I had the ikesa and childsa at a different position, and the configuration file failed to parse. It was not obvious this was due to the order of the "sections".
This fails:
ikev2 test esp
from 10.0.1.0/24 to 10.0.2.0/24
local 1.2.3.4 peer 5.6.7.8
srcid foo dstid bar
ikesa enc aes-256 auth hmac-sha2-256 group esp256
childsa enc aes-128-gcm
psk test
tag FOO
but this works:
ikev2 test esp
from 10.0.1.0/24 to 10.0.2.0/24
local 1.2.3.4 peer 5.6.7.8
ikesa enc aes-256 auth hmac-sha2-256 group esp256
childsa enc aes-128-gcm
srcid foo dstid bar
psk test
tag FOO
I had the ikesa and childsa at a different position, and the configuration file failed to parse. It was not obvious this was due to the order of the "sections".
This fails:
ikev2 test esp
from 10.0.1.0/24 to 10.0.2.0/24
local 1.2.3.4 peer 5.6.7.8
srcid foo dstid bar
ikesa enc aes-256 auth hmac-sha2-256 group esp256
childsa enc aes-128-gcm
psk test
tag FOO
but this works:
ikev2 test esp
from 10.0.1.0/24 to 10.0.2.0/24
local 1.2.3.4 peer 5.6.7.8
ikesa enc aes-256 auth hmac-sha2-256 group esp256
childsa enc aes-128-gcm
srcid foo dstid bar
psk test
tag FOO