IPSec IKEv2 + radius + Let’s Encrypt problem

RouterOS General
1

Hello.

So I have IPSec IKEv2 + radius + Let’s Encrypt tunnel and its been working for few months but now it doesn’t. I have completely no idea why. I didnt change any configuration or so. Below is my log.

08:53:40 ipsec,debug ===== received 370 bytes from 37.31.156.56[37972] to 213.158.206.103[500] 
08:53:40 ipsec,debug,packet 9ccf8836 a6fc17dd 00000000 00000000 21202208 00000000 00000172 220000a4 
08:53:40 ipsec,debug,packet 02000024 01010003 0300000c 01000014 800e0100 03000008 02000005 00000008 
08:53:40 ipsec,debug,packet 04000013 02000024 02010003 0300000c 01000014 800e0100 03000008 02000005 
08:53:40 ipsec,debug,packet 00000008 0400000e 0200002c 03010004 0300000c 0100000c 800e0100 03000008 
08:53:40 ipsec,debug,packet 02000005 03000008 0300000c 00000008 04000013 0000002c 04010004 0300000c 
08:53:40 ipsec,debug,packet 0100000c 800e0100 03000008 02000005 03000008 0300000c 00000008 0400000e 
08:53:40 ipsec,debug,packet 28000048 00130000 999fae5a 247c4a1b 1b85c4dc 3569a08c 734dd699 fdbb7b72 
08:53:40 ipsec,debug,packet 1eceebb5 6bc7f8ba f2693489 9c4b4964 2bd5cde0 ccb83e2b 1a954db5 f1bfa9bd 
08:53:40 ipsec,debug,packet d9421160 57017fcb 29000014 bd8264e3 caf6d648 6503b1ab 58f3f874 29000008 
08:53:40 ipsec,debug,packet 00004016 2900001c 00004004 770a1884 22b8c1be 7db848be e1377f3e 565b3b5e 
08:53:40 ipsec,debug,packet 2900001c 00004005 f9f0230c b217807f cf5ea380 de665db0 1902a9b9 29000008 
08:53:40 ipsec,debug,packet 0000402e 0000000e 0000402f 00040003 0002 
08:53:40 ipsec,debug => (size 0xa) 
08:53:40 ipsec,debug 0000000a 00000011 000e 
08:53:40 ipsec,debug ===== sending 38 bytes from 213.158.206.103[500] to 37.31.156.56[37972] 
08:53:40 ipsec,debug 1 times of 38 bytes message will be sent to 37.31.156.56[37972] 
08:53:40 ipsec,debug,packet 9ccf8836 a6fc17dd 00000000 00000000 29202220 00000000 00000026 0000000a 
08:53:40 ipsec,debug,packet 00000011 000e 
08:53:40 ipsec,debug ===== received 562 bytes from 37.31.156.56[37972] to 213.158.206.103[500] 
08:53:40 ipsec,debug,packet 9ccf8836 a6fc17dd 00000000 00000000 21202208 00000000 00000232 220000a4 
08:53:40 ipsec,debug,packet 02000024 01010003 0300000c 01000014 800e0100 03000008 02000005 00000008 
08:53:40 ipsec,debug,packet 04000013 02000024 02010003 0300000c 01000014 800e0100 03000008 02000005 
08:53:40 ipsec,debug,packet 00000008 0400000e 0200002c 03010004 0300000c 0100000c 800e0100 03000008 
08:53:40 ipsec,debug,packet 02000005 03000008 0300000c 00000008 04000013 0000002c 04010004 0300000c 
08:53:40 ipsec,debug,packet 0100000c 800e0100 03000008 02000005 03000008 0300000c 00000008 0400000e 
08:53:40 ipsec,debug,packet 28000108 000e0000 2073450e c02743da fdb458dc 82f2b940 82bdb938 280e75ed 
08:53:40 ipsec,debug,packet c80f8478 a3782992 0dad112f 7df35a2e cca54bb5 38e54241 6a201966 7c3fbcfe 
08:53:40 ipsec,debug,packet 53b35b59 6bbb892f 55a32d75 b718334d a5960a22 ce000ce1 3e1a6f39 2b4fc32e 
08:53:40 ipsec,debug,packet e4e57e09 2cff7854 e2648613 a6d833df b5598911 03fc0263 38834818 8f869abb 
08:53:40 ipsec,debug,packet 326c6039 e9b8757b 35d7dc95 c1209eb1 62ece683 0f820895 84e9c72e a8ce6b9c 
08:53:40 ipsec,debug,packet 89cf1ea8 f4a3e027 39e8bb2c 3b394986 4a955e47 82876ae3 ecc8b45f 393dad8f 
08:53:40 ipsec,debug,packet 96fc725b 59341104 35cf44de 6d3720da 16bf2a46 07b675b4 fc5b2eef 13523fa7 
08:53:40 ipsec,debug,packet bd1028f2 29612ba0 00dd35df 1fe997eb 5bb1a019 5824938b d556a6f6 786d6744 
08:53:40 ipsec,debug,packet bc611d13 e77038a3 29000014 0f966a8f 2944d4a8 3776a07a 66714533 29000008 
08:53:40 ipsec,debug,packet 00004016 2900001c 00004004 770a1884 22b8c1be 7db848be e1377f3e 565b3b5e 
08:53:40 ipsec,debug,packet 2900001c 00004005 f9f0230c b217807f cf5ea380 de665db0 1902a9b9 29000008 
08:53:40 ipsec,debug,packet 0000402e 0000000e 0000402f 00040003 0002 
08:53:41 ipsec,debug => shared secret (size 0x100) 
08:53:41 ipsec,debug acb60046 8ef7715c ab727f91 798731b4 d9948cb6 9d1aa33a 36d33d3c 7d5fe552 
08:53:41 ipsec,debug 91594a86 1db0bb16 fec5c6cf 77b72ec4 02740482 d62da96c 1329b59f 786d33dd 
08:53:41 ipsec,debug 06c10529 6049d928 910ef0e8 6112c5d7 41626234 0935f977 cd5892bd d2c6b0c7 
08:53:41 ipsec,debug e48e733f 4a5047c6 0d619daa 46c19b1c 4ed4d261 b73a5303 5f56f5f3 2710f86e 
08:53:41 ipsec,debug 685fb76d 61129e18 b6f84ef6 ceae627b 321dd36e af6e903f 1a152610 d858681e 
08:53:41 ipsec,debug 66ff1464 14d86597 b5bb4cc4 25aa17a0 072c274b 07cd8cf7 53c30d3e cf889c78 
08:53:41 ipsec,debug 6995d3d7 7419392d 827f7d6f 7b217f9d c2694e8a 8964bb58 e0ef29b4 2620af78 
08:53:41 ipsec,debug 53cc2827 38abbc83 a4bbe5f1 d852e560 0433f45e 3e167ea2 5c254ea0 af4f2c6b 
08:53:41 ipsec,debug => (size 0x30) 
08:53:41 ipsec,debug 00000030 0000002c 04010004 0300000c 0100000c 800e0100 03000008 02000005 
08:53:41 ipsec,debug 03000008 0300000c 00000008 0400000e 
08:53:41 ipsec,debug => (first 0x100 of 0x108) 
08:53:41 ipsec,debug 00000108 000e0000 2f34cff9 01faca1c 03e84313 a02cde43 d06c784d 6aab33a4 
08:53:41 ipsec,debug 60f2b63b 6944ff63 9525d6c8 f2b62406 31462bfd a15f67fe b69c26f5 5f5f8d59 
08:53:41 ipsec,debug 98744205 9f39e196 f70140a4 ee2e8fe9 c5dd05d1 bf6b32b7 5e10ca79 486108cb 
08:53:41 ipsec,debug 649f9734 a84ea676 c6650234 66246f3a 81327615 de043966 a53f1cfa f3f407d2 
08:53:41 ipsec,debug 7fa0c741 cbaec7f6 d37df0b7 18303d80 40e884ac 3cf858b6 750dc96c e3b4ebaf 
08:53:41 ipsec,debug 9f43cf99 9c2c60cf ef69eb5f ab3c2172 bec7005c 9f604aea 9242d390 cb4a22e4 
08:53:41 ipsec,debug b5065c0d 17c0c3d2 c6807841 6a324773 1f374faf f8f3ea8c 8142d1e2 3e493576 
08:53:41 ipsec,debug 1aca160e b9861ce8 2814d01b 38beeb7a 1b5971f2 e662ef35 40bf4663 842f0146 
08:53:41 ipsec,debug => (size 0x1c) 
08:53:41 ipsec,debug 0000001c b32c66aa dbcb7b16 d1c781ae 88b67374 24dd7810 617897a0 
08:53:41 ipsec,debug => (size 0x1c) 
08:53:41 ipsec,debug 0000001c 00004004 fe88b7ce e03f974f b5fe0bc3 3ee7070c 9b6fbece 
08:53:41 ipsec,debug => (size 0x1c) 
08:53:41 ipsec,debug 0000001c 00004005 d2cee748 978cfce7 ea30c5a2 8c32526f ad7df047 
08:53:41 ipsec,debug => (size 0x8) 
08:53:41 ipsec,debug 00000008 0000402e 
08:53:41 ipsec,debug => (size 0x5) 
08:53:41 ipsec,debug 00000005 04 
08:53:41 ipsec,debug ===== sending 437 bytes from 213.158.206.103[500] to 37.31.156.56[37972] 
08:53:41 ipsec,debug 1 times of 437 bytes message will be sent to 37.31.156.56[37972] 
08:53:41 ipsec,debug,packet 9ccf8836 a6fc17dd fc717881 e4623329 21202220 00000000 000001b5 22000030 
08:53:41 ipsec,debug,packet 0000002c 04010004 0300000c 0100000c 800e0100 03000008 02000005 03000008 
08:53:41 ipsec,debug,packet 0300000c 00000008 0400000e 28000108 000e0000 2f34cff9 01faca1c 03e84313 
08:53:41 ipsec,debug,packet a02cde43 d06c784d 6aab33a4 60f2b63b 6944ff63 9525d6c8 f2b62406 31462bfd 
08:53:41 ipsec,debug,packet a15f67fe b69c26f5 5f5f8d59 98744205 9f39e196 f70140a4 ee2e8fe9 c5dd05d1 
08:53:41 ipsec,debug,packet bf6b32b7 5e10ca79 486108cb 649f9734 a84ea676 c6650234 66246f3a 81327615 
08:53:41 ipsec,debug,packet de043966 a53f1cfa f3f407d2 7fa0c741 cbaec7f6 d37df0b7 18303d80 40e884ac 
08:53:41 ipsec,debug,packet 3cf858b6 750dc96c e3b4ebaf 9f43cf99 9c2c60cf ef69eb5f ab3c2172 bec7005c 
08:53:41 ipsec,debug,packet 9f604aea 9242d390 cb4a22e4 b5065c0d 17c0c3d2 c6807841 6a324773 1f374faf 
08:53:41 ipsec,debug,packet f8f3ea8c 8142d1e2 3e493576 1aca160e b9861ce8 2814d01b 38beeb7a 1b5971f2 
08:53:41 ipsec,debug,packet e662ef35 40bf4663 842f0146 07c84703 da7af7a7 2900001c b32c66aa dbcb7b16 
08:53:41 ipsec,debug,packet d1c781ae 88b67374 24dd7810 617897a0 2900001c 00004004 fe88b7ce e03f974f 
08:53:41 ipsec,debug,packet b5fe0bc3 3ee7070c 9b6fbece 2900001c 00004005 d2cee748 978cfce7 ea30c5a2 
08:53:41 ipsec,debug,packet 8c32526f ad7df047 26000008 0000402e 00000005 04 
08:53:41 ipsec,debug => skeyseed (size 0x20) 
08:53:41 ipsec,debug 43b2e673 eb6ccbad ceb6cbdd a10a95c3 24ef34ae e3c61ed4 e39c3c70 06dbf9dd 
08:53:41 ipsec,debug => keymat (size 0x20) 
08:53:41 ipsec,debug c2c51e6d 5d6bdd9a dc8bf321 9e2e0955 47aa67e4 8737000b 3deb1595 06e71f0c 
08:53:41 ipsec,debug => SK_ai (size 0x20) 
08:53:41 ipsec,debug c616b6ec 3d8ff65e 03ceb734 4f28cb0b f9cfc179 4a33b04f 6719f107 1cc552d2 
08:53:41 ipsec,debug => SK_ar (size 0x20) 
08:53:41 ipsec,debug d5e2077f e08b4925 0fda38ee 14737b7d 6c2d5394 60486cdf 9b8eb94d 8c4a9a5d 
08:53:41 ipsec,debug => SK_ei (size 0x20) 
08:53:41 ipsec,debug 9d64c959 5155e365 1b44570f e5029daf 7ef55125 d0cc64a8 9664d962 99b71512 
08:53:41 ipsec,debug => SK_er (size 0x20) 
08:53:41 ipsec,debug 0c94c788 4cc2b910 600300f0 232a0f4a e8e67889 d926c03d d653dedb 856ffa60 
08:53:41 ipsec,debug => SK_pi (size 0x20) 
08:53:41 ipsec,debug 0d288104 3d6c32c3 5cb9977a ba1f8eaa d0dec7ea 97881de4 a1707f2c 51ae4ce5 
08:53:41 ipsec,debug => SK_pr (size 0x20) 
08:53:41 ipsec,debug e27e6d38 12efec8b f21bbbcf fb6f215a 6db91ed7 bfeee47a fe9dbf91 3ee74e3b 
08:53:41 ipsec,info new ike2 SA (R): peer-ikev2 213.158.206.103[500]-37.31.156.56[37972] spi:fc717881e4623329:9ccf8836a6fc17dd 
08:53:41 ipsec,debug 000400030002 
08:53:41 ipsec,debug ===== received 562 bytes from 37.31.156.56[37972] to 213.158.206.103[500] 
08:53:41 ipsec,debug,packet 9ccf8836 a6fc17dd 00000000 00000000 21202208 00000000 00000232 220000a4 
08:53:41 ipsec,debug,packet 02000024 01010003 0300000c 01000014 800e0100 03000008 02000005 00000008 
08:53:41 ipsec,debug,packet 04000013 02000024 02010003 0300000c 01000014 800e0100 03000008 02000005 
08:53:41 ipsec,debug,packet 00000008 0400000e 0200002c 03010004 0300000c 0100000c 800e0100 03000008 
08:53:41 ipsec,debug,packet 02000005 03000008 0300000c 00000008 04000013 0000002c 04010004 0300000c 
08:53:41 ipsec,debug,packet 0100000c 800e0100 03000008 02000005 03000008 0300000c 00000008 0400000e 
08:53:41 ipsec,debug,packet 28000108 000e0000 2073450e c02743da fdb458dc 82f2b940 82bdb938 280e75ed 
08:53:41 ipsec,debug,packet c80f8478 a3782992 0dad112f 7df35a2e cca54bb5 38e54241 6a201966 7c3fbcfe 
08:53:41 ipsec,debug,packet 53b35b59 6bbb892f 55a32d75 b718334d a5960a22 ce000ce1 3e1a6f39 2b4fc32e 
08:53:41 ipsec,debug,packet e4e57e09 2cff7854 e2648613 a6d833df b5598911 03fc0263 38834818 8f869abb 
08:53:41 ipsec,debug,packet 326c6039 e9b8757b 35d7dc95 c1209eb1 62ece683 0f820895 84e9c72e a8ce6b9c 
08:53:41 ipsec,debug,packet 89cf1ea8 f4a3e027 39e8bb2c 3b394986 4a955e47 82876ae3 ecc8b45f 393dad8f 
08:53:41 ipsec,debug,packet 96fc725b 59341104 35cf44de 6d3720da 16bf2a46 07b675b4 fc5b2eef 13523fa7 
08:53:41 ipsec,debug,packet bd1028f2 29612ba0 00dd35df 1fe997eb 5bb1a019 5824938b d556a6f6 786d6744 
08:53:41 ipsec,debug,packet bc611d13 e77038a3 29000014 0f966a8f 2944d4a8 3776a07a 66714533 29000008 
08:53:41 ipsec,debug,packet 00004016 2900001c 00004004 770a1884 22b8c1be 7db848be e1377f3e 565b3b5e 
08:53:41 ipsec,debug,packet 2900001c 00004005 f9f0230c b217807f cf5ea380 de665db0 1902a9b9 29000008 
08:53:41 ipsec,debug,packet 0000402e 0000000e 0000402f 00040003 0002 
08:53:41 ipsec,debug ===== sending 437 bytes from 213.158.206.103[500] to 37.31.156.56[37972] 
08:53:41 ipsec,debug 1 times of 437 bytes message will be sent to 37.31.156.56[37972] 
08:53:41 ipsec,debug,packet 9ccf8836 a6fc17dd fc717881 e4623329 21202220 00000000 000001b5 22000030 
08:53:41 ipsec,debug,packet 0000002c 04010004 0300000c 0100000c 800e0100 03000008 02000005 03000008 
08:53:41 ipsec,debug,packet 0300000c 00000008 0400000e 28000108 000e0000 2f34cff9 01faca1c 03e84313 
08:53:41 ipsec,debug,packet a02cde43 d06c784d 6aab33a4 60f2b63b 6944ff63 9525d6c8 f2b62406 31462bfd 
08:53:41 ipsec,debug,packet a15f67fe b69c26f5 5f5f8d59 98744205 9f39e196 f70140a4 ee2e8fe9 c5dd05d1 
08:53:41 ipsec,debug,packet bf6b32b7 5e10ca79 486108cb 649f9734 a84ea676 c6650234 66246f3a 81327615 
08:53:41 ipsec,debug,packet de043966 a53f1cfa f3f407d2 7fa0c741 cbaec7f6 d37df0b7 18303d80 40e884ac 
08:53:41 ipsec,debug,packet 3cf858b6 750dc96c e3b4ebaf 9f43cf99 9c2c60cf ef69eb5f ab3c2172 bec7005c 
08:53:41 ipsec,debug,packet 9f604aea 9242d390 cb4a22e4 b5065c0d 17c0c3d2 c6807841 6a324773 1f374faf 
08:53:41 ipsec,debug,packet f8f3ea8c 8142d1e2 3e493576 1aca160e b9861ce8 2814d01b 38beeb7a 1b5971f2 
08:53:41 ipsec,debug,packet e662ef35 40bf4663 842f0146 07c84703 da7af7a7 2900001c b32c66aa dbcb7b16 
08:53:41 ipsec,debug,packet d1c781ae 88b67374 24dd7810 617897a0 2900001c 00004004 fe88b7ce e03f974f 
08:53:41 ipsec,debug,packet b5fe0bc3 3ee7070c 9b6fbece 2900001c 00004005 d2cee748 978cfce7 ea30c5a2 
08:53:41 ipsec,debug,packet 8c32526f ad7df047 26000008 0000402e 00000005 04 
08:53:41 ipsec,debug ===== received 384 bytes from 37.31.156.56[37971] to 213.158.206.103[4500] 
08:53:41 ipsec,debug,packet 9ccf8836 a6fc17dd fc717881 e4623329 2e202308 00000001 00000180 23000164 
08:53:41 ipsec,debug,packet 86a62222 994f1aef 368b5a14 8c02db65 983e6b36 bbbdf0c4 5cf81c6f 89923256 
08:53:41 ipsec,debug,packet 84ed1f89 071e5937 b4fe1fe0 d45df05a c64b8285 edc12ef6 6e17d15d c94a02b2 
08:53:41 ipsec,debug,packet 9847e384 9011f139 b32a8765 982eaf44 1ac58e35 9cc561be 89a11ce7 9120c82c 
08:53:41 ipsec,debug,packet f86831fc 2898eeec 84ae2415 8a41007c e74f6c65 84f4c57a 999bfb64 bec8b798 
08:53:41 ipsec,debug,packet 15312039 9b434182 2f1783d4 5083f7a2 351bcfca 9e11db2a 4471f3f6 369d824a 
08:53:41 ipsec,debug,packet 9a01b77f 34dfd446 4a09fee2 682528c6 9f8bd50a d7969401 e3948995 85e719cb 
08:53:41 ipsec,debug,packet c29b9a3b 57a21dd7 5cd56d0b 71f65ee5 c462ec33 6b2b8996 c8d127b7 6023dd82 
08:53:41 ipsec,debug,packet 73eeabd6 1befa16a a4455b63 27774f11 3761a6c4 827ecb06 2a1c59fe b81b56cb 
08:53:41 ipsec,debug,packet c2d9771e 5d35a009 acf5b6cd c7fae9ca 091cb045 aed3f388 e1faa379 57c46426 
08:53:41 ipsec,debug,packet d387f8f4 9bb68a54 995ed505 b54b77d2 62c17b74 d9d0e3f3 1b163c4c aa7240e6 
08:53:41 ipsec,debug,packet 798677c4 a4febecf 51d6d4fc ce3c2886 08f95a19 037f4713 d0b91ea5 a32218d4 
08:53:41 ipsec,debug KA tree dump: 213.158.206.103[4500]->37.31.156.56[37972] (in_use=1) 
08:53:41 ipsec,debug KA removing this one... 
08:53:41 ipsec,debug => iv (size 0x10) 
08:53:41 ipsec,debug 86a62222 994f1aef 368b5a14 8c02db65 
08:53:41 ipsec,debug decrypted packet 
08:53:41 ipsec,debug,packet => decrypted packet (size 0x156) 
08:53:41 ipsec,debug,packet 9ccf8836 a6fc17dd fc717881 e4623329 23202308 00000001 00000156 2900000c 
08:53:41 ipsec,debug,packet 01000000 0abab42e 24000008 00004000 2f00001a 02000000 72656d6f 74652e70 
08:53:41 ipsec,debug,packet 72616b77 6963652e 706c2900 00280100 00000001 00000002 00000006 00000003 
08:53:41 ipsec,debug,packet 00000008 0000000c 0000000a 00000019 00002900 00080000 400a2100 00080000 
08:53:41 ipsec,debug,packet 400b2c00 004c0200 00200103 04020f83 99e70300 000c0100 0014800e 01000000 
08:53:41 ipsec,debug,packet 00080500 00000000 00280203 04030f83 99e70300 000c0100 000c800e 01000300 
08:53:41 ipsec,debug,packet 00080300 000c0000 00080500 00002d00 00400200 00000700 00100000 ffff0000 
08:53:41 ipsec,debug,packet 0000ffff ffff0800 00280000 ffff0000 00000000 00000000 00000000 0000ffff 
08:53:41 ipsec,debug,packet 
08:53:41 ipsec,debug,packet ffffffff ffffffff ffffffff ffff2900 00400200 00000700 00100000 ffff0000 
08:53:41 ipsec,debug,packet 0000ffff ffff0800 00280000 ffff0000 00000000 00000000 00000000 0000ffff 
08:53:41 ipsec,debug,packet ffffffff ffffffff ffffffff ffff0000 00080000 400c 
08:53:41 ipsec,debug ignoring unterminated SAN: DNS: remote.prakwice.pl 
08:53:41 ipsec,debug => auth nonce (size 0x10) 
08:53:41 ipsec,debug 0f966a8f 2944d4a8 3776a07a 66714533 
08:53:41 ipsec,debug => SK_p (size 0x20) 
08:53:41 ipsec,debug e27e6d38 12efec8b f21bbbcf fb6f215a 6db91ed7 bfeee47a fe9dbf91 3ee74e3b 
08:53:41 ipsec,debug => idhash (size 0x20) 
08:53:41 ipsec,debug 473f895a 20677df2 b970b1f9 404481be cedca508 d65dcbe4 aa579672 584be188 
08:53:41 ipsec,debug => my auth (size 0x100) 
08:53:41 ipsec,debug 36db2520 c9f14377 2ee3df6e 6fc85d68 fd4bdcc4 1c2310e2 40e88d7a 19d266c8 
08:53:41 ipsec,debug 5189f91f a17ba8a6 03bcc307 91edafd0 31067697 5c32a4d7 6df67b88 3c3307f0 
08:53:41 ipsec,debug 5a165f7f 795379f5 bda2ef9c 31a3f497 941ffcfa ab53d9cd 398a5c8c 1e224826 
08:53:41 ipsec,debug 67039a0d 3c8e5ed3 86c2828d 75bae275 5c3c1fd6 c5bc9341 348dce88 0cec091c 
08:53:41 ipsec,debug ab7ed07f 7c308597 47cb6f1f 3c454db8 90375456 2e8467b4 2a56a042 39b4cfca 
08:53:41 ipsec,debug f42b38c5 f29dc66c 2c995882 cd116af6 b45f494c c34dafe4 61f777bb 0c00f693 
08:53:41 ipsec,debug dd253814 656a729c a845f9c3 97eec116 9a4b0509 4db959c3 2934dcd2 37bf5cf7 
08:53:41 ipsec,debug 3364eb4a c4e761d6 7328b02e 4fb4da34 02ce67cf 3f2f3e8c e332083e 02408f2e 
08:53:41 ipsec,debug => (size 0x27) 
08:53:41 ipsec,debug 00000027 09000000 301d311b 30190603 55040313 1272656d 6f74652e 7072616b 
08:53:41 ipsec,debug 77696365 2e706c 
08:53:41 ipsec,debug => (first 0x100 of 0x108) 
08:53:41 ipsec,debug 00000108 01000000 36db2520 c9f14377 2ee3df6e 6fc85d68 fd4bdcc4 1c2310e2 
08:53:41 ipsec,debug 40e88d7a 19d266c8 5189f91f a17ba8a6 03bcc307 91edafd0 31067697 5c32a4d7 
08:53:41 ipsec,debug 6df67b88 3c3307f0 5a165f7f 795379f5 bda2ef9c 31a3f497 941ffcfa ab53d9cd 
08:53:41 ipsec,debug 398a5c8c 1e224826 67039a0d 3c8e5ed3 86c2828d 75bae275 5c3c1fd6 c5bc9341 
08:53:41 ipsec,debug 348dce88 0cec091c ab7ed07f 7c308597 47cb6f1f 3c454db8 90375456 2e8467b4 
08:53:41 ipsec,debug 2a56a042 39b4cfca f42b38c5 f29dc66c 2c995882 cd116af6 b45f494c c34dafe4 
08:53:41 ipsec,debug 61f777bb 0c00f693 dd253814 656a729c a845f9c3 97eec116 9a4b0509 4db959c3 
08:53:41 ipsec,debug 2934dcd2 37bf5cf7 3364eb4a c4e761d6 7328b02e 4fb4da34 02ce67cf 3f2f3e8c 
08:53:41 ipsec,debug => (first 0x100 of 0x4fa) 
08:53:41 ipsec,debug 000004fa 04308204 f1308203 d9a00302 01020212 03bc2625 06484be0 f8f9e60b 
08:53:41 ipsec,debug c5b446b6 ef11300d 06092a86 4886f70d 01010b05 00303231 0b300906 03550406 
08:53:41 ipsec,debug 13025553 31163014 06035504 0a130d4c 65742773 20456e63 72797074 310b3009 
08:53:41 ipsec,debug 06035504 03130252 33301e17 0d323430 34323230 38323234 375a170d 32343037 
08:53:41 ipsec,debug 32313038 32323436 5a301d31 1b301906 03550403 13127265 6d6f7465 2e707261 
08:53:41 ipsec,debug 6b776963 652e706c 30820122 300d0609 2a864886 f70d0101 01050003 82010f00 
08:53:41 ipsec,debug 3082010a 02820101 00b86ba9 ff7bff68 e280186b d700b027 6346e616 32b83461 
08:53:41 ipsec,debug 34459cdc 389b887e adefd53b c578515b 261974a0 3ba3a142 5743c82e 1b93210f 
08:53:41 ipsec,debug => (size 0x9) 
08:53:41 ipsec,debug 00000009 01000005 01 
08:53:41 ipsec,debug,packet => outgoing plain packet (size 0x64e) 
08:53:41 ipsec,debug,packet 9ccf8836 a6fc17dd fc717881 e4623329 24202320 00000001 0000064e 27000027 
08:53:41 ipsec,debug,packet 09000000 301d311b 30190603 55040313 1272656d 6f74652e 7072616b 77696365 
08:53:41 ipsec,debug,packet 2e706c25 00010801 00000036 db2520c9 f143772e e3df6e6f c85d68fd 4bdcc41c 
08:53:41 ipsec,debug,packet 2310e240 e88d7a19 d266c851 89f91fa1 7ba8a603 bcc30791 edafd031 0676975c 
08:53:41 ipsec,debug,packet 32a4d76d f67b883c 3307f05a 165f7f79 5379f5bd a2ef9c31 a3f49794 1ffcfaab 
08:53:41 ipsec,debug,packet 53d9cd39 8a5c8c1e 22482667 039a0d3c 8e5ed386 c2828d75 bae2755c 3c1fd6c5 
08:53:41 ipsec,debug,packet bc934134 8dce880c ec091cab 7ed07f7c 30859747 cb6f1f3c 454db890 3754562e 
08:53:41 ipsec,debug,packet 8467b42a 56a04239 b4cfcaf4 2b38c5f2 9dc66c2c 995882cd 116af6b4 5f494cc3 
08:53:41 ipsec,debug,packet 
08:53:41 ipsec,debug,packet 4dafe461 f777bb0c 00f693dd 25381465 6a729ca8 45f9c397 eec1169a 4b05094d 
08:53:41 ipsec,debug,packet b959c329 34dcd237 bf5cf733 64eb4ac4 e761d673 28b02e4f b4da3402 ce67cf3f 
08:53:41 ipsec,debug,packet 2f3e8ce3 32083e02 408f2e30 0004fa04 308204f1 308203d9 a0030201 02021203 
08:53:41 ipsec,debug,packet bc262506 484be0f8 f9e60bc5 b446b6ef 11300d06 092a8648 86f70d01 010b0500 
08:53:41 ipsec,debug,packet 3032310b 30090603 55040613 02555331 16301406 0355040a 130d4c65 74277320 
08:53:41 ipsec,debug,packet 456e6372 79707431 0b300906 03550403 13025233 301e170d 32343034 32323038 
08:53:41 ipsec,debug,packet 32323437 5a170d32 34303732 31303832 3234365a 301d311b 30190603 55040313 
08:53:41 ipsec,debug,packet 1272656d 6f74652e 7072616b 77696365 2e706c30 82012230 0d06092a 864886f7 
08:53:41 ipsec,debug,packet 
08:53:41 ipsec,debug,packet 0d010101 05000382 010f0030 82010a02 82010100 b86ba9ff 7bff68e2 80186bd7 
08:53:41 ipsec,debug,packet 00b02763 46e61632 b8346134 459cdc38 9b887ead efd53bc5 78515b26 1974a03b 
08:53:41 ipsec,debug,packet a3a14257 43c82e1b 93210ff2 45404dac 6fb31052 f74094b7 010a1e54 cffc469c 
08:53:41 ipsec,debug,packet 68a3f6f5 2eca5fb9 d8b69b3d 2451ca41 e5f985f9 4de18fdc 7d401ac4 b03c6585 
08:53:41 ipsec,debug,packet 384f2b17 b7abdb8d ca12e83a 7369c19e 30aa6670 78660df7 ca455ede 862d0cfd 
08:53:41 ipsec,debug,packet c9b000ed 29e11b69 a1aa0882 27dc4ace b7317297 a7e3edd7 e5ad0a45 77fc63b1 
08:53:41 ipsec,debug,packet 9c6e2bbd 573490d4 450d4a21 3c423e0d 232477fe 6aff73d6 8ea13584 7fcf5284 
08:53:41 ipsec,debug,packet c8eec18b 07062354 9df72e3c 93cee08b e707dff0 6da63d72 8b1d8b91 5e11c602 
08:53:41 ipsec,debug,packet 
08:53:41 ipsec,debug,packet 70f53416 ff696e80 e79f4ca9 df47bf68 56886fff 02030100 01a38202 14308202 
08:53:41 ipsec,debug,packet 10300e06 03551d0f 0101ff04 04030205 a0301d06 03551d25 04163014 06082b06 
08:53:41 ipsec,debug,packet 01050507 03010608 2b060105 05070302 300c0603 551d1301 01ff0402 3000301d 
08:53:41 ipsec,debug,packet 0603551d 0e041604 14cbe5ea a335da46 8c2de3e5 3fa511f2 f2251ac8 88301f06 
08:53:41 ipsec,debug,packet 03551d23 04183016 8014142e b317b758 56cbae50 0940e61f af9d8b14 c2c63055 
08:53:41 ipsec,debug,packet 06082b06 01050507 01010449 30473021 06082b06 01050507 30018615 68747470 
08:53:41 ipsec,debug,packet 3a2f2f72 332e6f2e 6c656e63 722e6f72 67302206 082b0601 05050730 02861668 
08:53:41 ipsec,debug,packet 7474703a 2f2f7233 2e692e6c 656e6372 2e6f7267 2f301d06 03551d11 04163014 
08:53:41 ipsec,debug,packet 
 08:53:41 ipsec,debug,packet 82127265 6d6f7465 2e707261 6b776963 652e706c 30130603 551d2004 0c300a30
 08:53:41 ipsec,debug,packet 08060667 810c0102 01308201 04060a2b 06010401 d6790204 020481f5 0481f200
 08:53:41 ipsec,debug,packet f0007700 3f174b4f d7224758 941d651c 84be0d12 ed90377f 1f856aeb c1bf2885
 08:53:41 ipsec,debug,packet ecf8646e 0000018f 051d73e6 00000403 00483046 022100d0 e5497af3 e524bc9d
 08:53:41 ipsec,debug,packet 4491a722 ab45e61e 9abdbde3 9b8efb7f 2a649caf ac020202 2100eef0 0920b094
 08:53:41 ipsec,debug,packet e70ecfb3 1bb04f85 6141c166 4b535794 fe33d859 95c2058a 9e3f0075 00dfe156
 08:53:41 ipsec,debug,packet ebaa05af b59c0f86 718da8c0 324eae56 d96ea7f5 a56a01d1 c13bbe52 5c000001
 08:53:41 ipsec,debug,packet 8f051d74 aa000004 03004630 44022020 4554b8dd 88b3c8af 0c7ebf65 27bd2137
 08:53:41 ipsec,debug,packet 
 08:53:41 ipsec,debug,packet 626f1154 95fc76bb 82e9d70f 3883c102 20699da0 03140e49 a032907f 7c0bda1b
 08:53:41 ipsec,debug,packet 10f23dd6 9efa4e2b 660e487c 3badb6b9 c7300d06 092a8648 86f70d01 010b0500
 08:53:41 ipsec,debug,packet 03820101 002f2c61 f6e50ad4 250e00ac 83e27e22 bf2f09c5 52149fc0 65ab2ada
 08:53:41 ipsec,debug,packet 9cbd68aa e7969759 1d37df20 bdcc1717 2ab9172b 4719aaee a3f9d98b c948b5bb
 08:53:41 ipsec,debug,packet 682f0d10 5523909b 2a7116d9 4f5b6ea1 4fec032d bca83b23 e0d5f577 65e89813
 08:53:41 ipsec,debug,packet 62cd8293 7c889390 56f1c271 e2b7be58 4dc28029 027497ca 0d1b257f 069988ad
 08:53:41 ipsec,debug,packet 408eef9b 7a9ef69d 05d7e6bc 02168302 0c9f8127 e33a34f8 4f9784a9 989484c4
 08:53:41 ipsec,debug,packet 95900d9f 111411de 87b50bec 46afd784 ce8d7c53 ab1109af 3d4e203d 02348b28
 08:53:41 ipsec,debug,packet 
 08:53:41 ipsec,debug,packet a59150a5 58012bf9 32e86b73 cd86d421 418b9a2e 530c3126 a0bba4f9 da1bc773
 08:53:41 ipsec,debug,packet 3dc1cbbb e6af0d43 998f22f3 59bdb8b6 98e38187 f597660c 7616ee82 7420e96d
 08:53:41 ipsec,debug,packet 1f4445af 27000000 09010000 0501
 08:53:41 ipsec,debug => (first 0x100 of 0x4c8)
 08:53:41 ipsec,debug 240004c8 00010002 8608f95a 19037f47 13d0b91e a5a32218 c5fa70b4 9fcd513d
 08:53:41 ipsec,debug d4eb23a3 dca2e7db 70a28017 3e9fd6a0 179da7bc 4e24dec8 0f13570c a9288744
 08:53:41 ipsec,debug 8c8c18f6 e573f688 4339cceb 77548adb fac252a0 9d11cf2e dd013494 cd02990d
 08:53:42 ipsec,debug 607b672c aac23dee 3c0729d5 ec724856 835e9ecb a70cca7e eb6d8f6c 81a4d278
 08:53:42 ipsec,debug e999f9ce 334f5072 614edb76 3940b256 53dac12f 895197e6 b6c319f8 0ad49344
 08:53:42 ipsec,debug 0129a6d9 1381a3ba b5eb4f5e db1a313d c09918d7 7fe82274 d3a63cb4 82dfbd46
 08:53:42 ipsec,debug 4c3ba2ce 33dce291 72c3fd35 7b766ce2 b3da7d09 90a8576f 63668927 62532c19
 08:53:42 ipsec,debug 76659907 42defff7 cfa38090 4ca64098 a1a908ac 5c18b67d 115d9b12 0da60d8d
 08:53:42 ipsec,debug => (first 0x100 of 0x358)
 08:53:42 ipsec,debug 00000358 00020002 8608f95a 19037f47 13d0b91e a5a32218 986ab2fa 562321dc
 08:53:42 ipsec,debug 7335bd8c 0814873b ce85298d a51690cc a3728d7d 2e0ecb7d ad2233be b0795533
 08:53:42 ipsec,debug e3f77889 f42ae88b d3782cd6 7d99262b ddb09afa 19d6f2c0 873ae2a0 3f6d9bc6
 08:53:42 ipsec,debug 4521e92f 86283530 3f2cca96 86fedb04 71310d91 da9d6988 7c98d9ee 618ca3f8
 08:53:42 ipsec,debug f45fa7af 8ebad652 ef9b7b2d 5bffd4cb f5642a56 8e5e31bf a24df1af 7c14153f
 08:53:42 ipsec,debug c9ba4082 528a9fc3 9cba755f fa90c088 eaae7936 01587b94 107d477d f319ac8d
 08:53:42 ipsec,debug 44da64fc 3a8d0a69 434e27e6 ca4509bf 9f7bd3f6 bbbf8136 df2fe24b 54162565
 08:53:42 ipsec,debug 6050f467 a9c0e848 d4f1d336 45dd1a1a 5fc6759c 6d2eafbf 8f108de9 f714deb7
 08:53:42 ipsec,debug ===== sending 1252 bytes from 213.158.206.103[4500] to 37.31.156.56[37971]
 08:53:42 ipsec,debug 1 times of 1256 bytes message will be sent to 37.31.156.56[37971]
 08:53:42 ipsec,debug,packet 9ccf8836 a6fc17dd fc717881 e4623329 35202320 00000001 000004e4 240004c8
 08:53:42 ipsec,debug,packet 00010002 8608f95a 19037f47 13d0b91e a5a32218 c5fa70b4 9fcd513d d4eb23a3
 08:53:42 ipsec,debug,packet dca2e7db 70a28017 3e9fd6a0 179da7bc 4e24dec8 0f13570c a9288744 8c8c18f6
 08:53:42 ipsec,debug,packet e573f688 4339cceb 77548adb fac252a0 9d11cf2e dd013494 cd02990d 607b672c
 08:53:42 ipsec,debug,packet aac23dee 3c0729d5 ec724856 835e9ecb a70cca7e eb6d8f6c 81a4d278 e999f9ce
 08:53:42 ipsec,debug,packet 334f5072 614edb76 3940b256 53dac12f 895197e6 b6c319f8 0ad49344 0129a6d9
 08:53:42 ipsec,debug,packet 1381a3ba b5eb4f5e db1a313d c09918d7 7fe82274 d3a63cb4 82dfbd46 4c3ba2ce
 08:53:42 ipsec,debug,packet 33dce291 72c3fd35 7b766ce2 b3da7d09 90a8576f 63668927 62532c19 76659907
 08:53:42 ipsec,debug,packet 42defff7 cfa38090 4ca64098 a1a908ac 5c18b67d 115d9b12 0da60d8d d8dddd1e
 08:53:42 ipsec,debug,packet e1860248 0c951166 de139557 bbf3e857 a265fae3 466068cc 4a85813f da510c1e
 08:53:42 ipsec,debug,packet 9468c8d7 f2c42dac c28a8728 1a0474c7 6b9d3df8 199aff0e c24ec257 641fb66f
 08:53:42 ipsec,debug,packet 8a1c8d0a 7e10344a 45c55325 ae8cc1c2 96e53e5c 5ea897a9 a2753a78 f921b525
 08:53:42 ipsec,debug,packet 3234b7ea 1317558e 1f2fa16d ca74ae32 62445ec7 6feb27b0 789381fd 17690f52
 08:53:42 ipsec,debug,packet 34e8dd2b 70304568 e316ab02 6b5e6aa6 e95b04a5 2e16c179 cc960366 07720ae8
 08:53:42 ipsec,debug,packet 88cf2f5e b0ea2907 51f8d498 a7c2a4ee 6259f126 3f739f35 e054a33c 6c6c624d
 08:53:42 ipsec,debug,packet a892e3b2 2d7e87db a25a7204 b01d2796 935ebf0b 735be35e e23a8d34 38c868cc
 08:53:42 ipsec,debug,packet f535e4d5 27b92d08 fff8eacb e3355526 e414bee0 f401bc23 b32ba995 3a884c10
 08:53:42 ipsec,debug,packet 206c5279 7de90993 a048d13a 7fbc0be4 e34ff742 4f7cfd28 9531c126 a220c0f3
 08:53:42 ipsec,debug,packet 4bc143a5 b0d61d7e f6def5d1 121fe196 c5c783c2 85c1eb41 b7fd8a01 025f7213
 08:53:42 ipsec,debug,packet bff5a3bd 8dd216bc cb258b7f 03d601c7 e09d7b74 960c3e0e 295569d1 d9bcf023
 08:53:42 ipsec,debug,packet 3688936e d28e5d3e e9229ada 5247f129 7a4ee914 7faa57f9 4a915a1d aeda5100
 08:53:42 ipsec,debug,packet da5ebb45 9df20627 efec62c3 3c21c75e fb5d9cb0 551f5c13 80d50ae4 5100953e
 08:53:42 ipsec,debug,packet 7396d783 abe32841 0ef51a12 ff952a7c 42d2ecc5 5c05c429 604721e2 5d70a390
 08:53:42 ipsec,debug,packet 519023f5 2e6fafd7 86662509 3c523ed9 da315fd3 96b2a178 04c3a7e0 0926c223
 08:53:42 ipsec,debug,packet 5bbb85d0 1519ea79 fdeecfe3 ddf6f86e d562fbf3 6521ce27 a0d15431 9cf510ed
 08:53:42 ipsec,debug,packet a1f62e87 5277e4fc c303ed42 a3fe717e d615b361 99337357 60e58719 9c168c0d
 08:53:42 ipsec,debug,packet 35d23e42 94687534 db0eb190 5cc27ce6 b520e603 b8baacca 442abdf5 8d855d64
 08:53:42 ipsec,debug,packet 41bec953 465e8352 c0e95d24 4c6a436f 3a2617c1 f0c72cf2 3d10e7fc 84112efd
 08:53:42 ipsec,debug,packet 32c52d5b d3a99e9c af79d6fe f2e30254 1e12443f d7ddad86 957cc2a8 71907327
 08:53:42 ipsec,debug,packet 38a94551 17e0ad86 9bec2a3e 459c6068 3425267f 69074c4e 1d6b933a 3f894194
 08:53:42 ipsec,debug,packet 8477fc4d ccf9dd64 3bc9686b 330eaa06 c6a07484 0ee56791 e0cc5d67 933a78d6
 08:53:42 ipsec,debug,packet 0f56569a 9f184130 99cdb058 9d03ef77 09c86836 49eea971 c2c47622 ecc90647
 08:53:42 ipsec,debug,packet bc52aa3e 28fa84c2 6ea21638 2978b76d 9c1df235 a6dbf3a2 617d69a6 81a30df7
 08:53:42 ipsec,debug,packet 98549313 76b3dd2f 073a6fde dd0505be c2577839 aa949a5b 8bf9b845 eeb4cf09
 08:53:42 ipsec,debug,packet c9209848 ca062730 1ec56dfc e46cf56a 44e200ff 893720f9 e6ba7435 71774219
 08:53:42 ipsec,debug,packet 1bb748c0 c44ba44a 7b42a824 18561fa3 9e00aa1e 9e0dc4b0 4fd04bcd 75d46b42
 08:53:42 ipsec,debug,packet eacedcbd 22197771 77bcd4e3 246d580a 0088f522 845fe05f 2999b698 7ae081bb
 08:53:42 ipsec,debug,packet 99fb4a3a 3ee8b265 fdf927d1 01150e55 bfbb3c92 6fd652ab b3e5e321 9e2b3a69
 08:53:42 ipsec,debug,packet 9e9abd63 625a49fc 36adb7bb ead8d332 fb9c2dd7 7be34290 f52c60b2 a9bd054d
 08:53:42 ipsec,debug,packet 841a55a8
 08:53:42 ipsec,debug ===== sending 884 bytes from 213.158.206.103[4500] to 37.31.156.56[37971]
 08:53:42 ipsec,debug 1 times of 888 bytes message will be sent to 37.31.156.56[37971]
 08:53:42 ipsec,debug,packet 9ccf8836 a6fc17dd fc717881 e4623329 35202320 00000001 00000374 00000358
 08:53:42 ipsec,debug,packet 00020002 8608f95a 19037f47 13d0b91e a5a32218 986ab2fa 562321dc 7335bd8c
 08:53:42 ipsec,debug,packet 0814873b ce85298d a51690cc a3728d7d 2e0ecb7d ad2233be b0795533 e3f77889
 08:53:42 ipsec,debug,packet f42ae88b d3782cd6 7d99262b ddb09afa 19d6f2c0 873ae2a0 3f6d9bc6 4521e92f
 08:53:42 ipsec,debug,packet 86283530 3f2cca96 86fedb04 71310d91 da9d6988 7c98d9ee 618ca3f8 f45fa7af
 08:53:42 ipsec,debug,packet 8ebad652 ef9b7b2d 5bffd4cb f5642a56 8e5e31bf a24df1af 7c14153f c9ba4082
 08:53:42 ipsec,debug,packet 528a9fc3 9cba755f fa90c088 eaae7936 01587b94 107d477d f319ac8d 44da64fc
 08:53:42 ipsec,debug,packet 3a8d0a69 434e27e6 ca4509bf 9f7bd3f6 bbbf8136 df2fe24b 54162565 6050f467
 08:53:42 ipsec,debug,packet a9c0e848 d4f1d336 45dd1a1a 5fc6759c 6d2eafbf 8f108de9 f714deb7 05c47e45
 08:53:42 ipsec,debug,packet 65467079 ef1085d1 effcb2ed d76d15f7 bd2fb7db 64a87117 89454c79 8e1d63c8
 08:53:42 ipsec,debug,packet 06fd9dc3 43cfa420 065cf19d ca7b1e4b 5c0e5fac 66cf4f30 7fd21dcc e1f17e9d
 08:53:42 ipsec,debug,packet 51a2a074 2e1576be b4dc16cf 9eeafa11 e7f2209b 5d35a0ef 1567474a 81c65015
 08:53:42 ipsec,debug,packet 864c0e73 79cc9824 926e8fa2 c23a571d 74cd5790 9f6afcc1 b55dc11c 502e09e8
 08:53:42 ipsec,debug,packet 197ee50a 1a6edd20 90804528 7463e22b 19aff1c6 c5288066 bb12774f bab01b7e
 08:53:42 ipsec,debug,packet 0265de23 191453d6 30c26029 b4be7e61 bbd1e833 9e2d1527 fb19a6fb 05f1062f
 08:53:42 ipsec,debug,packet 085fc668 b084e95c a9e7a814 3337f275 a2056407 4ae82bf9 86ba196f d01245de
 08:53:42 ipsec,debug,packet d7879899 b9a4f347 21d7aeec c7612211 675195fc 11f1bb1f ce86ce09 15f0e9a8
 08:53:42 ipsec,debug,packet 9666a7da 6d5266b3 f1ffd8db dec304a1 a3761399 ea2f1078 75482be6 1e162e6c
 08:53:42 ipsec,debug,packet 1ccf841a c9b7f8cc 7a5982c8 3ca72d66 8a152dc6 407437bb 0e1e14ea ba64012a
 08:53:42 ipsec,debug,packet 33a18ad3 a38b7625 1b2a48fb 302d2906 452de6b5 1a7e10d6 e279f65c c7382cf4
 08:53:42 ipsec,debug,packet 79854c27 796d33aa bc598027 ff9a27bd 786c30a4 2057bd32 e1396e19 92b524dc
 08:53:42 ipsec,debug,packet 7549c120 ff91c2a9 07857dc5 03253081 e57d5b55 26305df5 886f5d46 431ff0e0
 08:53:42 ipsec,debug,packet cb55bb97 c957d78d 13117e0b 38951ca9 8a1497b6 d4b04e48 278c1627 024bf1e5
 08:53:42 ipsec,debug,packet 205f34b7 e99ea7e3 59f038b0 519347f7 a6b41314 9c94f41e c30980c0 98334cff
 08:53:42 ipsec,debug,packet f4b85bdb 761abd24 5a46309a 38c966b8 dfbf073d 53cdb8f6 8071cb0e da94509b
 08:53:42 ipsec,debug,packet a659acf5 95243a51 19a7e1a9 96873a1f cd165b43 ec4238ae 2c3acd5b 06617b3f
 08:53:42 ipsec,debug,packet cafd5327 174374df bcfa1212 0818a960 a455e03d e838e749 498c20dc 94aa80fd
 08:53:42 ipsec,debug,packet b9f2d5bc 9ccffb38 a5d2981b 655d4974 dae0b857
 08:53:50 ipsec,debug KA: 213.158.206.103[4500]->37.31.156.56[37971]
 08:53:50 ipsec,debug 1 times of 1 bytes message will be sent to 37.31.156.56[37971]
 08:53:50 ipsec,debug,packet ff
 08:54:10 ipsec,debug KA: 213.158.206.103[4500]->37.31.156.56[37971]
 08:54:10 ipsec,debug 1 times of 1 bytes message will be sent to 37.31.156.56[37971]
 08:54:10 ipsec,debug,packet ff
 08:54:11 ipsec,info killing ike2 SA: peer-ikev2 213.158.206.103[4500]-37.31.156.56[37971] spi:fc717881e4623329:9ccf8836a6fc17dd
 08:54:11 ipsec,debug KA tree dump: 213.158.206.103[4500]->37.31.156.56[37971] (in_use=1)
 08:54:11 ipsec,debug KA removing this one...
2

You haven’t but Let’s Encrypt did - for the newly issued certificates, they started using another set of intermediate CAs, R10 and R11. So you have to install the intermediate ones to the certificate store of the Mikrotik. If that alone is not enough for IPsec (I haven’t got to testing it with IPsec yet, for hotspot it is sufficient), you will have to add those certificates to the certificate parameter of the /ip/ipsec/identity item (it can hold a list).
EDIT: So the intermediate certificates indeed have to be added to the certificate list on the /ip/ipsec/identity row in order that the Mikrotik would send them to the peer. The good thing is that the embedded Windows VPN client doesn’t mind receiving an unrelated certificate, so it doesn’t matter whether your Let’s Encrypt certificate gets signed using R10 or R11 on renewal, it is enough to add both to the list.

3

Any advice how to install intermediate ones?

4

Any advice how to install intermediate ones?

5

Go to the let’s encrypt web site, download them from there and import them on your Mikrotik. I don’t want to put here the direct urls because clicking to 3rd party links to obtain critical components of security is not a good practice, but it’s the first link, Let’s Encrypt Chains of Trust, that Google spits out when you search for “let’s encrypt R10 R11”. On that page, look for Let’s Encrypt R10 → Certificate details (signed by ISRG Root X1) → pem. Click on the pem link save the file, upload it to the Tik, and there, run /certificate/import file=r10.pem . Press [Enter] when asked for a passphrase, as the passphrase is only required to import the private key, which is not the case here. And repeat the procedure for R11.

Of course you could also use /tool/fetch to download the certificates directly from the web to the Mikrotik but since no CA certificates are installed in Mikrotik by default, you would have to disable the server certificate check for the fetch and although I cannot imagine any way how providing a forged intermediate certificate could be useful for some attack, maybe some do exist.

6

Just did it (r10 and r11) but connection still fails. Any ideas?

7

Have you just imported them or also added them to the certificate list on the /ip/ipsec/identity row?

8

Yes, I did. This is the log:

15:42:58 ipsec -> ike2 request, exchange: SA_INIT:0 37.31.152.56[31277] b94dbf8c75a52911:0000000000000000
 15:42:58 ipsec ike2 respond
 15:42:58 ipsec payload seen: SA
 15:42:58 ipsec payload seen: KE
 15:42:58 ipsec payload seen: NONCE
 15:42:58 ipsec payload seen: NOTIFY
 15:42:58 ipsec payload seen: NOTIFY
 15:42:58 ipsec payload seen: NOTIFY
 15:42:58 ipsec payload seen: NOTIFY
 15:42:58 ipsec payload seen: NOTIFY
 15:42:58 ipsec processing payload: SA
 15:42:58 ipsec IKE Protocol: IKE
 15:42:58 ipsec  proposal #1
 15:42:58 ipsec   enc: aes256-gcm
 15:42:58 ipsec   prf: hmac-sha256
 15:42:58 ipsec   dh: ecp256
 15:42:58 ipsec  proposal #2
 15:42:58 ipsec   enc: aes256-gcm
 15:42:58 ipsec   prf: hmac-sha256
 15:42:58 ipsec   dh: modp2048
 15:42:58 ipsec  proposal #3
 15:42:58 ipsec   enc: aes256-cbc
 15:42:58 ipsec   prf: hmac-sha256
 15:42:58 ipsec   auth: sha256
 15:42:58 ipsec   dh: ecp256
 15:42:58 ipsec  proposal #4
 15:42:58 ipsec   enc: aes256-cbc
 15:42:58 ipsec   prf: hmac-sha256
 15:42:58 ipsec   auth: sha256
 15:42:58 ipsec   dh: modp2048
 15:42:58 ipsec matched proposal:
 15:42:58 ipsec  proposal #4
 15:42:58 ipsec   enc: aes256-cbc
 15:42:58 ipsec   prf: hmac-sha256
 15:42:58 ipsec   auth: sha256
 15:42:58 ipsec   dh: modp2048
 15:42:58 ipsec processing payload: KE
 15:42:58 ipsec mismatch between KE and DH group: 14 != 19
 15:42:58 ipsec adding notify: INVALID_KE_PAYLOAD
 15:42:58 ipsec -> ike2 request, exchange: SA_INIT:0 37.31.152.56[31277] b94dbf8c75a52911:0000000000000000
 15:42:58 ipsec ike2 respond
 15:42:58 ipsec payload seen: SA
 15:42:58 ipsec payload seen: KE
 15:42:58 ipsec payload seen: NONCE
 15:42:58 ipsec payload seen: NOTIFY
 15:42:58 ipsec payload seen: NOTIFY
 15:42:58 ipsec payload seen: NOTIFY
 15:42:58 ipsec payload seen: NOTIFY
 15:42:58 ipsec payload seen: NOTIFY
 15:42:58 ipsec processing payload: SA
 15:42:58 ipsec IKE Protocol: IKE
 15:42:58 ipsec  proposal #1
 15:42:58 ipsec   enc: aes256-gcm
 15:42:58 ipsec   prf: hmac-sha256
 15:42:58 ipsec   dh: ecp256
 15:42:58 ipsec  proposal #2
 15:42:58 ipsec   enc: aes256-gcm
 15:42:58 ipsec   prf: hmac-sha256
 15:42:58 ipsec   dh: modp2048
 15:42:58 ipsec  proposal #3
 15:42:58 ipsec   enc: aes256-cbc
 15:42:58 ipsec   prf: hmac-sha256
 15:42:58 ipsec   auth: sha256
 15:42:58 ipsec   dh: ecp256
 15:42:58 ipsec  proposal #4
 15:42:58 ipsec   enc: aes256-cbc
 15:42:58 ipsec   prf: hmac-sha256
 15:42:58 ipsec   auth: sha256
 15:42:58 ipsec   dh: modp2048
 15:42:58 ipsec matched proposal:
 15:42:58 ipsec  proposal #4
 15:42:58 ipsec   enc: aes256-cbc
 15:42:58 ipsec   prf: hmac-sha256
 15:42:58 ipsec   auth: sha256
 15:42:58 ipsec   dh: modp2048
 15:42:58 ipsec processing payload: KE
 15:42:59 ipsec ike2 respond finish: request, exchange: SA_INIT:0 37.31.152.56[31277] b94dbf8c75a52911:0000000000000000
 15:42:59 ipsec processing payload: NONCE
 15:42:59 ipsec adding payload: SA
 15:42:59 ipsec adding payload: KE
 15:42:59 ipsec adding payload: NONCE
 15:42:59 ipsec adding notify: NAT_DETECTION_SOURCE_IP
 15:42:59 ipsec adding notify: NAT_DETECTION_DESTINATION_IP
 15:42:59 ipsec adding notify: IKEV2_FRAGMENTATION_SUPPORTED
 15:42:59 ipsec adding payload: CERTREQ
 15:42:59 ipsec <- ike2 reply, exchange: SA_INIT:0 37.31.152.56[31277] b94dbf8c75a52911:7eb7b4d5ce3648ea
 15:42:59 ipsec,info new ike2 SA (R): ikev2-peer 213.158.208.73[500]-37.31.152.56[31277] spi:7eb7b4d5ce3648ea:b94dbf8c75a52911
 15:42:59 ipsec processing payloads: VID (none found)
 15:42:59 ipsec processing payloads: NOTIFY
 15:42:59 ipsec   notify: REDIRECT_SUPPORTED
 15:42:59 ipsec   notify: NAT_DETECTION_SOURCE_IP
 15:42:59 ipsec   notify: NAT_DETECTION_DESTINATION_IP
 15:42:59 ipsec   notify: IKEV2_FRAGMENTATION_SUPPORTED
 15:42:59 ipsec   notify: SIGNATURE_HASH_ALGORITHMS
 15:42:59 ipsec (NAT-T) REMOTE 
 15:42:59 ipsec KA list add: 213.158.208.73[4500]->37.31.152.56[31277]
 15:42:59 ipsec fragmentation negotiated
 15:42:59 ipsec -> ike2 request, exchange: SA_INIT:0 37.31.152.56[31277] b94dbf8c75a52911:0000000000000000
 15:42:59 ipsec ike2 respond
 15:42:59 ipsec payload seen: SA
 15:42:59 ipsec payload seen: KE
 15:42:59 ipsec payload seen: NONCE
 15:42:59 ipsec payload seen: NOTIFY
 15:42:59 ipsec payload seen: NOTIFY
 15:42:59 ipsec payload seen: NOTIFY
 15:42:59 ipsec payload seen: NOTIFY
 15:42:59 ipsec payload seen: NOTIFY
 15:42:59 ipsec IKE_SA_INIT retransmitted
 15:42:59 ipsec -> ike2 request, exchange: AUTH:1 37.31.152.56[31253] b94dbf8c75a52911:7eb7b4d5ce3648ea
 15:42:59 ipsec peer ports changed: 31277 -> 31253
 15:42:59 ipsec KA remove: 213.158.208.73[4500]->37.31.152.56[31277]
 15:42:59 ipsec KA list add: 213.158.208.73[4500]->37.31.152.56[31253]
 15:42:59 ipsec payload seen: ENC
 15:42:59 ipsec processing payload: ENC
 15:42:59 ipsec payload seen: ID_I
 15:42:59 ipsec payload seen: NOTIFY
 15:42:59 ipsec payload seen: ID_R
 15:42:59 ipsec payload seen: CONFIG
 15:42:59 ipsec payload seen: NOTIFY
 15:42:59 ipsec payload seen: NOTIFY
 15:42:59 ipsec payload seen: SA
 15:42:59 ipsec payload seen: TS_I
 15:42:59 ipsec payload seen: TS_R
 15:42:59 ipsec payload seen: NOTIFY
 15:42:59 ipsec processing payloads: NOTIFY
 15:42:59 ipsec   notify: INITIAL_CONTACT
 15:42:59 ipsec   notify: ESP_TFC_PADDING_NOT_SUPPORTED
 15:42:59 ipsec   notify: NON_FIRST_FRAGMENTS_ALSO
 15:42:59 ipsec   notify: MOBIKE_SUPPORTED
 15:42:59 ipsec ike auth: respond
 15:42:59 ipsec processing payload: ID_I
 15:42:59 ipsec ID_I (ADDR4): 10.177.74.28
 15:42:59 ipsec processing payload: ID_R
 15:42:59 ipsec ID_R (FQDN): hidden
 15:42:59 ipsec processing payload: AUTH (not found)
 15:42:59 ipsec requested server id: hidden
 15:42:59 ipsec processing payloads: NOTIFY
 15:42:59 ipsec   notify: INITIAL_CONTACT
 15:42:59 ipsec   notify: ESP_TFC_PADDING_NOT_SUPPORTED
 15:42:59 ipsec   notify: NON_FIRST_FRAGMENTS_ALSO
 15:42:59 ipsec   notify: MOBIKE_SUPPORTED
 15:42:59 ipsec ID_R (DER DN): CN=hidden
 15:42:59 ipsec adding payload: ID_R
 15:42:59 ipsec adding payload: AUTH
 15:42:59 ipsec Certificate:
 15:42:59 ipsec   serialNr:  03:32:d3:72:41:f9:62:b2:04:46:ec:fa:f8:27:1a:cf:cb:e9
 15:42:59 ipsec   issuer:    <C=US, O=Let's Encrypt, CN=R11>
 15:42:59 ipsec   subject:   <CN=hidden>
 15:42:59 ipsec   notBefore: Tue Jul 30 12:13:17 2024
 15:42:59 ipsec   notAfter:  Mon Oct 28 12:13:16 2024
 15:42:59 ipsec   selfSigned:0
 15:42:59 ipsec   extensions:
 15:42:59 ipsec     key usage: digital-signature, key-encipherment
 15:42:59 ipsec     extended key usage: tls-server, tls-client
 15:42:59 ipsec     basic constraints: isCa: FALSE
 15:42:59 ipsec     subject key id:  f5:23:23:71:ea:10:ab:6d:b8:bc:be:7f:ec:c1:aa:79:57:43:64:37
 15:42:59 ipsec     authority key id:c5:cf:46:a4:ea:f4:c3:c0:7a:6c:95:c4:2d:b0:5e:92:2f:26:e3:b9
 15:42:59 ipsec     subject alternative name: 
 15:42:59 ipsec       DNS: hidden
 15:42:59 ipsec   signed with: SHA256+RSA
 15:42:59 ipsec [RSA-PUBLIC]
 15:42:59 ipsec modulus: af1dff5d1f30e59906bc9941a762a64802df0517af5a0d95c3eb953a88682566f883f60c0ed5e067ffc6aad94e9255be9610c65684f7ccb99046b88c24dd25c02ca1f138de6d13d5295799a5efbed7257938f43fb7450323e189a2bd002c2ac794fc18bfb678cfc03bed146682245c9f9146742235f9e65020809ba682bf08a61cb62a7d4fdacafb4fc831ae198449f99880b0a6b1c0d4096551f8772e6e7dbe618b7caa6a3341f1fc681983cd8ce8cda7ff4509c02856619c881baf8451affe180becf7b2b8aa1b11b5753f782adc92d6cd15c2af16d808e840d1bda242d6f872700492adb203e36916c8e93907e30509ced3fb5a12d6efd7362e1193fab801
 15:42:59 ipsec publicExponent: 10001
 15:42:59 ipsec adding payload: CERT
 15:42:59 ipsec Certificate:
 15:42:59 ipsec   serialNr:  00:8a:7d:3e:13:d6:2f:30:ef:23:86:bd:29:07:6b:34:f8
 15:42:59 ipsec   issuer:    <C=US, O=Internet Security Research Group, CN=ISRG Root X1>
 15:42:59 ipsec   subject:   <C=US, O=Let's Encrypt, CN=R11>
 15:42:59 ipsec   notBefore: Wed Mar 13 00:00:00 2024
 15:42:59 ipsec   notAfter:  Fri Mar 12 23:59:59 2027
 15:42:59 ipsec   selfSigned:0
 15:42:59 ipsec   extensions:
 15:42:59 ipsec     key usage: digital-signature, key-cert-sign, crl-sign
 15:42:59 ipsec     extended key usage: tls-server, tls-client
 15:42:59 ipsec     basic constraints: isCa: TRUE
 15:42:59 ipsec     subject key id:  c5:cf:46:a4:ea:f4:c3:c0:7a:6c:95:c4:2d:b0:5e:92:2f:26:e3:b9
 15:42:59 ipsec     authority key id:79:b4:59:e6:7b:b6:e5:e4:01:73:80:08:88:c8:1a:58:f6:e9:9b:6e
 15:42:59 ipsec     CRL distribution points: 
 15:42:59 ipsec        URI: http://x1.c.lencr.org/
 15:42:59 ipsec   signed with: SHA256+RSA
 15:42:59 ipsec [RSA-PUBLIC]
 15:42:59 ipsec modulus: ba87bc5c1b0039cbca0acdd46710f9013ca54ea561cb26ca52fb1501b7b928f5281eed27b324183967090c08ece03ab03b770ebdf3e53954410c4eae41d69974de51dbef7bff58bda8b713f6de31d5f272c9726a0b8374959c4600641499f3b1d922d9cda892aa1c267a3ffeef58057b089581db710f8efbe33109bb09be504d5f8f91763d5a9d9e83f2e9c466b3e106664348188065a037189a9b843297b1b2bdc4f815009d2788fbe26317966c9b27674bc4db285e69c279f0495ce02450e1c4bca105ac7b406d00b4c2413fa758b82fc55c9ba5bb099ef1feebb08539fda80aef45c478eb652ac2cf5f3cdee35c4d1bf70b272baa0b4277534f796a1d87d9
 15:42:59 ipsec publicExponent: 10001
 15:42:59 ipsec adding payload: CERT
 15:42:59 ipsec Certificate:
 15:42:59 ipsec   serialNr:  4b:a8:52:93:f7:9a:2f:a2:73:06:4b:a8:04:8d:75:d0
 15:42:59 ipsec   issuer:    <C=US, O=Internet Security Research Group, CN=ISRG Root X1>
 15:42:59 ipsec   subject:   <C=US, O=Let's Encrypt, CN=R10>
 15:42:59 ipsec   notBefore: Wed Mar 13 00:00:00 2024
 15:42:59 ipsec   notAfter:  Fri Mar 12 23:59:59 2027
 15:42:59 ipsec   selfSigned:0
 15:42:59 ipsec   extensions:
 15:42:59 ipsec     key usage: digital-signature, key-cert-sign, crl-sign
 15:42:59 ipsec     extended key usage: tls-server, tls-client
 15:42:59 ipsec     basic constraints: isCa: TRUE
 15:42:59 ipsec     subject key id:  bb:bc:c3:47:a5:e4:bc:a9:c6:c3:a4:72:0c:10:8d:a2:35:e1:c8:e8
 15:42:59 ipsec     authority key id:79:b4:59:e6:7b:b6:e5:e4:01:73:80:08:88:c8:1a:58:f6:e9:9b:6e
 15:42:59 ipsec     CRL distribution points: 
 15:42:59 ipsec        URI: http://x1.c.lencr.org/
 15:42:59 ipsec   signed with: SHA256+RSA
 15:42:59 ipsec [RSA-PUBLIC]
 15:42:59 ipsec modulus: cf57e5e6c45412edb447fec92758764650288c1d3e88df059dd5b51829bdddb55abffaf6cea3beaf00214b625a5a3c012fc55803f689ff8e1143ebc1b5e01407968f6f1fd7e7ba8139097565b7c2af185b372628e7a3f4072b6d1affab58bc95ae40ffe9cb57c4b55b7f780d1861bc17e754c6bb4991cd6e18d18085eea66536bc74eabc504ceafc21f338169394bab0d36b3806cd16127aca5275c8ad76b2c29c5d98455c6f617bc62dee3c13528601d957e6381cdf8db51f92919ae74a1ccc45a87255f0b0e6a307ecfda71b669e3f488b71847158c93afaef5ef25b442b3c74e78fb247c1076acd9ab70d96f712812651540aec61f6f7f5e2f28ac8950d8d
 15:42:59 ipsec publicExponent: 10001
 15:42:59 ipsec adding payload: CERT
 15:42:59 ipsec adding payload: EAP
 15:42:59 ipsec <- ike2 reply, exchange: AUTH:1 37.31.152.56[31253] b94dbf8c75a52911:7eb7b4d5ce3648ea
 15:43:00 ipsec fragmenting into 5 chunks
 15:43:00 ipsec adding payload: SKF
 15:43:00 ipsec adding payload: SKF
 15:43:00 ipsec adding payload: SKF
 15:43:00 ipsec adding payload: SKF
 15:43:00 ipsec adding payload: SKF
 15:43:00 ipsec -> ike2 request, exchange: AUTH:2 37.31.152.56[31253] b94dbf8c75a52911:7eb7b4d5ce3648ea
 15:43:00 ipsec payload seen: ENC
 15:43:00 ipsec processing payload: ENC
 15:43:00 ipsec payload seen: EAP
 15:43:00 ipsec processing payloads: NOTIFY (none found)
 15:43:00 ipsec processing payload: EAP
 15:43:00 ipsec update peer's identity from EAP: filip -> filip
 15:43:01 ipsec,error radius timeout
 15:43:01 ipsec reply notify: AUTHENTICATION_FAILED
 15:43:01 ipsec adding notify: AUTHENTICATION_FAILED
 15:43:01 ipsec <- ike2 reply, exchange: AUTH:2 37.31.152.56[31253] b94dbf8c75a52911:7eb7b4d5ce3648ea
 15:43:01 ipsec,info killing ike2 SA: ikev2-peer 213.158.208.73[4500]-37.31.152.56[31253] spi:7eb7b4d5ce3648ea:b94dbf8c75a52911
 15:43:01 ipsec KA remove: 213.158.208.73[4500]->37.31.152.56[31253]
9

I’m not sure any more that your issue has anything to do with certificates, because the initator has initiated the EAP exchange, which I think should not happen if it did not like your certificate. The establishment of Phase 1 fails because your Radius server does not respond:

15:43:00 ipsec processing payload: EAP
15:43:00 ipsec update peer’s identity from EAP: filip → filip
15:43:01 ipsec,error radius timeout
15:43:01 ipsec reply notify: AUTHENTICATION_FAILED
15:43:01 ipsec adding notify: AUTHENTICATION_FAILED

Even if there actually still is an issue with the certificate chain, you cannot get past the EAP phase until you fix the RADIUS connection.

10

Okay. While updating certificates I must have messed something with firewall rule. Now it works fine. Thank you.