknown SA
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xc5881d3ed32f5801: recv INFORMATIONAL req 4428 peer --FR--:500
> local --UK--:500, 96 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xc5881d3ed32f5801 rspi 0xfcad33aa65954d8e
> > ikev2_init_recv: unknown SA
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xc5881d3ed32f5801: recv INFORMATIONAL req 4428 peer --FR--:500
> local --UK--:500, 96 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xc5881d3ed32f5801 rspi 0xfcad33aa65954d8e
> > ikev2_init_recv: unknown SA
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 0 peer --FR--:500 local
> --UK--:500, 112 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 0
> length 112 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 84
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 48
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 48/48 padding 47
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 0
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 0 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003184
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003184
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003183
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 3
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003183
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 3
> second(s) ago
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xb3a689d63d247dd3: recv INFORMATIONAL req 2 peer --CAT--:4500 local
> --UK--:4500, 80 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xb3a689d63d247dd3 rspi 0x3ec4e46becafef14
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xf94ce3fc2e48f7f2: recv IKE_SA_INIT req 0 peer --CAT--:500 local
> --UK--:500, 1056 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xf94ce3fc2e48f7f2 rspi 0x0000000000000000
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > ikev2_pld_parse: header ispi 0xf94ce3fc2e48f7f2 rspi 0x0000000000000000
> nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x08 msgid 0 length
> 1056 response 0
> > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 832
> > ikev2_pld_sa: more 2 reserved 0 length 352 proposal #1 protoid IKE
> spisize 0 xforms 37 spi 0
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CTR
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CTR
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CTR
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CTR
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CTR
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CTR
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type ENCR id 3DES
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_256_128
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_384_192
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_512_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id HMAC_SHA1_96
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id AES_XCBC_96
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id AES_CMAC_96
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_384
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_512
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id AES128_XCBC
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id AES128_CMAC
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_384
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_521
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P256R1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P384R1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P512R1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id CURVE25519
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_3072
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_4096
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_6144
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_8192
> > ikev2_pld_xform: more 0 reserved 0 length 8 type DH id MODP_2048
> > ikev2_pld_sa: more 0 reserved 0 length 476 proposal #2 protoid IKE
> spisize 0 xforms 45 spi 0
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_384
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_512
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id AES128_XCBC
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id AES128_CMAC
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_384
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_521
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P256R1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P384R1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P512R1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id CURVE25519
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_3072
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_4096
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_6144
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_8192
> > ikev2_pld_xform: more 0 reserved 0 length 8 type DH id MODP_2048
> > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 72
> > ikev2_pld_ke: dh group ECP_256 reserved 0
> > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00
> length 36
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP
> > ikev2_nat_detection: peer source 0xf94ce3fc2e48f7f2 0x0000000000000000
> --CAT--:500
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type
> NAT_DETECTION_DESTINATION_IP
> > ikev2_nat_detection: peer destination 0xf94ce3fc2e48f7f2
> 0x0000000000000000 --UK--:500
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type FRAGMENTATION_SUPPORTED
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 16
> > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS
> > ikev2_pld_notify: signature hash SHA2_256 (2)
> > ikev2_pld_notify: signature hash SHA2_384 (3)
> > ikev2_pld_notify: signature hash SHA2_512 (4)
> > ikev2_pld_notify: signature hash <UNKNOWN:5> (5)
> > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length
> 8
> > ikev2_pld_notify: protoid NONE spisize 0 type REDIRECT_SUPPORTED
> > proposals_negotiate: score 4
> > proposals_negotiate: score 0
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xf94ce3fc2e48f7f2: sa_state: INIT -> SA_INIT
> > proposals_negotiate: score 4
> > proposals_negotiate: score 0
> > sa_stateok: SA_INIT flags 0x0000, require 0x0000
> > sa_stateflags: 0x0000 -> 0x0020 sa (required 0x0000 )
> > spi=0xf94ce3fc2e48f7f2: ikev2_sa_keys: DHSECRET with 32 bytes
> > ikev2_sa_keys: SKEYSEED with 32 bytes
> > spi=0xf94ce3fc2e48f7f2: ikev2_sa_keys: S with 80 bytes
> > ikev2_prfplus: T1 with 32 bytes
> > ikev2_prfplus: T2 with 32 bytes
> > ikev2_prfplus: T3 with 32 bytes
> > ikev2_prfplus: T4 with 32 bytes
> > ikev2_prfplus: T5 with 32 bytes
> > ikev2_prfplus: T6 with 32 bytes
> > ikev2_prfplus: T7 with 32 bytes
> > ikev2_prfplus: Tn with 224 bytes
> > ikev2_sa_keys: SK_d with 32 bytes
> > ikev2_sa_keys: SK_ai with 32 bytes
> > ikev2_sa_keys: SK_ar with 32 bytes
> > ikev2_sa_keys: SK_ei with 32 bytes
> > ikev2_sa_keys: SK_er with 32 bytes
> > ikev2_sa_keys: SK_pi with 32 bytes
> > ikev2_sa_keys: SK_pr with 32 bytes
> > ikev2_add_proposals: length 44
> > ikev2_next_payload: length 48 nextpayload KE
> > ikev2_next_payload: length 72 nextpayload NONCE
> > ikev2_next_payload: length 36 nextpayload NOTIFY
> > ikev2_nat_detection: local source 0xf94ce3fc2e48f7f2 0x1d51ac7d723a726d
> --UK--:500
> > ikev2_next_payload: length 28 nextpayload NOTIFY
> > ikev2_nat_detection: local destination 0xf94ce3fc2e48f7f2
> 0x1d51ac7d723a726d --CAT--:500
> > ikev2_next_payload: length 28 nextpayload CERTREQ
> > ikev2_add_certreq: type X509_CERT length 21
> > ikev2_next_payload: length 25 nextpayload NOTIFY
> > ikev2_next_payload: length 14 nextpayload NONE
> > ikev2_pld_parse: header ispi 0xf94ce3fc2e48f7f2 rspi 0x1d51ac7d723a726d
> nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x20 msgid 0 length
> 279 response 1
> > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 48
> > ikev2_pld_sa: more 0 reserved 0 length 44 proposal #1 protoid IKE
> spisize 0 xforms 4 spi 0
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_256_128
> > ikev2_pld_xform: more 0 reserved 0 length 8 type DH id ECP_256
> > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 72
> > ikev2_pld_ke: dh group ECP_256 reserved 0
> > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00
> length 36
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP
> > ikev2_pld_payloads: payload NOTIFY nextpayload CERTREQ critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type
> NAT_DETECTION_DESTINATION_IP
> > ikev2_pld_payloads: payload CERTREQ nextpayload NOTIFY critical 0x00
> length 25
> > ikev2_pld_certreq: type X509_CERT length 20
> > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length
> 14
> > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS
> > spi=0xf94ce3fc2e48f7f2: send IKE_SA_INIT res 0 peer --CAT--:500 local
> --UK--:500, 279 bytes
> > config_free_proposals: free 0x3c31292ae80
> > config_free_proposals: free 0x3c31292a880
> > spi=0xf94ce3fc2e48f7f2: recv IKE_AUTH req 1 peer --CAT--:4500 local
> --UK--:4500, 1792 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xf94ce3fc2e48f7f2 rspi 0x1d51ac7d723a726d
> > ikev2_recv: updated SA to peer --CAT--:4500 local --UK--:4500
> > ikev2_pld_parse: header ispi 0xf94ce3fc2e48f7f2 rspi 0x1d51ac7d723a726d
> nextpayload SK version 0x20 exchange IKE_AUTH flags 0x08 msgid 1 length
> 1792 response 0
> > ikev2_pld_payloads: payload SK nextpayload IDi critical 0x00 length 1764
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 1728
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 1728/1728 padding 11
> > ikev2_pld_payloads: decrypted payload IDi nextpayload CERT critical 0x00
> length 33
> > ikev2_pld_id: id UFQDN/indra@--CA-HOST-- length 29
> > ikev2_pld_payloads: decrypted payload CERT nextpayload NOTIFY critical
> 0x00 length 1090
> > ikev2_pld_cert: type X509_CERT length 1085
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload CERTREQ
> critical 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type INITIAL_CONTACT
> > ikev2_pld_payloads: decrypted payload CERTREQ nextpayload AUTH critical
> 0x00 length 85
> > ikev2_pld_certreq: type X509_CERT length 80
> > ikev2_pld_payloads: decrypted payload AUTH nextpayload CP critical 0x00
> length 280
> > ikev2_pld_auth: method SIG length 272
> > ikev2_pld_payloads: decrypted payload CP nextpayload NOTIFY critical
> 0x00 length 16
> > ikev2_pld_cp: type REQUEST length 8
> > ikev2_pld_cp: INTERNAL_IP4_ADDRESS 0x0001 length 0
> > ikev2_pld_cp: INTERNAL_IP4_DNS 0x0003 length 0
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload SA critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type USE_TRANSPORT_MODE
> > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00
> length 100
> > ikev2_pld_sa: more 0 reserved 0 length 96 proposal #1 protoid ESP
> spisize 4 xforms 9 spi 0xc9f9084d
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_256_128
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_384_192
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_512_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id HMAC_SHA1_96
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id AES_XCBC_96
> > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id NONE
> > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start 0.0.0.0 end 255.255.255.255
> > ikev2_pld_payloads: decrypted payload TSr nextpayload NOTIFY critical
> 0x00 length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --UK-- end --UK--
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload NOTIFY critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type MOBIKE_SUPPORTED
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload NOTIFY critical
> 0x00 length 24
> > ikev2_pld_notify: protoid NONE spisize 0 type ADDITIONAL_IP6_ADDRESS
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload NOTIFY critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type EAP_ONLY_AUTHENTICATION
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload NONE critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type
> IKEV2_MESSAGE_ID_SYNC_SUPPORTED
> > ikev2_handle_notifies: mobike enabled
> > sa_stateok: SA_INIT flags 0x0000, require 0x0000
> > spi=0xf94ce3fc2e48f7f2: sa_state: SA_INIT -> AUTH_REQUEST
> > policy_lookup: peerid 'indra@--CA-HOST--'
> > proposals_negotiate: score 4
> > policy_lookup: setting policy '--CAT-HOST--'
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > sa_stateflags: 0x0020 -> 0x0024 certreq,sa (required 0x003b
> cert,certvalid,auth,authvalid,sa)
> > ikev2_msg_auth: responder auth data length 343
> > ca_setauth: switching SIG_ANY to SIG
> > ca_setauth: auth length 343
> > proposals_negotiate: score 4
> > sa_stateflags: 0x0024 -> 0x0024 certreq,sa (required 0x003b
> cert,certvalid,auth,authvalid,sa)
> > config_free_proposals: free 0x3c31292a480
> > ca_getreq: found CA /C=FR/ST=Seine-Saint-Denis/L=Aubervilliers/O=Telecom
> Lobby/OU=VPNC/CN=--CA-HOST--
> > ca_x509_subjectaltname_do: did not find subjectAltName in certificate
> > ca_getreq: found local certificate /C=UK/ST=England/L=London/O=Telecom
> Lobby/OU=VPNC/CN=--UK-HOST--
> > _dsa_sign_encode: signature scheme 0 selected
> > _dsa_sign_encode: signature scheme 0 selected
> > _dsa_sign_encode: signature scheme 0 selected
> > ca_setauth: auth length 272
> > ca_validate_pubkey: could not open public key pubkeys/ufqdn/indra@
> --CA-HOST--
> > ca_validate_cert: /C=ES/ST=Catalunya/L=sant Pere de Ribes/O=Telecom
> Lobby/OU=VPNC/CN=--CAT-HOST-- ok
> > ikev2_getimsgdata: imsg 22 rspi 0x1d51ac7d723a726d ispi
> 0xf94ce3fc2e48f7f2 initiator 0 sa valid type 4 data length 1064
> > ikev2_dispatch_cert: cert type X509_CERT length 1064, ok
> > sa_stateflags: 0x0024 -> 0x0025 cert,certreq,sa (required 0x003b
> cert,certvalid,auth,authvalid,sa)
> > ikev2_getimsgdata: imsg 28 rspi 0x1d51ac7d723a726d ispi
> 0xf94ce3fc2e48f7f2 initiator 0 sa valid type 14 data length 272
> > ikev2_dispatch_cert: AUTH type 14 len 272
> > sa_stateflags: 0x0025 -> 0x002d cert,certreq,auth,sa (required 0x003b
> cert,certvalid,auth,authvalid,sa)
> > ikev2_getimsgdata: imsg 23 rspi 0x1d51ac7d723a726d ispi
> 0xf94ce3fc2e48f7f2 initiator 0 sa valid type 4 data length 1085
> > ikev2_msg_auth: initiator auth data length 1120
> > ikev2_msg_authverify: method SIG keylen 1085 type X509_CERT
> > _dsa_verify_init: signature scheme 0 selected
> > ikev2_msg_authverify: authentication successful
> > spi=0xf94ce3fc2e48f7f2: sa_state: AUTH_REQUEST -> AUTH_SUCCESS
> > sa_stateflags: 0x002d -> 0x003d cert,certreq,auth,authvalid,sa (required
> 0x003b cert,certvalid,auth,authvalid,sa)
> > ikev2_dispatch_cert: peer certificate is valid
> > sa_stateflags: 0x003d -> 0x003f cert,certvalid,certreq,auth,authvalid,sa
> (required 0x003b cert,certvalid,auth,authvalid,sa)
> > sa_stateok: VALID flags 0x003b, require 0x003b
> cert,certvalid,auth,authvalid,sa
> > spi=0xf94ce3fc2e48f7f2: sa_state: AUTH_SUCCESS -> VALID
> > sa_stateok: VALID flags 0x003b, require 0x003b
> cert,certvalid,auth,authvalid,sa
> > sa_stateok: VALID flags 0x003b, require 0x003b
> cert,certvalid,auth,authvalid,sa
> > ikev2_sa_tag: (0)
> > ikev2_childsa_negotiate: proposal 1
> > ikev2_childsa_negotiate: key material length 128
> > ikev2_prfplus: T1 with 32 bytes
> > ikev2_prfplus: T2 with 32 bytes
> > ikev2_prfplus: T3 with 32 bytes
> > ikev2_prfplus: T4 with 32 bytes
> > ikev2_prfplus: Tn with 128 bytes
> > pfkey_sa_getspi: spi 0xba75d84f
> > pfkey_sa_init: new spi 0xba75d84f
> > ikev2_next_payload: length 35 nextpayload CERT
> > ikev2_next_payload: length 1069 nextpayload AUTH
> > ikev2_next_payload: length 280 nextpayload CP
> > ikev2_next_payload: length 8 nextpayload NOTIFY
> > ikev2_add_notify: done
> > ikev2_next_payload: length 8 nextpayload NOTIFY
> > ikev2_add_notify: done
> > ikev2_next_payload: length 8 nextpayload SA
> > ikev2_add_proposals: length 40
> > ikev2_next_payload: length 44 nextpayload TSi
> > ikev2_next_payload: length 24 nextpayload TSr
> > ikev2_next_payload: length 24 nextpayload NONE
> > ikev2_next_payload: length 1540 nextpayload IDr
> > ikev2_msg_encrypt: decrypted length 1500
> > ikev2_msg_encrypt: padded length 1504
> > ikev2_msg_encrypt: length 1501, padding 3, output length 1536
> > ikev2_msg_integr: message length 1568
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf94ce3fc2e48f7f2 rspi 0x1d51ac7d723a726d
> nextpayload SK version 0x20 exchange IKE_AUTH flags 0x20 msgid 1 length
> 1568 response 1
> > ikev2_pld_payloads: payload SK nextpayload IDr critical 0x00 length 1540
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 1504
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 1504/1504 padding 3
> > ikev2_pld_payloads: decrypted payload IDr nextpayload CERT critical 0x00
> length 35
> > ikev2_pld_id: id UFQDN/--UK-ID-- length 31
> > ikev2_pld_payloads: decrypted payload CERT nextpayload AUTH critical
> 0x00 length 1069
> > ikev2_pld_cert: type X509_CERT length 1064
> > ikev2_pld_payloads: decrypted payload AUTH nextpayload CP critical 0x00
> length 280
> > ikev2_pld_auth: method SIG length 272
> > ikev2_pld_payloads: decrypted payload CP nextpayload NOTIFY critical
> 0x00 length 8
> > ikev2_pld_cp: type REPLY length 0
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload NOTIFY critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type USE_TRANSPORT_MODE
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload SA critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type MOBIKE_SUPPORTED
> > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00
> length 44
> > ikev2_pld_sa: more 0 reserved 0 length 40 proposal #1 protoid ESP
> spisize 4 xforms 3 spi 0xba75d84f
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_256_128
> > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id NONE
> > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --CAT-- end --CAT--
> > ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --UK-- end --UK--
> > spi=0xf94ce3fc2e48f7f2: send IKE_AUTH res 1 peer --CAT--:4500 local
> --UK--:4500, 1568 bytes, NAT-T
> > pfkey_sa_add: update spi 0xba75d84f
> > ikev2_childsa_enable: loaded CHILD SA spi 0xba75d84f
> > pfkey_sa_add: add spi 0xc9f9084d
> > ikev2_childsa_enable: loaded CHILD SA spi 0xc9f9084d
> > ikev2_childsa_enable: loaded flow 0x3c324182800
> > ikev2_childsa_enable: loaded flow 0x3c2eec20400
> > ikev2_childsa_enable: remember SA peer --CAT--:4500
> > spi=0xf94ce3fc2e48f7f2: ikev2_childsa_enable: loaded SPIs: 0xba75d84f,
> 0xc9f9084d
> > spi=0xf94ce3fc2e48f7f2: ikev2_childsa_enable: loaded flows:
> ESP---UK--/32=--CAT--/32(47)
> > spi=0xf94ce3fc2e48f7f2: sa_state: VALID -> ESTABLISHED from --CAT--:4500
> to --UK--:4500 policy '--CAT-HOST--'
> > spi=0xf94ce3fc2e48f7f2: established peer --CAT--:4500[UFQDN/indra@--CA-HOST--]
> local --UK--:4500[UFQDN/--UK-ID--] policy '--CAT-HOST--' as responder
> > pfkey_sa_lookup: last_used 1614003186
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003186
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 0
> second(s) ago
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xc5881d3ed32f5801: recv INFORMATIONAL req 4428 peer --FR--:500
> local --UK--:500, 96 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xc5881d3ed32f5801 rspi 0xfcad33aa65954d8e
> > ikev2_init_recv: unknown SA
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xb3a689d63d247dd3: recv INFORMATIONAL req 2 peer --CAT--:4500 local
> --UK--:4500, 80 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xb3a689d63d247dd3 rspi 0x3ec4e46becafef14
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xc5881d3ed32f5801: recv INFORMATIONAL req 4429 peer --FR--:500
> local --UK--:500, 240 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xc5881d3ed32f5801 rspi 0xfcad33aa65954d8e
> > ikev2_init_recv: unknown SA
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xb3a689d63d247dd3: recv INFORMATIONAL req 2 peer --CAT--:4500 local
> --UK--:4500, 80 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xb3a689d63d247dd3 rspi 0x3ec4e46becafef14
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 1 peer --FR--:500 local
> --UK--:500, 128 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 1
> length 128 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 100
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 64
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 64/64 padding 63
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 1
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 1 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003199
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003199
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003198
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 3
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003198
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 3
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003201
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xba75d84f last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003201
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003201
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 0
> second(s) ago
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xb3a689d63d247dd3: recv INFORMATIONAL req 2 peer --CAT--:4500 local
> --UK--:4500, 80 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xb3a689d63d247dd3 rspi 0x3ec4e46becafef14
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 2 peer --FR--:500 local
> --UK--:500, 144 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 2
> length 144 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 116
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 80
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 80/80 padding 79
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 2
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 2 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003214
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003214
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003216
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003216
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003216
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xba75d84f last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003216
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003216
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 0
> second(s) ago
> > ikev2_init_ike_sa: "--FR-HOST--" is already active
> > ikev2_init_ike_sa: "--US-HOST--" is already active
> > ikev2_init_ike_sa: "--JP-HOST--" is already active
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 3 peer --FR--:500 local
> --UK--:500, 112 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 3
> length 112 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 84
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 48
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 48/48 padding 47
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 3
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 3 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003229
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003229
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003231
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003231
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003231
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xba75d84f last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003231
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003231
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 0
> second(s) ago
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xb3a689d63d247dd3: recv INFORMATIONAL req 2 peer --CAT--:4500 local
> --UK--:4500, 80 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xb3a689d63d247dd3 rspi 0x3ec4e46becafef14
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 4 peer --FR--:500 local
> --UK--:500, 128 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 4
> length 128 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 100
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 64
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 64/64 padding 63
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 4
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 4 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003244
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003245
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003246
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003246
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003246
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xba75d84f last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003246
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003246
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 0
> second(s) ago
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 5 peer --FR--:500 local
> --UK--:500, 96 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 5
> length 96 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 68
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 32
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 32/32 padding 31
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 5
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 5 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003259
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003259
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003261
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003261
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003261
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xba75d84f last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003261
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003261
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 0
> second(s) ago
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0xb3a689d63d247dd3: recv INFORMATIONAL req 2 peer --CAT--:4500 local
> --UK--:4500, 80 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xb3a689d63d247dd3 rspi 0x3ec4e46becafef14
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 6 peer --FR--:500 local
> --UK--:500, 96 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 6
> length 96 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 68
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 32
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 32/32 padding 31
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 6
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 6 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003275
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003275
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003276
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003276
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003276
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xba75d84f last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003276
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003275
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 1
> second(s) ago
> > ikev2_init_ike_sa: "--FR-HOST--" is already active
> > ikev2_init_ike_sa: "--US-HOST--" is already active
> > ikev2_init_ike_sa: "--JP-HOST--" is already active
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 7 peer --FR--:500 local
> --UK--:500, 112 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 7
> length 112 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 84
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 48
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 48/48 padding 47
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 7
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 7 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003290
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003290
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003291
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003291
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003291
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xba75d84f last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003291
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003290
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 1
> second(s) ago
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 8 peer --FR--:500 local
> --UK--:500, 144 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 8
> length 144 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 116
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 80
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 80/80 padding 79
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 8
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 8 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003305
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003305
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003306
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003306
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003306
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xba75d84f last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003306
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003305
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 1
> second(s) ago
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 9 peer --FR--:500 local
> --UK--:500, 160 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 9
> length 160 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 132
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 96
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 96/96 padding 95
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 9
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 9 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003319
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003320
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003321
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003321
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003321
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xba75d84f last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003321
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003320
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 1
> second(s) ago
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 10 peer --FR--:500 local
> --UK--:500, 96 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 10
> length 96 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 68
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 32
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 32/32 padding 31
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 10
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 10 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003334
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003335
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003336
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003336
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003336
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xba75d84f last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003336
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003335
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 1
> second(s) ago
> > policy_lookup: setting policy '--JP-HOST--'
> > spi=0x52b68ffd0ebb1984: recv INFORMATIONAL req 93 peer --JP-IP--:500
> local --UK--:500, 57 bytes, policy '--JP-HOST--'
> > ikev2_recv: ispi 0x52b68ffd0ebb1984 rspi 0xebcdfe906b83921a
> > ikev2_init_recv: unknown SA
> > policy_lookup: setting policy '--JP-HOST--'
> > spi=0x52b68ffd0ebb1984: recv INFORMATIONAL req 93 peer --JP-IP--:500
> local --UK--:500, 57 bytes, policy '--JP-HOST--'
> > ikev2_recv: ispi 0x52b68ffd0ebb1984 rspi 0xebcdfe906b83921a
> > ikev2_init_recv: unknown SA
> > policy_lookup: setting policy '--JP-HOST--'
> > spi=0x52b68ffd0ebb1984: recv INFORMATIONAL req 93 peer --JP-IP--:500
> local --UK--:500, 57 bytes, policy '--JP-HOST--'
> > ikev2_recv: ispi 0x52b68ffd0ebb1984 rspi 0xebcdfe906b83921a
> > ikev2_init_recv: unknown SA
> > ikev2_init_ike_sa: "--FR-HOST--" is already active
> > ikev2_init_ike_sa: "--US-HOST--" is already active
> > ikev2_init_ike_sa: "--JP-HOST--" is already active
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 11 peer --FR--:500 local
> --UK--:500, 96 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 11
> length 96 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 68
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 32
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 32/32 padding 31
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 11
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 11 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003349
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003350
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003351
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003351
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003350
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xba75d84f last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003351
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003350
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 1
> second(s) ago
> > policy_lookup: setting policy '--JP-HOST--'
> > spi=0x52b68ffd0ebb1984: recv INFORMATIONAL req 93 peer --JP-IP--:500
> local --UK--:500, 57 bytes, policy '--JP-HOST--'
> > ikev2_recv: ispi 0x52b68ffd0ebb1984 rspi 0xebcdfe906b83921a
> > ikev2_init_recv: unknown SA
> > spi=0xf94ce3fc2e48f7f2: recv INFORMATIONAL req 2 peer --CAT--:4500 local
> --UK--:4500, 80 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0xf94ce3fc2e48f7f2 rspi 0x1d51ac7d723a726d
> > ikev2_recv: updated SA to peer --CAT--:4500 local --UK--:4500
> > ikev2_pld_parse: header ispi 0xf94ce3fc2e48f7f2 rspi 0x1d51ac7d723a726d
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x08 msgid 2
> length 80 response 0
> > ikev2_pld_payloads: payload SK nextpayload DELETE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 7
> > ikev2_pld_payloads: decrypted payload DELETE nextpayload NONE critical
> 0x00 length 8
> > ikev2_pld_delete: proto IKE spisize 0 nspi 0
> > ikev2_next_payload: length 4 nextpayload NONE
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 4
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 5, padding 11, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf94ce3fc2e48f7f2 rspi 0x1d51ac7d723a726d
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x20 msgid 2
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 11
> > spi=0xf94ce3fc2e48f7f2: send INFORMATIONAL res 2 peer --CAT--:4500 local
> --UK--:4500, 80 bytes, NAT-T
> > spi=0xf94ce3fc2e48f7f2: ikev2_ikesa_recv_delete: received delete
> > spi=0xf94ce3fc2e48f7f2: sa_state: ESTABLISHED -> CLOSED from
> --CAT--:4500 to --UK--:4500 policy '--CAT-HOST--'
> > ikev2_recv: closing SA
> > spi=0xf94ce3fc2e48f7f2: sa_free: received delete
> > config_free_proposals: free 0x3c27ccfe800
> > config_free_proposals: free 0x3c31292a600
> > config_free_childsas: free 0x3c2db888f00
> > config_free_childsas: free 0x3c300bf3e00
> > sa_free_flows: free 0x3c324182800
> > sa_free_flows: free 0x3c2eec20400
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0x87993e0d839b617f: recv IKE_SA_INIT req 0 peer --CAT--:500 local
> --UK--:500, 1056 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0x87993e0d839b617f rspi 0x0000000000000000
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > ikev2_pld_parse: header ispi 0x87993e0d839b617f rspi 0x0000000000000000
> nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x08 msgid 0 length
> 1056 response 0
> > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 832
> > ikev2_pld_sa: more 2 reserved 0 length 352 proposal #1 protoid IKE
> spisize 0 xforms 37 spi 0
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CTR
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CTR
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CTR
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CTR
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CTR
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CTR
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type ENCR id 3DES
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_256_128
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_384_192
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_512_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id HMAC_SHA1_96
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id AES_XCBC_96
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id AES_CMAC_96
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_384
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_512
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id AES128_XCBC
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id AES128_CMAC
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_384
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_521
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P256R1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P384R1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P512R1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id CURVE25519
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_3072
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_4096
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_6144
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_8192
> > ikev2_pld_xform: more 0 reserved 0 length 8 type DH id MODP_2048
> > ikev2_pld_sa: more 0 reserved 0 length 476 proposal #2 protoid IKE
> spisize 0 xforms 45 spi 0
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_16
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_GCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_8
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id CAMELLIA_CCM_12
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_384
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_512
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id AES128_XCBC
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id AES128_CMAC
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_384
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id ECP_521
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P256R1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P384R1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id BRAINPOOL_P512R1
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id CURVE25519
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_3072
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_4096
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_6144
> > ikev2_pld_xform: more 3 reserved 0 length 8 type DH id MODP_8192
> > ikev2_pld_xform: more 0 reserved 0 length 8 type DH id MODP_2048
> > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 72
> > ikev2_pld_ke: dh group ECP_256 reserved 0
> > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00
> length 36
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP
> > ikev2_nat_detection: peer source 0x87993e0d839b617f 0x0000000000000000
> --CAT--:500
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type
> NAT_DETECTION_DESTINATION_IP
> > ikev2_nat_detection: peer destination 0x87993e0d839b617f
> 0x0000000000000000 --UK--:500
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type FRAGMENTATION_SUPPORTED
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 16
> > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS
> > ikev2_pld_notify: signature hash SHA2_256 (2)
> > ikev2_pld_notify: signature hash SHA2_384 (3)
> > ikev2_pld_notify: signature hash SHA2_512 (4)
> > ikev2_pld_notify: signature hash <UNKNOWN:5> (5)
> > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length
> 8
> > ikev2_pld_notify: protoid NONE spisize 0 type REDIRECT_SUPPORTED
> > proposals_negotiate: score 4
> > proposals_negotiate: score 0
> > policy_lookup: setting policy '--CAT-HOST--'
> > spi=0x87993e0d839b617f: sa_state: INIT -> SA_INIT
> > proposals_negotiate: score 4
> > proposals_negotiate: score 0
> > sa_stateok: SA_INIT flags 0x0000, require 0x0000
> > sa_stateflags: 0x0000 -> 0x0020 sa (required 0x0000 )
> > spi=0x87993e0d839b617f: ikev2_sa_keys: DHSECRET with 32 bytes
> > ikev2_sa_keys: SKEYSEED with 32 bytes
> > spi=0x87993e0d839b617f: ikev2_sa_keys: S with 80 bytes
> > ikev2_prfplus: T1 with 32 bytes
> > ikev2_prfplus: T2 with 32 bytes
> > ikev2_prfplus: T3 with 32 bytes
> > ikev2_prfplus: T4 with 32 bytes
> > ikev2_prfplus: T5 with 32 bytes
> > ikev2_prfplus: T6 with 32 bytes
> > ikev2_prfplus: T7 with 32 bytes
> > ikev2_prfplus: Tn with 224 bytes
> > ikev2_sa_keys: SK_d with 32 bytes
> > ikev2_sa_keys: SK_ai with 32 bytes
> > ikev2_sa_keys: SK_ar with 32 bytes
> > ikev2_sa_keys: SK_ei with 32 bytes
> > ikev2_sa_keys: SK_er with 32 bytes
> > ikev2_sa_keys: SK_pi with 32 bytes
> > ikev2_sa_keys: SK_pr with 32 bytes
> > ikev2_add_proposals: length 44
> > ikev2_next_payload: length 48 nextpayload KE
> > ikev2_next_payload: length 72 nextpayload NONCE
> > ikev2_next_payload: length 36 nextpayload NOTIFY
> > ikev2_nat_detection: local source 0x87993e0d839b617f 0xbd5bf5ce26784624
> --UK--:500
> > ikev2_next_payload: length 28 nextpayload NOTIFY
> > ikev2_nat_detection: local destination 0x87993e0d839b617f
> 0xbd5bf5ce26784624 --CAT--:500
> > ikev2_next_payload: length 28 nextpayload CERTREQ
> > ikev2_add_certreq: type X509_CERT length 21
> > ikev2_next_payload: length 25 nextpayload NOTIFY
> > ikev2_next_payload: length 14 nextpayload NONE
> > ikev2_pld_parse: header ispi 0x87993e0d839b617f rspi 0xbd5bf5ce26784624
> nextpayload SA version 0x20 exchange IKE_SA_INIT flags 0x20 msgid 0 length
> 279 response 1
> > ikev2_pld_payloads: payload SA nextpayload KE critical 0x00 length 48
> > ikev2_pld_sa: more 0 reserved 0 length 44 proposal #1 protoid IKE
> spisize 0 xforms 4 spi 0
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type PRF id HMAC_SHA2_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_256_128
> > ikev2_pld_xform: more 0 reserved 0 length 8 type DH id ECP_256
> > ikev2_pld_payloads: payload KE nextpayload NONCE critical 0x00 length 72
> > ikev2_pld_ke: dh group ECP_256 reserved 0
> > ikev2_pld_payloads: payload NONCE nextpayload NOTIFY critical 0x00
> length 36
> > ikev2_pld_payloads: payload NOTIFY nextpayload NOTIFY critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type NAT_DETECTION_SOURCE_IP
> > ikev2_pld_payloads: payload NOTIFY nextpayload CERTREQ critical 0x00
> length 28
> > ikev2_pld_notify: protoid NONE spisize 0 type
> NAT_DETECTION_DESTINATION_IP
> > ikev2_pld_payloads: payload CERTREQ nextpayload NOTIFY critical 0x00
> length 25
> > ikev2_pld_certreq: type X509_CERT length 20
> > ikev2_pld_payloads: payload NOTIFY nextpayload NONE critical 0x00 length
> 14
> > ikev2_pld_notify: protoid NONE spisize 0 type SIGNATURE_HASH_ALGORITHMS
> > spi=0x87993e0d839b617f: send IKE_SA_INIT res 0 peer --CAT--:500 local
> --UK--:500, 279 bytes
> > config_free_proposals: free 0x3c2ef864700
> > config_free_proposals: free 0x3c2a56da100
> > spi=0x87993e0d839b617f: recv IKE_AUTH req 1 peer --CAT--:4500 local
> --UK--:4500, 1792 bytes, policy '--CAT-HOST--'
> > ikev2_recv: ispi 0x87993e0d839b617f rspi 0xbd5bf5ce26784624
> > ikev2_recv: updated SA to peer --CAT--:4500 local --UK--:4500
> > ikev2_pld_parse: header ispi 0x87993e0d839b617f rspi 0xbd5bf5ce26784624
> nextpayload SK version 0x20 exchange IKE_AUTH flags 0x08 msgid 1 length
> 1792 response 0
> > ikev2_pld_payloads: payload SK nextpayload IDi critical 0x00 length 1764
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 1728
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 1728/1728 padding 11
> > ikev2_pld_payloads: decrypted payload IDi nextpayload CERT critical 0x00
> length 33
> > ikev2_pld_id: id UFQDN/indra@--CA-HOST-- length 29
> > ikev2_pld_payloads: decrypted payload CERT nextpayload NOTIFY critical
> 0x00 length 1090
> > ikev2_pld_cert: type X509_CERT length 1085
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload CERTREQ
> critical 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type INITIAL_CONTACT
> > ikev2_pld_payloads: decrypted payload CERTREQ nextpayload AUTH critical
> 0x00 length 85
> > ikev2_pld_certreq: type X509_CERT length 80
> > ikev2_pld_payloads: decrypted payload AUTH nextpayload CP critical 0x00
> length 280
> > ikev2_pld_auth: method SIG length 272
> > ikev2_pld_payloads: decrypted payload CP nextpayload NOTIFY critical
> 0x00 length 16
> > ikev2_pld_cp: type REQUEST length 8
> > ikev2_pld_cp: INTERNAL_IP4_ADDRESS 0x0001 length 0
> > ikev2_pld_cp: INTERNAL_IP4_DNS 0x0003 length 0
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload SA critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type USE_TRANSPORT_MODE
> > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00
> length 100
> > ikev2_pld_sa: more 0 reserved 0 length 96 proposal #1 protoid ESP
> spisize 4 xforms 9 spi 0xc0567d8f
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 128 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 192 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_256_128
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_384_192
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_512_256
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id HMAC_SHA1_96
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id AES_XCBC_96
> > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id NONE
> > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start 0.0.0.0 end 255.255.255.255
> > ikev2_pld_payloads: decrypted payload TSr nextpayload NOTIFY critical
> 0x00 length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --UK-- end --UK--
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload NOTIFY critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type MOBIKE_SUPPORTED
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload NOTIFY critical
> 0x00 length 24
> > ikev2_pld_notify: protoid NONE spisize 0 type ADDITIONAL_IP6_ADDRESS
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload NOTIFY critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type EAP_ONLY_AUTHENTICATION
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload NONE critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type
> IKEV2_MESSAGE_ID_SYNC_SUPPORTED
> > ikev2_handle_notifies: mobike enabled
> > sa_stateok: SA_INIT flags 0x0000, require 0x0000
> > spi=0x87993e0d839b617f: sa_state: SA_INIT -> AUTH_REQUEST
> > policy_lookup: peerid 'indra@--CA-HOST--'
> > proposals_negotiate: score 4
> > policy_lookup: setting policy '--CAT-HOST--'
> > ikev2_policy2id: srcid UFQDN/--UK-ID-- length 31
> > sa_stateflags: 0x0020 -> 0x0024 certreq,sa (required 0x003b
> cert,certvalid,auth,authvalid,sa)
> > ikev2_msg_auth: responder auth data length 343
> > ca_setauth: switching SIG_ANY to SIG
> > ca_setauth: auth length 343
> > proposals_negotiate: score 4
> > sa_stateflags: 0x0024 -> 0x0024 certreq,sa (required 0x003b
> cert,certvalid,auth,authvalid,sa)
> > config_free_proposals: free 0x3c2ef864180
> > ca_getreq: found CA /C=FR/ST=Seine-Saint-Denis/L=Aubervilliers/O=Telecom
> Lobby/OU=VPNC/CN=--CA-HOST--
> > ca_x509_subjectaltname_do: did not find subjectAltName in certificate
> > ca_getreq: found local certificate /C=UK/ST=England/L=London/O=Telecom
> Lobby/OU=VPNC/CN=--UK-HOST--
> > _dsa_sign_encode: signature scheme 0 selected
> > _dsa_sign_encode: signature scheme 0 selected
> > _dsa_sign_encode: signature scheme 0 selected
> > ca_setauth: auth length 272
> > ca_validate_pubkey: could not open public key pubkeys/ufqdn/indra@
> --CA-HOST--
> > ca_validate_cert: /C=ES/ST=Catalunya/L=sant Pere de Ribes/O=Telecom
> Lobby/OU=VPNC/CN=--CAT-HOST-- ok
> > ikev2_getimsgdata: imsg 22 rspi 0xbd5bf5ce26784624 ispi
> 0x87993e0d839b617f initiator 0 sa valid type 4 data length 1064
> > ikev2_dispatch_cert: cert type X509_CERT length 1064, ok
> > sa_stateflags: 0x0024 -> 0x0025 cert,certreq,sa (required 0x003b
> cert,certvalid,auth,authvalid,sa)
> > ikev2_getimsgdata: imsg 28 rspi 0xbd5bf5ce26784624 ispi
> 0x87993e0d839b617f initiator 0 sa valid type 14 data length 272
> > ikev2_dispatch_cert: AUTH type 14 len 272
> > sa_stateflags: 0x0025 -> 0x002d cert,certreq,auth,sa (required 0x003b
> cert,certvalid,auth,authvalid,sa)
> > ikev2_getimsgdata: imsg 23 rspi 0xbd5bf5ce26784624 ispi
> 0x87993e0d839b617f initiator 0 sa valid type 4 data length 1085
> > ikev2_msg_auth: initiator auth data length 1120
> > ikev2_msg_authverify: method SIG keylen 1085 type X509_CERT
> > _dsa_verify_init: signature scheme 0 selected
> > ikev2_msg_authverify: authentication successful
> > spi=0x87993e0d839b617f: sa_state: AUTH_REQUEST -> AUTH_SUCCESS
> > sa_stateflags: 0x002d -> 0x003d cert,certreq,auth,authvalid,sa (required
> 0x003b cert,certvalid,auth,authvalid,sa)
> > ikev2_dispatch_cert: peer certificate is valid
> > sa_stateflags: 0x003d -> 0x003f cert,certvalid,certreq,auth,authvalid,sa
> (required 0x003b cert,certvalid,auth,authvalid,sa)
> > sa_stateok: VALID flags 0x003b, require 0x003b
> cert,certvalid,auth,authvalid,sa
> > spi=0x87993e0d839b617f: sa_state: AUTH_SUCCESS -> VALID
> > sa_stateok: VALID flags 0x003b, require 0x003b
> cert,certvalid,auth,authvalid,sa
> > sa_stateok: VALID flags 0x003b, require 0x003b
> cert,certvalid,auth,authvalid,sa
> > ikev2_sa_tag: (0)
> > ikev2_childsa_negotiate: proposal 1
> > ikev2_childsa_negotiate: key material length 128
> > ikev2_prfplus: T1 with 32 bytes
> > ikev2_prfplus: T2 with 32 bytes
> > ikev2_prfplus: T3 with 32 bytes
> > ikev2_prfplus: T4 with 32 bytes
> > ikev2_prfplus: Tn with 128 bytes
> > pfkey_sa_getspi: spi 0x41a9644f
> > pfkey_sa_init: new spi 0x41a9644f
> > ikev2_next_payload: length 35 nextpayload CERT
> > ikev2_next_payload: length 1069 nextpayload AUTH
> > ikev2_next_payload: length 280 nextpayload CP
> > ikev2_next_payload: length 8 nextpayload NOTIFY
> > ikev2_add_notify: done
> > ikev2_next_payload: length 8 nextpayload NOTIFY
> > ikev2_add_notify: done
> > ikev2_next_payload: length 8 nextpayload SA
> > ikev2_add_proposals: length 40
> > ikev2_next_payload: length 44 nextpayload TSi
> > ikev2_next_payload: length 24 nextpayload TSr
> > ikev2_next_payload: length 24 nextpayload NONE
> > ikev2_next_payload: length 1540 nextpayload IDr
> > ikev2_msg_encrypt: decrypted length 1500
> > ikev2_msg_encrypt: padded length 1504
> > ikev2_msg_encrypt: length 1501, padding 3, output length 1536
> > ikev2_msg_integr: message length 1568
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0x87993e0d839b617f rspi 0xbd5bf5ce26784624
> nextpayload SK version 0x20 exchange IKE_AUTH flags 0x20 msgid 1 length
> 1568 response 1
> > ikev2_pld_payloads: payload SK nextpayload IDr critical 0x00 length 1540
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 1504
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 1504/1504 padding 3
> > ikev2_pld_payloads: decrypted payload IDr nextpayload CERT critical 0x00
> length 35
> > ikev2_pld_id: id UFQDN/--UK-ID-- length 31
> > ikev2_pld_payloads: decrypted payload CERT nextpayload AUTH critical
> 0x00 length 1069
> > ikev2_pld_cert: type X509_CERT length 1064
> > ikev2_pld_payloads: decrypted payload AUTH nextpayload CP critical 0x00
> length 280
> > ikev2_pld_auth: method SIG length 272
> > ikev2_pld_payloads: decrypted payload CP nextpayload NOTIFY critical
> 0x00 length 8
> > ikev2_pld_cp: type REPLY length 0
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload NOTIFY critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type USE_TRANSPORT_MODE
> > ikev2_pld_payloads: decrypted payload NOTIFY nextpayload SA critical
> 0x00 length 8
> > ikev2_pld_notify: protoid NONE spisize 0 type MOBIKE_SUPPORTED
> > ikev2_pld_payloads: decrypted payload SA nextpayload TSi critical 0x00
> length 44
> > ikev2_pld_sa: more 0 reserved 0 length 40 proposal #1 protoid ESP
> spisize 4 xforms 3 spi 0x41a9644f
> > ikev2_pld_xform: more 3 reserved 0 length 12 type ENCR id AES_CBC
> > ikev2_pld_attr: attribute type KEY_LENGTH length 256 total 4
> > ikev2_pld_xform: more 3 reserved 0 length 8 type INTEGR id
> HMAC_SHA2_256_128
> > ikev2_pld_xform: more 0 reserved 0 length 8 type ESN id NONE
> > ikev2_pld_payloads: decrypted payload TSi nextpayload TSr critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --CAT-- end --CAT--
> > ikev2_pld_payloads: decrypted payload TSr nextpayload NONE critical 0x00
> length 24
> > ikev2_pld_tss: count 1 length 16
> > ikev2_pld_tss: type IPV4_ADDR_RANGE protoid 47 length 16 startport 0
> endport 65535
> > ikev2_pld_ts: start --UK-- end --UK--
> > spi=0x87993e0d839b617f: send IKE_AUTH res 1 peer --CAT--:4500 local
> --UK--:4500, 1568 bytes, NAT-T
> > pfkey_sa_add: update spi 0x41a9644f
> > ikev2_childsa_enable: loaded CHILD SA spi 0x41a9644f
> > pfkey_sa_add: add spi 0xc0567d8f
> > ikev2_childsa_enable: loaded CHILD SA spi 0xc0567d8f
> > ikev2_childsa_enable: loaded flow 0x3c324182400
> > ikev2_childsa_enable: loaded flow 0x3c2eec20000
> > ikev2_childsa_enable: remember SA peer --CAT--:4500
> > spi=0x87993e0d839b617f: ikev2_childsa_enable: loaded SPIs: 0x41a9644f,
> 0xc0567d8f
> > spi=0x87993e0d839b617f: ikev2_childsa_enable: loaded flows:
> ESP---UK--/32=--CAT--/32(47)
> > spi=0x87993e0d839b617f: sa_state: VALID -> ESTABLISHED from --CAT--:4500
> to --UK--:4500 policy '--CAT-HOST--'
> > spi=0x87993e0d839b617f: established peer --CAT--:4500[UFQDN/indra@--CA-HOST--]
> local --UK--:4500[UFQDN/--UK-ID--] policy '--CAT-HOST--' as responder
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 12 peer --FR--:500 local
> --UK--:500, 112 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 12
> length 112 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 84
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 48
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 48/48 padding 47
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 12
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 12 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003365
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003365
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003366
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003366
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003366
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003365
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 1
> second(s) ago
> > policy_lookup: setting policy '--JP-HOST--'
> > spi=0x52b68ffd0ebb1984: recv INFORMATIONAL req 93 peer --JP-IP--:500
> local --UK--:500, 57 bytes, policy '--JP-HOST--'
> > ikev2_recv: ispi 0x52b68ffd0ebb1984 rspi 0xebcdfe906b83921a
> > ikev2_init_recv: unknown SA
> > pfkey_sa_lookup: last_used 1614003379
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x41a9644f last used 1
> second(s) ago
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 13 peer --FR--:500 local
> --UK--:500, 128 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 13
> length 128 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 100
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 64
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 64/64 padding 63
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 13
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 13 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003380
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003380
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003381
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003381
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003381
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003380
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 1
> second(s) ago
> > policy_lookup: setting policy '--US-HOST--'
> > spi=0xe6cf431822ad3dc9: recv INFORMATIONAL req 53 peer --US-IP--:500
> local --UK--:500, 57 bytes, policy '--US-HOST--'
> > ikev2_recv: ispi 0xe6cf431822ad3dc9 rspi 0x338f3945413a685a
> > ikev2_init_recv: unknown SA
> > pfkey_sa_lookup: last_used 1614003392
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x41a9644f last used 3
> second(s) ago
> > spi=0xf2043da59221143f: recv INFORMATIONAL req 14 peer --FR--:500 local
> --UK--:500, 160 bytes, policy '--FR-HOST--'
> > ikev2_recv: ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> > ikev2_recv: updated SA to peer --FR--:500 local --UK--:500
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x00 msgid 14
> length 160 response 0
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 132
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 96
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 96/96 padding 95
> > ikev2_next_payload: length 52 nextpayload NONE
> > ikev2_msg_encrypt: decrypted length 0
> > ikev2_msg_encrypt: padded length 16
> > ikev2_msg_encrypt: length 1, padding 15, output length 48
> > ikev2_msg_integr: message length 80
> > ikev2_msg_integr: integrity checksum length 16
> > ikev2_pld_parse: header ispi 0xf2043da59221143f rspi 0x1f43bd64d771a4e5
> nextpayload SK version 0x20 exchange INFORMATIONAL flags 0x28 msgid 14
> length 80 response 1
> > ikev2_pld_payloads: payload SK nextpayload NONE critical 0x00 length 52
> > ikev2_msg_decrypt: IV length 16
> > ikev2_msg_decrypt: encrypted payload length 16
> > ikev2_msg_decrypt: integrity checksum length 16
> > ikev2_msg_decrypt: integrity check succeeded
> > ikev2_msg_decrypt: decrypted payload length 16/16 padding 15
> > spi=0xf2043da59221143f: send INFORMATIONAL res 14 peer --FR--:500 local
> --UK--:500, 80 bytes
> > pfkey_sa_lookup: last_used 1614003394
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0x066d9db6 last used 1
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003394
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x8f3bad08 last used 1
> second(s) ago
> > policy_lookup: setting policy '--US-HOST--'
> > spi=0xe6cf431822ad3dc9: recv INFORMATIONAL req 53 peer --US-IP--:500
> local --UK--:500, 57 bytes, policy '--US-HOST--'
> > ikev2_recv: ispi 0xe6cf431822ad3dc9 rspi 0x338f3945413a685a
> > ikev2_init_recv: unknown SA
> > pfkey_sa_lookup: last_used 1614003396
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xd1bfd520 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003396
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0xfc41aa70 last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003396
> > ikev2_ike_sa_alive: outgoing CHILD SA spi 0xb1bffe2d last used 0
> second(s) ago
> > pfkey_sa_lookup: last_used 1614003395
> > ikev2_ike_sa_alive: incoming CHILD SA spi 0x4701e9b5 last used 1
> second(s) ago
> > policy_lookup: setting policy '--US-HOST--'
> > spi=0xe6cf431822ad3dc9: recv INFORMATIONAL req 53 peer --US-IP--:500
> local --UK--:500, 57 bytes, policy '--US-HOST--'
> > ikev2_recv: ispi 0xe6cf431822ad3dc9 rspi 0x338f3945413a685a
> > ikev2_init_recv: unknown SA
> > policy_lookup: setting policy '--JP-HOST--'
> > spi=0x52b68ffd0ebb1984: recv INFORMATIONAL req 93 peer --JP-IP--:500
> local --UK--:500, 57 bytes, policy '--JP-HOST--'
> > ikev2_recv: ispi 0x52b68ffd0ebb1984 rspi 0xebcdfe906b83921a
> > ikev2_init_recv: unknown SA
> > ca exiting, pid 842
> > control exiting, pid 64161
> > ikev2 exiting, pid 15623
> > parent terminating
>
>

--
Name: Riccardo Giuntoli
Email: taglio@gmail.com
Location: sant Pere de Ribes, BCN, Spain
PGP Key: 0x67123739
PGP Fingerprint: CE75 16B5 D855 842FAB54 FB5C DDC6 4640 6712 3739
Key server: hkp://wwwkeys.eu.pgp.net