On Mon, Feb 11, 2019, at 8:40 PM, Kostya Vasilyev wrote:
> Hello,
>
> I've got a strange, well, not sure if it's a problem, more of a question.
>
> My setup is Mikrtoik router client <-> libreswan server on Debian, IKEv1
> with certificate auth.
>
> Usually, watching SAs in Mikrtoik web UI and "ipsec status", there is a
> tendency to have 4 or even 6 SA's and for them to rotate / expire a few
> times a day.
>
> Now since maybe two days, I only got one pair of SAs - and it continues
> to accumulate more and more traffic stats in Mikrotik UI - that's how I
> know it's the same pair.
>
> On the server side I get messages like these from time to time:
>
> Feb 11 20:10:29 pluto[4767]: "mytunnel" #300: responding to Main Mode
> Feb 11 20:10:29 pluto[4767]: "mytunnel" #300: STATE_MAIN_R1: sent MR1,
> expecting MI2
> Feb 11 20:10:30 pluto[4767]: "mytunnel" #300: STATE_MAIN_R2: sent MR2,
> expecting MI3
> Feb 11 20:10:30 pluto[4767]: "mytunnel" #300: STATE_MAIN_R2:
> retransmission; will wait 0.5 seconds for response
> Feb 11 20:10:30 pluto[4767]: "mytunnel" #300: Peer ID is ID_DER_ASN1_DN:
> 'C=RU, L=Moscow, O=NewTunnel, OU=ac2'
> Feb 11 20:10:31 pluto[4767]: "mytunnel" #300: certificate verified OK:
> OU=ac2,O=NewTunnel,L=Moscow,C=RU
> Feb 11 20:10:31 pluto[4767]: "mytunnel" #300: Authenticated using RSA
> Feb 11 20:10:31 pluto[4767]: "mytunnel" #300: I am sending my cert
> Feb 11 20:10:31 pluto[4767]: "mytunnel" #300: STATE_MAIN_R3: sent MR3,
> ISAKMP SA established {auth=RSA_SIG cipher=AES_CBC_128
> integ=HMAC_SHA2_256 group=MODP2048}
> Feb 11 20:10:31 pluto[4767]: "mytunnel" #300: retransmitting in response
> to duplicate packet; already STATE_MAIN_R3
> Feb 11 20:22:21 pluto[4767]: "mytunnel" #299: deleting state
> (STATE_MAIN_I4) and sending notification
>
>
> 000 Total IPsec connections: loaded 1, active 1
> 000
> 000 State Information: DDoS cookies not required, Accepting new IKE
> connections
> 000 IKE SAs: total(1), half-open(0), open(0), authenticated(1),
> anonymous(0)
> 000 IPsec SAs: total(1), authenticated(1), anonymous(0)
> 000
> 000 #290: "mytunnel":500 STATE_QUICK_I2 (sent QI2, IPsec SA
> established); EVENT_SA_REPLACE in 841s; newest IPSEC; eroute owner;
> isakmp#289; idle;
> 000 #290: "mytunnel" esp.a76f21d@89.0.0.1 esp.366391ef@139.0.0.1 ref=0
> refhim=0 Traffic: ESPin=544KB ESPout=23MB! ESPmax=4194303B
> 000 #300: "mytunnel":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA
> established); EVENT_SA_REPLACE in 1661s; newest ISAKMP; lastdpd=17s(seq
> in:25740 out:0); idle;
>
> Now my question:
>
> Is this, like, normal? For a single pair of SA's to be used over such
> long time (days) and not be rotated?
>
> I thought (mistakenly) that SA's get replaced and part of rekeying process?
>
> Does this perhaps just mean that my Internet connection is more stable
> than before?
And just as I sent the above, there is a new pair of SA's - and a whole new
connection (#301)?
Feb 11 20:52:20 pluto[4767]: "mytunnel" #301: initiating Quick Mode
RSASIG+ENCRYPT+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO to replace
#290 {using isakmp#300 msgid:9da23ca9
proposal=AES_CBC_128-HMAC_SHA2_256_128-MODP2048 pfsgroup=MODP2048}
Feb 11 20:52:21 pluto[4767]: "mytunnel" #301: STATE_QUICK_I2: sent QI2, IPsec
SA established transport mode {ESP=>0x0ae5a560 <0x6ad1c975
xfrm=AES_CBC_128-HMAC_SHA2_256_128 NATOA=none NATD=none DPD=active}
000 #290: "mytunnel":500 STATE_QUICK_I2 (sent QI2, IPsec SA established);
EVENT_SA_EXPIRE in 496s; isakmp#289; idle;
000 #290: "mytunnel" esp.a76f21d@89.0.0.1 esp.366391ef@139.0.0.1 ref=0 refhim=0
Traffic: ESPin=553KB ESPout=23MB! ESPmax=4194303B
000 #300: "mytunnel":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established);
EVENT_SA_REPLACE in 708s; newest ISAKMP; lastdpd=10s(seq in:25763 out:0); idle;
000 #301: "mytunnel":500 STATE_QUICK_I2 (sent QI2, IPsec SA established);
EVENT_SA_REPLACE in 28023s; newest IPSEC; eroute owner; isakmp#300; idle;
000 #301: "mytunnel" esp.ae5a560@89.0.0.1 esp.6ad1c975@139.0.0.1 ref=0 refhim=0
Traffic: ESPin=0B ESPout=0B! ESPmax=4194303B
I know the old pair of SA's will expire in a while - and that traffic is using
the new pair already.
But I'm still curious - what is going on?
Why are SA's replaced sometimes fast, sometimes slow?
Is there an connectivity issue between the client and the server?
Maybe they (client / server) can't agree on some sort of refresh interval?
Something else?
-- K
_______________________________________________
Swan mailing list
Swan@lists.libreswan.org
https://lists.libreswan.org/mailman/listinfo/swan
