IPSec VPN no IKE found

I try to set up some IPSec site to site tunnels on my new XGS138. Until now I had them connected to a Zyxel USG Flex where the tunnels built without any issue. For the IPSec profiles I therefore used precisely the same parameters.

However, what I get in  the strongswan log is similar to the following I found in the trouble shooting documents ( Sophos Firewall: Troubleshooting site to site IPsec VPN issues ):

2020-09-24 18:51:19 13[NET] <100> received packet: from 72.138.xx.xx1[500] to 10.0.0.4[500] (872 bytes)

2020-09-24 18:51:19 13[ENC] <100> parsed ID_PROT request 0 [ SA V V V V V V ]

2020-09-24 18:51:19 13[CFG] <100> looking for an ike config for 10.0.0.4...72.138.xx.xx

2020-09-24 18:51:19 13[IKE] <100> no IKE config found for 10.0.0.4...72.138.xx.xx, sending NO_PROPOSAL_CHOSEN

Now the interesting and important question is: what exactly is strongswan looking for? That would dramatically help identifying the issue. Is there any debug log available showing exactly how the request looks like?

Something like this:

Recv IKE sa: SA([0] protocol = IKE (1), AES CBC key len = 128, HMAC-SHA1 PRF, HMAC-SHA1-96, 2048 bit MODP, HMAC-MD5 PRF, HMAC-MD5-96, 3DES

[ESP aes-cbc|hmac-sha1-96][SPI 0x79ce5aa9|0x97ace71f][Lifetime 3620]

As a matter of fact I'm quite disappointed so far regarding the capabilities of this quite expensive device (for a small office). No IKEv2 for remote client access, no real debug capabilities, PPTP seems to have a bug, ... It took me a couple of days to get the VPN connections running on the Zyxel USG but at least the logs were much more helpful than what I have available so far.



Edited TAGs
[edited by: Erick Jan at 12:05 AM (GMT -7) on 7 Apr 2025]