00:25:13 05 (child_alert) ALERT: the received traffic selectors did not match: 172.16.19.0/24 = 10.0.1.0/24 failed to establish CHILD_SA, keeping IKE_SA 00:25:13 05 parsed CREATE_CHILD_SA request 2 Verify the network objects on either end match exactly down to the correct subnets and even individual addresses. This issue may occur if the networks being negotiated on either end of the tunnels don’t match on both ends.

Problem #1 - Incorrect traffic selectors (SA) Verify networks being presented by both local and remote ends match You could filter logs with the tunnel name if there are multiple IPsec tunnels.

The grep command applies a search filter for the keyword within the logs.

You can also match keywords within the logs by entering /

The less command allows you to parse through the static log files.

To check the live logs run the following command from Advanced Shell: tail -f /log/strongswan.log.

Note: Run the same command to remove the service from the debug.

SFVUNL_AI01_SFOS 19.0.1 MR-1-Build365# service -S | grep strongswan.

Run the following command to check the status of the service : service -S | grep strongswan.

SFVUNL_AI01_SFOS 19.0.1 MR-1-Build365# service strongswan:debug -ds nosync.

To put the strongswan service in debugging, type the following command: service strongswan:debug -ds nosync.

To connect using SSH, you may use any SSH client to connect to port 22 of the SFOS device.

SSH into the XG firewall by following this KBA: Sophos Firewall: SSH to the firewall using PuTTY utility.

Steps to put the strongswan service in debug:.

We’ll put strongswan service in debugging while we troubleshoot IPsec VPN issues. Strongswan is the service used by Sophos XG to provide IPSec functionality.

Check out the following KBA for a more detailed explanation on troubleshooting other IPsec problems.

Verify the Preshared Key on both firewalls to resolve this issue.

Problem #5 Invalid HASH_V1 payload length, decryption failed? & Parsed IKE_AUTH response1.

Sophos XG Firewall: Troubleshooting steps when traffic is not passing through the VPN tunnel.

Problem #4 - Traffic does not pass through the IPsec VPN Tunnel.

This issue may occur if there’s a mismatched local and remote connection ID configured

Check the configured remote and local connection ID.

Problem #3 - ALERT: peer authentication failed.

This issue may occur if the IKE version mismatch with the configured policy of the firewalls

Verify configured IKE version on policies.

Verify networks being presented by both local and remote ends match.

Problem #1 - Incorrect traffic selectors (SA).

Debug vpn checkpoint