Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When Windows 8 tries to connect to my Strongswan VPN I get the following error,

Error 13843: Invalid Payload Received.

I'm not sure how to resolve it or what causes it. My charon log has this,

15[IKE] IKE_SA roadwarrior[2] established between[DNREDACTED1]...[DNREDACTED2]
15[IKE] scheduling reauthentication in 9771s
15[IKE] maximum IKE_SA lifetime 10311s
15[IKE] sending end entity cert "REDACTED GW CERT"
15[IKE] peer requested virtual IP %any
15[IKE] no virtual IP found, sending INTERNAL_ADDRESS_FAILURE
15[IKE] configuration payload negotiation failed, no CHILD_SA built
15[NET] sending packet: from[4500] to[4500]
16[NET] received packet: from[4500] to[4500]
16[ENC] parsed INFORMATIONAL request 2 [ D ]
16[IKE] received DELETE for IKE_SA roadwarrior[2]
16[IKE] deleting IKE_SA roadwarrior[2] between[DNREDACTED1]...[DNREDACTED2]
16[IKE] IKE_SA deleted
16[ENC] generating INFORMATIONAL response 2 [ ]
16[NET] sending packet: from[4500] to[4500]


conn %default                                                                                                                                                                                                                                

conn roadwarrior                                                                                                                                                                                                                             


charon {                                                                                                                                                                                                                                     
  threads = 16;                                                                                                                                                                                                                              

    # Two defined file loggers. Each subsection is either a file                                                                                                                                                                             
    # in the filesystem or one of: stdout, stderr.                                                                                                                                                                                           
    filelog {                                                                                                                                                                                                                                
        /var/log/charon.log {                                                                                                                                                                                                                
            # add a timestamp prefix                                                                                                                                                                                                         
            time_format = %b %e %T                                                                                                                                                                                                           
            # loggers to files also accept the append option to open files in                                                                                                                                                                
            # append mode at startup (default is yes)                                                                                                                                                                                        
            append = no                                                                                                                                                                                                                      
            # the default loglevel for all daemon subsystems (defaults to 1).                                                                                                                                                                
            default = 1                                                                                                                                                                                                                      
            # flush each line to disk                                                                                                                                                                                                        
            flush_line = yes                                                                                                                                                                                                                 
        stderr {                                                                                                                                                                                                                             
            # more detailed loglevel for a specific subsystem, overriding the                                                                                                                                                                
            # default loglevel.                                                                                                                                                                                                              
            ike = 2                                                                                                                                                                                                                          
            knl = 3                                                                                                                                                                                                                          
            # prepend connection name, simplifies grepping                                                                                                                                                                                   
            ike_name = yes                                                                                                                                                                                                                   
    # And two loggers using syslog. The subsections define the facility to log                                                                                                                                                               
    # to, currently one of: daemon, auth.                                                                                                                                                                                                    
    syslog {                                                                                                                                                                                                                                 
        # optional identifier used with openlog(3), prepended to each log message                                                                                                                                                            
        # by syslog. if not configured, openlog(3) is not called, so the value will                                                                                                                                                          
        # depend on system defaults (usually the program name)                                                                                                                                                                               
        identifier = charon-custom                                                                                                                                                                                                           
        # default level to the LOG_DAEMON facility                                                                                                                                                                                           
        daemon {                                                                                                                                                                                                                             
        # very minimalistic IKE auditing logs to LOG_AUTHPRIV                                                                                                                                                                                
        auth {                                                                                                                                                                                                                               
            default = -1                                                                                                                                                                                                                     
            ike = 0                                                                                                                                                                                                                          


share|improve this question
What are your strongswan and windows IPSec configs? – EEAA Aug 5 '13 at 3:41
@EEAA updated with strongswan's ipsec.conf, windows is just using certs that I installed per, – Evan Carroll Aug 5 '13 at 3:43
@EEAA forgot about strongswan.conf pasted that too. – Evan Carroll Aug 5 '13 at 3:51

In your ipsec.conf log you have


That should be


left/rightsubnet is documented as,

left|rightsubnet = [[]][,...]

private subnet behind the left participant, expressed as network/netmask; if omitted, essentially assumed to be left/32|128, signifying that the left|right end of the connection goes to the left|right participant only. The configured subnets of the peers may differ, the protocol narrows it to the greatest common subnet. Since 5.0.0 this is also done for IKEv1, but as this may lead to problems with other implementations, make sure to configure identical subnets in such configurations. IKEv2 supports multiple subnets separated by commas, IKEv1 only interprets the first subnet of such a definition, unless the Cisco Unity extension plugin is enabled (available since 5.0.1).

Since 5.1.0 the optional part after each subnet enclosed in square brackets specifies a protocol/port to restrict the selector for that subnet. Examples: leftsubnet=[tcp/http],[6/80] or leftsubnet=fec1::1[udp],[/53]. Instead of omitting either value %any can be used to the same effect, e.g. leftsubnet=fec1::1[udp/%any],[%any/53]

The port value can alternatively take the value %opaque for RFC 4301 OPAQUE selectors, or a numerical range in the form 1024-65535. None of the kernel backends currently supports opaque or port ranges and uses %any for policy installation instead.

Instead of specifying a subnet, %dynamic can be used to replace it with the IKE address, having the same effect as omitting left|rightsubnet completely. Using %dynamic can be used to define multiple dynamic selectors, each having a potentially different protocol/port definition.

Whereas rightsourceip is documented as,

rightsourceip = %config | / | %poolname

The internal source IP to use in a tunnel for the remote peer. If the value is config on the responder side, the initiator must propose an address which is then echoed back. Also supported are address pools expressed as / or the use of an external IP address pool using %poolname where poolname is the name of the IP address pool used for the lookup (see virtual IP for details). Since 5.0.1 a comma-separated list of IP addresses / pools is accepted, for instance, to define pools of different address families.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.