IBM Cloud: VPC-Gen2とVMware NSX-TをIPsec VPNで接続してみる

#1. はじめに
IBM CloudのVPC-Gen2にはVPNaaSが存在する。このVPNaaSとVMWare NSX-T 2.5間でIPsec VPNを張れることを確認した。
加えて、IPsec VPNを張る際には失敗することもあるため、成功時のログと比較したいことが多い。今回はActivity Tracker with LogDNAでの出力結果も確認してみた。


#2. IBM Cloud側の設定

##IKEポリシー
DH Group=14でもOKだった。
<img width="960" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/e44e09c3-5fa3-1014-7c95-c35a8c32ad1d.png">

##IPsecポリシー
PFS=EnabledでもOKだった。
<img width="960" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/0b22b706-dea6-720c-03df-c2bc34e80e47.png">

##VPN Connection設定
対抗アドレス、local subnets/remote subnets、IKEポリシー/IPsecポリシー/DPDの指定など。
NSX-TではDPD actionは`Restart`が自動構成されるためその設定に揃える。
<img width="960" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/6e18aa67-c207-da78-53a0-3621acd37c1e.png">


##Status確認
設定変更をした後は、下記のStateをdisalbed/enabledする方が安全かもしれない。
<img width="960" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/a3f6fcb1-e2a8-4ad4-32da-a74a060972f7.png">





#3. NSX-T側の設定

## VPN Service
ガワを作ってT0 Gatewayを指定しただけ。
<img width="960" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/9c0508bf-486b-2068-16e9-9a68276f10d4.png">


## Local Endpoints
<img width="960" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/8e0a0974-4a4e-82af-a0d3-fdd13649c480.png">


##IKE Profile
<img width="960" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/e5b9a5aa-9030-d060-fc82-bb6330e49035.png">

##IPsec Profile
<img width="960" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/54f70bdb-dd10-1f8d-1c1f-e6853df8373c.png">

## DPD Profile
<img width="960" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/1ada61d9-4c1b-2bf0-012a-0d00269d5c7f.png">

NSX-TではDPD actionは`Restart`が自動構成される。
[参考](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.0/migration/GUID-2A39C982-5BCC-400F-8761-F133F994A2C6.html)

> In NSX-T, dpdaction is set to “restart” and cannot be changed.

## IPsec Session
各種Profileの指定、対抗アドレス(Remote IP)、local subnets/remote subnetsの指定など
<img width="960" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/1665e40d-2286-1470-c2f6-ac589bf8a301.png">

##Status確認
<img width="1279" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/c6177d76-1966-0f3c-5d93-d4a57a05ddcf.png">

##Firewall構成
本来はFirewallは事前に構成しておくべきなのだが、VPN Sessionを作成すると自動的にシステムがポートを開いてくれる構成になっているようだ。よって、NSX-TでのFirewall構成は特に変更していない。
<img width="1279" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/aa91e2db-ed09-1736-e135-8877000029aa.png">



#4. Activity Tracker with LogDNAによるログの確認

Activity Tracker with LogDNAでログの確認ができる。
https://cloud.ibm.com/docs/vpc?topic=vpc-using-logdna-to-view-vpn-logs

しかし、コンソールでログを追いかけるのは大変なので以下の手順に従ってログをexportして、手元で確認する。
https://cloud.ibm.com/docs/Log-Analysis-with-LogDNA?topic=Log-Analysis-with-LogDNA-export

- ViewでEVERYTHINGを選択し、事前に該当のVPNサービスをフィルタリングしておく。
- Export Linesを選択<br><img width="1280" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/4631fabd-4aaa-60a9-5a60-59ff0cd2bf4d.png">
- 範囲選択<br><img width="456" alt="image.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/62127/b30fa822-779b-b9b9-e3cb-ac69e91529fa.png">

なお、exportされたログはgz形式で圧縮されている。解凍したログもjson形式のため、jqコマンドで必要な箇所のみ抽出する。
$ cat export_2020-08-12-01-54-23-982_705cf228-4b0d-4de2-87eb-37e6a85e4b07.jsonl | jq '.message' > vpn.log


```vpn.log（128.168.xx.xxおよび161.202.xx.xxのようにIPアドレスは隠蔽して表示しています）
"UTC 2020-08-11 14:00:46 03[NET] sending packet: from 10.1.0.4[500] to 161.202.xx.xx[500]"
"UTC 2020-08-11 14:00:47 00[DMN] signal of type SIGINT received. Shutting down"
"UTC 2020-08-11 14:00:47 00[DMN] Starting IKE charon daemon (strongSwan 5.8.1, Linux 4.15.0-106-generic, x86_64)"
"UTC 2020-08-11 14:00:47 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'"
"UTC 2020-08-11 14:00:47 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'"
"UTC 2020-08-11 14:00:47 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'"
"UTC 2020-08-11 14:00:47 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'"
"UTC 2020-08-11 14:00:47 00[CFG] loading crls from '/etc/ipsec.d/crls'"
"UTC 2020-08-11 14:00:47 00[CFG] loading secrets from '/etc/ipsec.secrets'"
"UTC 2020-08-11 14:00:47 00[CFG]   loaded IKE secret for 128.168.xx.xx 161.202.xx.xx"
"UTC 2020-08-11 14:00:47 00[LIB] loaded plugins: charon aes des rc2 sha2 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem fips-prf gmp curve25519 xcbc cmac hmac attr kernel-netlink resolve socket-default stroke vici updown xauth-generic counters"
"UTC 2020-08-11 14:00:47 00[LIB] dropped capabilities, running as uid 0, gid 0"
"UTC 2020-08-11 14:00:47 00[JOB] spawning 16 worker threads"
"UTC 2020-08-11 14:00:47 03[NET] waiting for data on sockets"
"UTC 2020-08-11 14:00:47 04[CFG] received stroke: add connection 'peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960'"
"UTC 2020-08-11 14:00:47 04[CFG] conn peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960"
"UTC 2020-08-11 14:00:47 04[CFG]   left=%any"
"UTC 2020-08-11 14:00:47 04[CFG]   leftsubnet=10.0.0.0/24"
"UTC 2020-08-11 14:00:47 04[CFG]   leftauth=psk"
"UTC 2020-08-11 14:00:47 04[CFG]   leftid=128.168.xx.xx"
"UTC 2020-08-11 14:00:47 04[CFG]   right=161.202.xx.xx"
"UTC 2020-08-11 14:00:47 04[CFG]   rightsubnet=192.168.0.0/24"
"UTC 2020-08-11 14:00:47 04[CFG]   rightauth=psk"
"UTC 2020-08-11 14:00:47 04[CFG]   rightid=161.202.xx.xx"
"UTC 2020-08-11 14:00:47 04[CFG]   ike=aes256-sha256-modp2048!"
"UTC 2020-08-11 14:00:47 04[CFG]   esp=aes256-sha256-modp2048!"
"UTC 2020-08-11 14:00:47 04[CFG]   dpddelay=60"
"UTC 2020-08-11 14:00:47 04[CFG]   dpdtimeout=120"
"UTC 2020-08-11 14:00:47 04[CFG]   dpdaction=3"
"UTC 2020-08-11 14:00:47 04[CFG]   sha256_96=no"
"UTC 2020-08-11 14:00:47 04[CFG]   mediation=no"
"UTC 2020-08-11 14:00:47 04[CFG]   keyexchange=ikev2"
"UTC 2020-08-11 14:00:47 04[CFG] added configuration 'peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960'"
"UTC 2020-08-11 14:00:47 06[CFG] received stroke: initiate 'peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960'"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> queueing IKE_VENDOR task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> queueing IKE_INIT task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> queueing IKE_NATD task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> queueing IKE_CERT_PRE task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> queueing IKE_AUTH task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> queueing IKE_CERT_POST task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> queueing IKE_CONFIG task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> queueing IKE_AUTH_LIFETIME task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> queueing CHILD_CREATE task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> activating new tasks"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   activating IKE_VENDOR task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   activating IKE_INIT task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   activating IKE_NATD task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   activating IKE_CERT_PRE task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   activating IKE_AUTH task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   activating IKE_CERT_POST task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   activating IKE_CONFIG task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   activating CHILD_CREATE task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   activating IKE_AUTH_LIFETIME task"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> initiating IKE_SA peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960[1] to 161.202.xx.xx"
"UTC 2020-08-11 14:00:47 06[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> IKE_SA peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960[1] state change: CREATED => CONNECTING"
"UTC 2020-08-11 14:00:47 06[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048"
"UTC 2020-08-11 14:00:47 06[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending supported signature hash algorithms: sha256 sha384 sha512 identity"
"UTC 2020-08-11 14:00:47 06[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]"
"UTC 2020-08-11 14:00:47 06[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending packet: from 10.1.0.4[500] to 161.202.xx.xx[500] (464 bytes)"
"UTC 2020-08-11 14:00:47 13[NET] sending packet: from 10.1.0.4[500] to 161.202.xx.xx[500]"
"UTC 2020-08-11 14:00:47 03[NET] received packet: from 161.202.xx.xx[500] to 10.1.0.4[500]"
"UTC 2020-08-11 14:00:47 03[NET] waiting for data on sockets"
"UTC 2020-08-11 14:00:47 08[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received packet: from 161.202.xx.xx[500] to 10.1.0.4[500] (468 bytes)"
"UTC 2020-08-11 14:00:47 08[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HTTP_CERT_LOOK) N(FRAG_SUP) V ]"
"UTC 2020-08-11 14:00:47 08[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received unknown vendor ID: 4f:85:58:17:1d:21:a0:8d:69:cb:5f:60:9b:3c:06:00"
"UTC 2020-08-11 14:00:47 08[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received HTTP_CERT_LOOKUP_SUPPORTED notify"
"UTC 2020-08-11 14:00:47 08[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received FRAGMENTATION_SUPPORTED notify"
"UTC 2020-08-11 14:00:47 08[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> selecting proposal:"
"UTC 2020-08-11 14:00:47 08[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   proposal matches"
"UTC 2020-08-11 14:00:47 08[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048"
"UTC 2020-08-11 14:00:47 08[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048"
"UTC 2020-08-11 14:00:47 08[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048"
"UTC 2020-08-11 14:00:47 08[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> local host is behind NAT, sending keep alives"
"UTC 2020-08-11 14:00:47 08[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> reinitiating already active tasks"
"UTC 2020-08-11 14:00:47 08[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   IKE_CERT_PRE task"
"UTC 2020-08-11 14:00:47 08[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   IKE_AUTH task"
"UTC 2020-08-11 14:00:47 08[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> authentication of '128.168.xx.xx' (myself) with pre-shared key"
"UTC 2020-08-11 14:00:47 08[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> successfully created shared key MAC"
"UTC 2020-08-11 14:00:47 08[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> proposing traffic selectors for us:"
"UTC 2020-08-11 14:00:47 08[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>  10.0.0.0/24"
"UTC 2020-08-11 14:00:47 08[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> proposing traffic selectors for other:"
"UTC 2020-08-11 14:00:47 08[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>  192.168.0.0/24"
"UTC 2020-08-11 14:00:47 08[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> configured proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ"
"UTC 2020-08-11 14:00:47 08[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> establishing CHILD_SA peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960{1}"
"UTC 2020-08-11 14:00:47 08[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]"
"UTC 2020-08-11 14:00:47 08[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500] (256 bytes)"
"UTC 2020-08-11 14:00:47 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:00:47 03[NET] received packet: from 161.202.xx.xx[4500] to 10.1.0.4[4500]"
"UTC 2020-08-11 14:00:47 03[NET] waiting for data on sockets"
"UTC 2020-08-11 14:00:47 09[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received packet: from 161.202.xx.xx[4500] to 10.1.0.4[4500] (224 bytes)"
"UTC 2020-08-11 14:00:47 09[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> parsed IKE_AUTH response 1 [ IDr AUTH SA TSi TSr N(ESP_TFC_PAD_N) ]"
"UTC 2020-08-11 14:00:47 09[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received ESP_TFC_PADDING_NOT_SUPPORTED notify"
"UTC 2020-08-11 14:00:47 09[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> authentication of '161.202.xx.xx' with pre-shared key successful"
"UTC 2020-08-11 14:00:47 09[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> IKE_SA peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960[1] established between 10.1.0.4[128.168.xx.xx]...161.202.xx.xx[161.202.xx.xx]"
"UTC 2020-08-11 14:00:47 09[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> IKE_SA peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960[1] state change: CONNECTING => ESTABLISHED"
"UTC 2020-08-11 14:00:47 09[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> scheduling reauthentication in 35055s"
"UTC 2020-08-11 14:00:47 09[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> maximum IKE_SA lifetime 35595s"
"UTC 2020-08-11 14:00:47 09[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding"
"UTC 2020-08-11 14:00:47 09[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> selecting proposal:"
"UTC 2020-08-11 14:00:47 09[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>   proposal matches"
"UTC 2020-08-11 14:00:47 09[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ"
"UTC 2020-08-11 14:00:47 09[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> configured proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ"
"UTC 2020-08-11 14:00:47 09[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ"
"UTC 2020-08-11 14:00:47 09[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> selecting traffic selectors for us:"
"UTC 2020-08-11 14:00:47 09[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>  config: 10.0.0.0/24, received: 10.0.0.0/24 => match: 10.0.0.0/24"
"UTC 2020-08-11 14:00:47 09[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> selecting traffic selectors for other:"
"UTC 2020-08-11 14:00:47 09[CFG] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1>  config: 192.168.0.0/24, received: 192.168.0.0/24 => match: 192.168.0.0/24"
"UTC 2020-08-11 14:00:47 09[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> CHILD_SA peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960{1} established with SPIs c63e56c9_i 7bbedc16_o and TS 10.0.0.0/24 === 192.168.0.0/24"
"UTC 2020-08-11 14:00:47 09[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> activating new tasks"
"UTC 2020-08-11 14:00:47 09[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> nothing to initiate"
"UTC 2020-08-11 14:01:09 16[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending keep alive to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:01:09 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:01:29 08[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending keep alive to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:01:29 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:01:47 03[NET] received packet: from 161.202.xx.xx[4500] to 10.1.0.4[4500]"
"UTC 2020-08-11 14:01:47 03[NET] waiting for data on sockets"
"UTC 2020-08-11 14:01:47 09[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received packet: from 161.202.xx.xx[4500] to 10.1.0.4[4500] (80 bytes)"
"UTC 2020-08-11 14:01:47 09[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> parsed INFORMATIONAL request 0 [ ]"
"UTC 2020-08-11 14:01:47 09[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> generating INFORMATIONAL response 0 [ ]"
"UTC 2020-08-11 14:01:47 09[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500] (80 bytes)"
"UTC 2020-08-11 14:01:47 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:02:07 05[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending keep alive to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:02:07 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:02:27 02[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending keep alive to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:02:27 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:02:47 10[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending keep alive to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:02:47 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:02:47 03[NET] received packet: from 161.202.xx.xx[4500] to 10.1.0.4[4500]"
"UTC 2020-08-11 14:02:47 03[NET] waiting for data on sockets"
"UTC 2020-08-11 14:02:47 14[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received packet: from 161.202.xx.xx[4500] to 10.1.0.4[4500] (80 bytes)"
"UTC 2020-08-11 14:02:47 14[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> parsed INFORMATIONAL request 1 [ ]"
"UTC 2020-08-11 14:02:47 14[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> generating INFORMATIONAL response 1 [ ]"
"UTC 2020-08-11 14:02:47 14[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500] (80 bytes)"
"UTC 2020-08-11 14:02:47 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:03:07 09[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending keep alive to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:03:07 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:03:27 12[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending keep alive to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:03:27 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:03:47 16[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending keep alive to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:03:47 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:03:47 03[NET] received packet: from 161.202.xx.xx[4500] to 10.1.0.4[4500]"
"UTC 2020-08-11 14:03:47 03[NET] waiting for data on sockets"
"UTC 2020-08-11 14:03:47 15[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received packet: from 161.202.xx.xx[4500] to 10.1.0.4[4500] (80 bytes)"
"UTC 2020-08-11 14:03:47 15[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> parsed INFORMATIONAL request 2 [ ]"
"UTC 2020-08-11 14:03:47 15[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> generating INFORMATIONAL response 2 [ ]"
"UTC 2020-08-11 14:03:47 15[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500] (80 bytes)"
"UTC 2020-08-11 14:03:47 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:04:07 08[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending keep alive to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:04:07 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:04:27 14[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending keep alive to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:04:27 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:04:47 03[NET] received packet: from 161.202.xx.xx[4500] to 10.1.0.4[4500]"
"UTC 2020-08-11 14:04:47 03[NET] waiting for data on sockets"
"UTC 2020-08-11 14:04:47 05[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received packet: from 161.202.xx.xx[4500] to 10.1.0.4[4500] (80 bytes)"
"UTC 2020-08-11 14:04:47 05[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> parsed INFORMATIONAL request 3 [ ]"
"UTC 2020-08-11 14:04:47 05[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> generating INFORMATIONAL response 3 [ ]"
"UTC 2020-08-11 14:04:47 05[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500] (80 bytes)"
"UTC 2020-08-11 14:04:47 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:05:07 10[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending keep alive to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:05:07 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:05:27 12[IKE] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending keep alive to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:05:27 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
"UTC 2020-08-11 14:05:47 03[NET] received packet: from 161.202.xx.xx[4500] to 10.1.0.4[4500]"
"UTC 2020-08-11 14:05:47 03[NET] waiting for data on sockets"
"UTC 2020-08-11 14:05:47 04[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> received packet: from 161.202.xx.xx[4500] to 10.1.0.4[4500] (80 bytes)"
"UTC 2020-08-11 14:05:47 04[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> parsed INFORMATIONAL request 4 [ ]"
"UTC 2020-08-11 14:05:47 04[ENC] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> generating INFORMATIONAL response 4 [ ]"
"UTC 2020-08-11 14:05:47 04[NET] <peer_161.202.xx.xx_02f7-885f1aa1-280f-4a08-9093-6e8c8b732960|1> sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500] (80 bytes)"
"UTC 2020-08-11 14:05:47 13[NET] sending packet: from 10.1.0.4[4500] to 161.202.xx.xx[4500]"
```