IPsec VPN tunnel between GCP and RUT955

[intars]

Hi,
I’m trying to setup on RUT955 Ipsec/IKE1 VPN but GCP can’t make connection. In the GCP log are such records:

creating acquire job for policy with reqid {1}
initiating Main Mode IKE_SA vpn_x.x.x.x[285] to y.y.y.y
generating ID_PROT request 0 [ SA V V V V V ]
sending packet: from x.x.x.x[500] to y.y.y.y[500] (180 bytes)
received packet: from y.y.y.y[500] to x.x.x.x[500] (160 bytes)
parsed ID_PROT response 0 [ SA V V V V ]
received XAuth vendor ID
received DPD vendor ID
received FRAGMENTATION vendor ID
received NAT-T (RFC 3947) vendor ID
selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from x.x.x.x[500] to y.y.y.y[500] (244 bytes)
received packet: from y.y.y.y[500] to x.x.x.x[500] (244 bytes)
parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
generating ID_PROT request 0 [ ID HASH ]
sending packet: from x.x.x.x[500] to y.y.y.y[500] (76 bytes)
received packet: from y.y.y.y[500] to x.x.x.x[500] (92 bytes)
parsed INFORMATIONAL_V1 request 4123347764 [ HASH N(AUTH_FAILED) ]
received AUTHENTICATION_FAILED error notify
received proposals: IKE:
configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
VPN Gateway Cipher Suite IKE Version 1 Phase 1 Encryption Algorithms: Phase 1 Integrity Algorithms: None Phase 1 Pseudo Random Functions: Phase 1 Diffie Hellman Groups: Phase 2 Encryption Algorithms: Phase 2 Integrity Algorithms: None Phase 2 PFS Algorithms: Phase 2 Diffie Hellman Groups:
No proposal was selected.

And on RUT955 side:

daemon.info ipsec: 08[IKE] no peer config found
daemon.info ipsec: 08[ENC] generating INFORMATIONAL_V1 request 806038484 [ HASH N(AUTH_FAILED) ]

RUT955 configuration:

[Daumantas]

Hello,

The issue seems to an issue in authentication phase. I noticed your local and remote identifiers are specified as FQDN. Are you sure this is correct?
FQDN (fully qualified domain name) usually looks like somehost.example.com. An alternative could be to use to use an IP address. The most important key is that both sides must match on both sides. Let’s say you are using somehost.example.com as a local identifier. Then somehost.example.com should also be used as remote identifier in GCP.
Alternatively, %any can be used to accept any identifier. This can be used in both - remote and local identifier fields.

Best regards,