Re: [strongSwan] problems with charon in 4.4.1

2011-05-27 Thread Andreas Schuldei
after the test setup survived the night (i dont know if there were problems during the night, but if there where, they self-healed, which is almost as good.) this morning the there were again several hosts without and SA in ESTABLISHED state (according to ipsec statusall). it centered around fion

Re: [strongSwan] problems with charon in 4.4.1

2011-05-26 Thread Andreas Schuldei
On Wed, May 25, 2011 at 8:49 AM, Andreas Schuldei wrote: > now i uploaded new logs from taylor and aldona. the two dropped their > SA sometimes after 2011-05-24T21:48:21 (that is the last good SA > negotiation i can see in the logs) and didnt manage to establish a new > one. > > could someone plea

Re: [strongSwan] problems with charon in 4.4.1

2011-05-24 Thread Andreas Schuldei
On Mon, May 23, 2011 at 11:38 PM, Andreas Steffen wrote: > Hello Andreas, > > I just analyzed the first part of the alvina.ash.spotify.net log > file and I see that of the 15 initiated IKE_SAs only 4 succeed in > the first round. Are there connection problems to the other 11 hosts, > are some of t

Re: [strongSwan] problems with charon in 4.4.1

2011-05-24 Thread Andreas Schuldei
On Tue, May 24, 2011 at 8:48 AM, Andreas Schuldei wrote: > On Mon, May 23, 2011 at 11:44 PM, Andreas Steffen > wrote: >> Hello Andreas, >> >> debugging these many connections might be easier using the >> condensed /var/log/auth.log which has the following entries: >> >> http://www.strongswan.org/

Re: [strongSwan] problems with charon in 4.4.1

2011-05-23 Thread Andreas Schuldei
On Mon, May 23, 2011 at 11:44 PM, Andreas Steffen wrote: > Hello Andreas, > > debugging these many connections might be easier using the > condensed /var/log/auth.log which has the following entries: > > http://www.strongswan.org/uml/testresults45/ikev2/dpd-restart/carol.auth.log the auth.log was

Re: [strongSwan] problems with charon in 4.4.1

2011-05-23 Thread Andreas Schuldei
ipsec was started by puppet. that means that the connections are initiated over an interval of about 30 min. when i checked later on i discovered that some hosts did not get their initial puppet trigger for some reason. our physical nets are quite good, we dont see package loss or so within our sit

Re: [strongSwan] problems with charon in 4.4.1

2011-05-23 Thread Andreas Steffen
Hello Andreas, debugging these many connections might be easier using the condensed /var/log/auth.log which has the following entries: http://www.strongswan.org/uml/testresults45/ikev2/dpd-restart/carol.auth.log Regards Andreas On 05/23/2011 08:14 PM, Andreas Schuldei wrote: > the charon log f

Re: [strongSwan] problems with charon in 4.4.1

2011-05-23 Thread Andreas Steffen
Hello Andreas, I just analyzed the first part of the alvina.ash.spotify.net log file and I see that of the 15 initiated IKE_SAs only 4 succeed in the first round. Are there connection problems to the other 11 hosts, are some of the peers not online yet or is the computing power of the hosts so sma

Re: [strongSwan] problems with charon in 4.4.1

2011-05-23 Thread Andreas Schuldei
the charon log files for these four hosts are available for download here: alvina.ash.spotify.net-charon.log.gz annalise.ash.spotify.net-charon.log.gz annmarie.ash.spotify.net-charon.log.gz taylor.sto.spotify.net-charon.log.gz On Mon, May 23, 2011 at 2:46 PM, Andreas Schuldei wrote: > hi! > > I

Re: [strongSwan] problems with charon in 4.4.1

2011-05-23 Thread Andreas Schuldei
the charon log files for these four hosts are available for download here: http://origin.scdn.co/u/wp/alvina.ash.spotify.net-charon.log.gz http://origin.scdn.co/u/wp/annalise.ash.spotify.net-charon.log.gz http://origin.scdn.co/u/wp/annmarie.ash.spotify.net-charon.log.gz http://origin.scdn.co/u/wp/t

[strongSwan] problems with charon in 4.4.1

2011-05-23 Thread Andreas Schuldei
hi! I seem to be experiencing problems with charon in strongswan 4.4.1. One problem is that charon sometimes failes to reinitiate SAs once they expire. I set up a testbed with 17 hosts to reproduce and track down the issue, as it takes some time for it to manifest. since every host has several c