Skip to main content
selassi
selassi
New Member
July 19, 2018
Question

No matching IPsec selector, drop

  • July 19, 2018
  • 1 reply
  • 8579 views

good day all.

 

i am stuck with this error message on my IPsec tunnel and do not know how to proceed. can anyone assist me please.

 

id=20085 trace_id=342 func=print_pkt_detail line=5319 msg="vd-DPRVR01OUTR received a packet(proto =1, 10.20.192.8:44384->172.16.200.75:2048) from local. type=8, code=0, id=44384, seq=2." id=20085 trace_id=342 func=resolve_ip_tuple_fast line=5394 msg="Find an existing session, id-01fe 94f9, original direction" id=20085 trace_id=342 func=ipsecdev_hard_start_xmit line=178 msg="enter IPsec interface-VPN_SBSA- RASG" id=20085 trace_id=342 func=ipsec_common_output4 line=816 msg="No matching IPsec selector, drop"

 

how do i create a matching IPsec selector

 

regards

 

Troubled soul

    1 reply

    emnoc
    emnoc
    New Member
    July 19, 2018

    Check the local/remote subnets  between the two vpn gateways. They need to match 

     

     

    example IPSEC S2S  siteA to siteB 

     

     

    siteA

     

     

     

     set src-subnet 10.1.1.0/24

     set dst-subnet 10.1.2.0/24

     

     

    siteB:

     

      set dst-subnet 10.1.1.0/24

      set src-subnet 10.1.2.0/24

     

     

    You probably have the TS wrong in the phase2- settings

     

    ken

     

     

     

     

    selassi
    selassiAuthor
    New Member
    July 23, 2018

    Thank you for your response. 

     

    i realised like what you said in your response that there are inconsistent gateway ips. however when i change my IP to the corressponding gateway my partner is using, my tunnel goes down and it will not come up. however when i run the diag debug the error message for no matching IP selectors stops. how can i troubleshoot the tunnel itself?

    Terms & ConditionsAccessibility statement