Hi strongSwan users and developers, the following issue was reported to us. When we try to reproduce under debug-friendly conditions (own lab), the unexpected message exchange does not occur!
Situation: "left" is configured as end node and has 2 IPv4 addresses: L1 and L2 (plain interface address and alias) "right" has 1 address and is configured as gateway. Both nodes are running strongSwan v4.4.1. IKEv2 tunnels are defined as follows, I hope that I don't leave out too much important information: conn l1r leftsubnet=L1/32 rightsubnet=R/23 left=L1 right=R conn l2r leftsubnet=L2/32 rightsubnet=R/23 left=L2 right=R left has "auto=start" and right has "auto=add". Tunnel establishment sequence seems to work nicely in the beginning after both nodes are started: 1. L1 -> R IKE_SA_INIT 2. L2 -> R IKE_SA_INIT 3. R -> L2 IKE_SA_INIT 4. R -> L1 IKE_SA_INIT 5. L2 -> R IKE_AUTH 6. L1 -> R IKE_AUTH 7. R -> L2 IKE_AUTH 8. R -> L1 IKE_AUTH But ... immediately after both configured tunnels are established, left starts DELETE exchange for the second connection, followed by a re-establishment of the same (within milliseconds). No particular reason for the deletion is found in the logs that are available. 9. L2 -> R INFORMATIONAL (Delete request for IKE SA l2r) 10. R -> L2 INFORMATIONAL (Delete response) 11. L2 -> R IKE_SA_INIT 12. L2 -> R IKE_SA_INIT 13. R -> L2 IKE_SA_INIT 14. R -> L2 IKE_SA_INIT 15. R -> L2 IKE_AUTH 16. L2 -> R IKE_AUTH 17. L2 -> R IKE_AUTH 18. R -> L2 IKE_AUTH After that both tunnels are stable. Could anybody explain why the Delete exchange is started by charon? Is it because "left" assumes (wrongly or not) that it has a duplicate IKE SA (why?) Any idea is welcome. Regards, Roman (NSN - DE/Duesseldorf) P.S.: This may be related to one issue that was reported recently on this list: Why does charon delete all IKE_SA? (https://lists.strongswan.org/pipermail/users/2010-September/005252.html) _______________________________________________ Users mailing list [email protected] https://lists.strongswan.org/mailman/listinfo/users
