IPSec strongswan creating CHILD_SA failed in logs

RE: IPSec strongswan creating CHILD_SA failed in logs

Sreenivasulu Naidu — Tue, 25 Jul 2023 08:47:36 GMT

Carlo By default, route based IPsec VPN on SFOS chose 'dual' stack, you can chose to have ipv4 only; probably you do not have ipv6 traffic selectors configured on Fortinet side, causing TS_UNACCEPTABLE, which is fine as SFOS side is not able to create IPv6 child SA and hence you are seeing this message. This is safe to ignore or you can keep ip version as ipv4 only.

On Fortinet side, you would have probably used IPv4 subnets or Range for traffic selectors. This will narrow down the traffic selectors on SFOS side.

RE: IPSec strongswan creating CHILD_SA failed in logs

Carlo — Tue, 25 Jul 2023 06:38:45 GMT

Hello. Thanks but it is route based vpn without subnets configured on profile ipsec connection. When you create tunnel interface by default is selected ip version "dual" and fields for entering subnets are disabled. I have sd-wan route that works.

And in that moment ipsec statusall

Security Associations (2 up, 0 connecting):

NAME-1{775}: 10.xxx.xxx.xxx/32 === 10.xxx.xxx.xxx/32 10.xxx.xxx.xxx/32

RE: IPSec strongswan creating CHILD_SA failed in logs

Giridhar Katti — Mon, 24 Jul 2023 14:37:51 GMT

The SA creation is failing because of incorrect traffic selectors and retry is happening every 60 secs. The below error log says it

2023-07-24 08:06:55Z 24[IKE] <NAME-1|41> creating CHILD_SA failed, trying again in 67 seconds

Maybe you need to check the traffic selector config in the ipsec profile.

RE: IPSec strongswan creating CHILD_SA failed in logs

LuCar Toni — Mon, 24 Jul 2023 12:29:50 GMT

SFOS uses Strongswan. You can check the Strongswan Community for more insights: https://wiki.strongswan.org/issues/2833

tldr: seems to be a config issue.

RE: IPSec strongswan creating CHILD_SA failed in logs

Carlo — Mon, 24 Jul 2023 09:46:14 GMT

This post is not about guessing what is wrong.

I want to understand what this means

2023-07-24 08:08:02Z 31[ENC] <NAME-1|41> parsed CREATE_CHILD_SA response 33 [ N(TS_UNACCEPT) ]
2023-07-24 08:08:02Z 31[IKE] <NAME-1|41> received TS_UNACCEPTABLE notify, no CHILD_SA built
2023-07-24 08:08:02Z 31[IKE] <NAME-1|41> creating CHILD_SA failed, trying again in 62 seconds

And why I am getting this every 60 sec even when tunnel is up and working

RE: IPSec strongswan creating CHILD_SA failed in logs

Bharat J — Mon, 24 Jul 2023 09:12:53 GMT

Sophos Firewall only supports time-based rekeying.IPsec connection is established between a Sophos Firewall device and a third-party firewall. Traffic stops flowing after some time or getting logs as shared.

Sign in to the CLI and click 5 for Device management and then click 3 for Advanced shell.
Enter the following command: ipsec statusall

The output shows that IPSec SAs have been established.
Enter the following command: ip xfrm state

The output shows the transform sets for the VPN exist, that is, the SAs match.
To prevent key exchange collisions, follow these guidelines:
- Set the initiator's phase 1 and phase 2 key life values lower than the responder's.
- Set the phase 2 key life lower than the phase 1 value in both firewalls.
Example values are as follows:

Key life Firewall 1 Firewall 2

Phase 1 12600 seconds 10800 seconds

Phase 2 5400 seconds 3600 seconds
Sophos Firewall only supports time-based rekeying. If you configured traffic-based rekeying on the third-party remote firewall, change it to time-based rekeying.

Key life	Firewall 1	Firewall 2
Phase 1	12600 seconds	10800 seconds
Phase 2	5400 seconds	3600 seconds

Please add local-id and remote-id on the IPsec VPN tunnel on both sides as agreed.

Regards

RE: IPSec strongswan creating CHILD_SA failed in logs

Carlo — Mon, 24 Jul 2023 08:51:39 GMT

Perhaps it is worth mentioning that the tunnel is up, traffic is flowing, it just gets re-keyed again. Then why do I see it in the logs.

RE: IPSec strongswan creating CHILD_SA failed in logs

Carlo — Mon, 24 Jul 2023 08:28:03 GMT

Not really. I asked what does this line mean

creating CHILD_SA failed

RE: IPSec strongswan creating CHILD_SA failed in logs

Bharat J — Mon, 24 Jul 2023 08:23:30 GMT

Hi Carlo

Hope below link might help to fix the issue

Sophos Firewall: IPsec troubleshooting and most common errors

Regards