<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Can someone please reply to this? Here are the questions:</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<blockquote type="cite" class="">
<div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div class="">1. How to prevent Charon from removing the name server configuration from /etc/resolv.conf in the IKA_SA re-authentication case?</div>
<div class=""><br class="">
</div>
<div class="">2. Why does the up/down script get invoked during IKE_SA re-authentication? When “make before break” is enabled, the up/down script invocation seems backward/awkward. That is, up/down is invoked with an ‘up’ notification at the initial establishment
of the tunnel, then again with a second ‘up’ notification during the “make before break”, then finally with a ‘down’ notification even though the tunnel is up?!?</div>
<div class=""><br class="">
</div>
<div class="">VPN up/down notifications from Initiator’s /var/log/messages:</div>
<div class=""><br class="">
</div>
<div class="">
<div class="" style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);">
Nov 11 17:24:54 initiator vpn: + <a href="http://responder.domain.com/" class="">responder.domain.com</a> 10.8.192.0/19 == re.sp.on.der -- 10.0.1.36 == 10.255.252.2/32</div>
<div class="" style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);">
Nov 11 20:02:52 initiator vpn: + <a href="http://responder.domain.com/" class="">responder.domain.com</a> 10.8.192.0/19 == re.sp.on.der -- 10.0.1.36 == 10.255.252.2/32</div>
<div class="" style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);">
Nov 11 20:02:52 initiator vpn: - <a href="http://responder.domain.com/" class="">responder.domain.com</a> 10.8.192.0/19 == re.sp.on.der -- 10.0.1.36 == 10.255.252.2/32</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">3. Aside: why does /usr/libexec/strongswan/_updown fail to find iptables?</div>
</div>
</blockquote>
</div>
<div class="">
<div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div class=""><br class="">
</div>
</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Nov 12, 2015, at 10:53 AM, Ken Nelson <<a href="mailto:ken@cazena.com" class="">ken@cazena.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class=""><br class="">
</div>
<div class="">Configuration</div>
<div class="">
<ul class="">
<li class="">StrongSwan version 5.3.0 on Centos 6.6 for both Initiator & Responder.</li><li class="">In /etc/strongswan/strongswan.d/charon.conf, set “make_before_break = yes” on both Initiator and Responder (responder also has cisco_unity = yes, but that should not be relevant).</li><li class="">In /etc/strongswan/strongswan.d/charon/resolv.conf, set “file = /etc/resolv.conf” on Initiator only.</li><li class="">Using the default up/down script, /usr/libexec/strongswan/_updown</li></ul>
<div class=""><br class="">
</div>
</div>
<div class="">Problem</div>
<div class=""><br class="">
</div>
<div class="">Initiator establishes an IKEv2 tunnel with the Responder which operates correctly until the first “reauthenticating IKE_SA” event occurs, i.e. IKE lifetime expires. Using the default value for ikelifetime so this occurs 2.5 - 3 hours after initial
tunnel establishment. After re-authentication completes, the tunnel continues to work correctly except that DNS is now incorrectly configured on the Initiator, causing DNS name resolution failure.</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Details</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">/etc/resolv.conf on the Initiator after the tunnel is established, 10.8.194.96 is the correct DNS nameserver. Note there’s a minor configuration bug on the Responder in that it sends the nameserver configuration twice, this does not seem to cause
any operational problems.</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
[myaccount@initiator ~]$ cat /etc/resolv.conf</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
search domain.internal # by edm-start-ipsec on Thu Nov 12 11:35:41 EST 2015</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
nameserver 10.8.194.96 # by strongSwan, from <a href="http://responder.domain.com/" class="">
responder.domain.com</a></div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
nameserver 10.8.194.96 # by strongSwan, from <a href="http://responder.domain.com/" class="">
responder.domain.com</a></div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
; generated by /sbin/dhclient-script</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
nameserver 10.0.1.1</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">/var/log/messages on the Initiator during IKA_SA re-authentication (timezone is EST):</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 07[IKE] reauthenticating IKE_SA dm-psk[1]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 07[IKE] installing new virtual IP 10.255.252.2</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 07[IKE] initiating IKE_SA dm-psk[2] to re.sp.on.der</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 07[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 07[NET] sending packet: from 10.0.1.36[4500] to re.sp.on.der[4500] (1436 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 04[NET] received packet: from re.sp.on.der[4500] to 10.0.1.36[4500] (456 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 04[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) N(MULT_AUTH) ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 04[IKE] local host is behind NAT, sending keep alives</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 04[IKE] remote host is behind NAT</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 04[IKE] authentication of 'my-user' (myself) with pre-shared key</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 04[IKE] establishing CHILD_SA dm-psk</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 04[ENC] generating IKE_AUTH request 1 [ IDi IDr AUTH CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(AUTH_FOLLOWS) ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 04[NET] sending packet: from 10.0.1.36[4500] to re.sp.on.der[4500] (428 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 06[NET] received packet: from re.sp.on.der[4500] to 10.0.1.36[4500] (124 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 06[ENC] parsed IKE_AUTH response 1 [ IDr AUTH ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 06[IKE] authentication of '<a href="http://responder.domain.com/" class="">responder.domain.com</a>' with pre-shared key successful</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 06[ENC] generating IKE_AUTH request 2 [ IDi ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 06[NET] sending packet: from 10.0.1.36[4500] to re.sp.on.der[4500] (76 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 13[NET] received packet: from re.sp.on.der[4500] to 10.0.1.36[4500] (92 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 13[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/GTC ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 13[IKE] server requested EAP_GTC authentication (id 0x79)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 13[ENC] generating IKE_AUTH request 3 [ EAP/RES/GTC ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 13[NET] sending packet: from 10.0.1.36[4500] to re.sp.on.der[4500] (92 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 09[NET] received packet: from re.sp.on.der[4500] to 10.0.1.36[4500] (76 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 09[ENC] parsed IKE_AUTH response 3 [ EAP/SUCC ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 09[IKE] EAP method EAP_GTC succeeded, no MSK established</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 09[IKE] authentication of 'my-user' (myself) with EAP</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 09[ENC] generating IKE_AUTH request 4 [ AUTH ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:51 initiator charon: 09[NET] sending packet: from 10.0.1.36[4500] to re.sp.on.der[4500] (92 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[NET] received packet: from re.sp.on.der[4500] to 10.0.1.36[4500] (300 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[ENC] parsed IKE_AUTH response 4 [ AUTH CPRP(ADDR U_SPLITINC U_LOCALLAN DNS U_DEFDOM DNS) SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[IKE] authentication of '<a href="http://responder.domain.com/" class="">responder.domain.com</a>' with EAP successful</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[IKE] IKE_SA dm-psk[2] established between 10.0.1.36[my-user]...re.sp.on.der[<a href="http://responder.domain.com/" class="">responder.domain.com</a>]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[IKE] scheduling reauthentication in 10092s</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[IKE] maximum IKE_SA lifetime 10632s</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[CFG] handling UNITY_SPLIT_INCLUDE attribute failed</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[CFG] handling UNITY_LOCAL_LAN attribute failed</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[IKE] installing DNS server 10.8.194.96 to /etc/resolv.conf</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[CFG] handling UNITY_DEF_DOMAIN attribute failed</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[IKE] installing DNS server 10.8.194.96 to /etc/resolv.conf</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[IKE] installing new virtual IP 10.255.252.2</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[IKE] CHILD_SA dm-psk{5} established with SPIs ce54cd29_i 759cb598_o and TS 10.255.252.2/32 === 10.8.192.0/19</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[CHD] updown: /usr/libexec/strongswan/_updown: line 300: iptables: command not found</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[CHD] updown: /usr/libexec/strongswan/_updown: line 303: iptables: command not found</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[CHD] updown: /usr/libexec/strongswan/_updown: line 312: iptables: command not found</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[CHD] updown: /usr/libexec/strongswan/_updown: line 315: iptables: command not found</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator vpn: + <a href="http://responder.domain.com/" class="">
responder.domain.com</a> 10.8.192.0/19 == re.sp.on.der -- 10.0.1.36 == 10.255.252.2/32</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[IKE] received AUTH_LIFETIME of 9930s, scheduling reauthentication in 9390s</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 15[IKE] peer supports MOBIKE</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 10[IKE] deleting IKE_SA dm-psk[1] between 10.0.1.36[my-user]...re.sp.on.der[<a href="http://responder.domain.com/" class="">responder.domain.com</a>]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 10[IKE] sending DELETE for IKE_SA dm-psk[1]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 10[ENC] generating INFORMATIONAL request 12 [ D ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 10[NET] sending packet: from 10.0.1.36[4500] to re.sp.on.der[4500] (76 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 14[NET] received packet: from re.sp.on.der[4500] to 10.0.1.36[4500] (76 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 14[ENC] parsed INFORMATIONAL response 12 [ ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 14[IKE] IKE_SA deleted</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 14[CHD] updown: /usr/libexec/strongswan/_updown: line 348: iptables: command not found</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 14[CHD] updown: /usr/libexec/strongswan/_updown: line 352: iptables: command not found</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 14[CHD] updown: /usr/libexec/strongswan/_updown: line 362: iptables: command not found</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 14[CHD] updown: /usr/libexec/strongswan/_updown: line 366: iptables: command not found</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator vpn: - <a href="http://responder.domain.com/" class="">
responder.domain.com</a> 10.8.192.0/19 == re.sp.on.der -- 10.0.1.36 == 10.255.252.2/32</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 14[IKE] removing DNS server 10.8.194.96 from /etc/resolv.conf</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 14[IKE] removing DNS server 10.8.194.96 from /etc/resolv.conf</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 14[IKE] removing DNS server 10.8.194.96 from /etc/resolv.conf</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator charon: 14[IKE] removing DNS server 10.8.194.96 from /etc/resolv.conf</div>
</div>
<div class="">
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:03:15 initiator charon: 11[IKE] sending keep alive to re.sp.on.der[4500]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:03:22 initiator charon: 04[IKE] sending DPD request</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">/etc/resolv.conf on the Initiator after IKA_SA re-authentication competes. Charon removed the name server configuration at datestamp “Nov 11 20:02:52 in the Initiator log above.</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
[myaccount@initiator ~]$ cat /etc/resolv.conf </div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
search domain.internal # by edm-start-ipsec on Wed Nov 11 17:24:56 EST 2015</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
; generated by /sbin/dhclient-script</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
nameserver 10.0.1.1</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</div>
<div class=""><br class="">
</div>
<div class="">/var/log/messages on the Responder during IKE_SA re-authentication (timezone is UTC):</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 08[NET] received packet: from ini.ti.at.or[40720] to 10.8.193.69[4500] (1436 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 08[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 08[IKE] ini.ti.at.or is initiating an IKE_SA</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 08[IKE] local host is behind NAT, sending keep alives</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 08[IKE] remote host is behind NAT</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 08[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(HASH_ALG) N(MULT_AUTH) ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 08[NET] sending packet: from 10.8.193.69[4500] to ini.ti.at.or[40720] (456 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 15[NET] received packet: from ini.ti.at.or[40720] to 10.8.193.69[4500] (428 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 15[ENC] parsed IKE_AUTH request 1 [ IDi IDr AUTH CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(AUTH_FOLLOWS) ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 15[CFG] looking for peer configs matching 10.8.193.69[<a href="http://responder.domain.com/" class="">responder.domain.com</a>]...ini.ti.at.or[my-user]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 15[CFG] selected peer config 'endpoints'</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 15[IKE] authentication of 'my-user' with pre-shared key successful</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 15[CFG] constraint requires public key authentication, but pre-shared key was used</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 15[CFG] selected peer config 'endpoints' inacceptable: non-matching authentication done</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 15[CFG] switching to peer config 'rw-ikev2-psk'</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 15[IKE] peer supports MOBIKE</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 15[IKE] authentication of '<a href="http://responder.domain.com/" class="">responder.domain.com</a>' (myself) with pre-shared key</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 15[ENC] generating IKE_AUTH response 1 [ IDr AUTH ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 15[NET] sending packet: from 10.8.193.69[4500] to ini.ti.at.or[40720] (124 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 10[NET] received packet: from ini.ti.at.or[40720] to 10.8.193.69[4500] (76 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 10[ENC] parsed IKE_AUTH request 2 [ IDi ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 10[IKE] initiating EAP_GTC method (id 0x79)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 10[ENC] generating IKE_AUTH response 2 [ EAP/REQ/GTC ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 10[NET] sending packet: from 10.8.193.69[4500] to ini.ti.at.or[40720] (92 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 12[NET] received packet: from ini.ti.at.or[40720] to 10.8.193.69[4500] (92 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:53 responder charon: 12[ENC] parsed IKE_AUTH request 3 [ EAP/RES/GTC ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 12[IKE] PAM authentication of 'my-user' successful</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 12[IKE] EAP method EAP_GTC succeeded, no MSK established</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 12[ENC] generating IKE_AUTH response 3 [ EAP/SUCC ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 12[NET] sending packet: from 10.8.193.69[4500] to ini.ti.at.or[40720] (76 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[NET] received packet: from ini.ti.at.or[40720] to 10.8.193.69[4500] (92 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[ENC] parsed IKE_AUTH request 4 [ AUTH ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[IKE] authentication of 'my-user' with EAP successful</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[IKE] authentication of '<a href="http://responder.domain.com/" class="">responder.domain.com</a>' (myself) with EAP</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[IKE] IKE_SA rw-ikev2-psk[4] established between 10.8.193.69[<a href="http://responder.domain.com/" class="">responder.domain.com</a>]...ini.ti.at.or[my-user]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[IKE] scheduling reauthentication in 9930s</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[IKE] maximum IKE_SA lifetime 10470s</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[IKE] peer requested virtual IP 10.255.252.2</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[CFG] reassigning online lease to 'my-user'</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[IKE] assigning virtual IP 10.255.252.2 to peer 'my-user'</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[IKE] CHILD_SA rw-ikev2-psk{7} established with SPIs 759cb598_i ce54cd29_o and TS 10.8.192.0/19 === 10.255.252.2/32</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder vpn: + my-user 10.255.252.2/32 == ini.ti.at.or -- 10.8.193.69 == 10.8.192.0/19</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[ENC] generating IKE_AUTH response 4 [ AUTH CPRP(ADDR U_SPLITINC U_LOCALLAN DNS U_DEFDOM DNS) SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 13[NET] sending packet: from 10.8.193.69[4500] to ini.ti.at.or[40720] (300 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 11[NET] received packet: from ini.ti.at.or[40720] to 10.8.193.69[4500] (76 bytes)</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 11[ENC] parsed INFORMATIONAL request 12 [ D ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 11[IKE] received DELETE for IKE_SA rw-ikev2-psk[3]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 11[IKE] deleting IKE_SA rw-ikev2-psk[3] between 10.8.193.69[<a href="http://responder.domain.com/" class="">responder.domain.com</a>]...ini.ti.at.or[my-user]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 11[IKE] IKE_SA deleted</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder vpn: - my-user 10.255.252.2/32 == ini.ti.at.or -- 10.8.193.69 == 10.8.192.0/19</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 11[ENC] generating INFORMATIONAL response 12 [ ]</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 12 01:02:54 responder charon: 11[NET] sending packet: from 10.8.193.69[4500] to ini.ti.at.or[40720] (76 bytes)</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Questions</div>
<div class=""><br class="">
</div>
<div class="">1. How to prevent Charon from removing the name server configuration from /etc/resolv.conf in the IKA_SA re-authentication case?</div>
<div class=""><br class="">
</div>
<div class="">2. Why does the up/down script get invoked during IKE_SA re-authentication? When “make before break” is enabled, the up/down script invocation seems backward/awkward. That is, up/down is invoked with an ‘up’ notification at the initial establishment
of the tunnel, then again with a second ‘up’ notification during the “make before break”, then finally with a ‘down’ notification even though the tunnel is up?!?</div>
<div class=""><br class="">
</div>
<div class="">VPN up/down notifications from Initiator’s /var/log/messages:</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 17:24:54 initiator vpn: + <a href="http://responder.domain.com/" class="">
responder.domain.com</a> 10.8.192.0/19 == re.sp.on.der -- 10.0.1.36 == 10.255.252.2/32</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator vpn: + <a href="http://responder.domain.com/" class="">
responder.domain.com</a> 10.8.192.0/19 == re.sp.on.der -- 10.0.1.36 == 10.255.252.2/32</div>
<div style="margin: 0px; line-height: normal; font-family: Courier; background-color: rgb(226, 225, 227);" class="">
Nov 11 20:02:52 initiator vpn: - <a href="http://responder.domain.com/" class="">
responder.domain.com</a> 10.8.192.0/19 == re.sp.on.der -- 10.0.1.36 == 10.255.252.2/32</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">3. Aside: why does /usr/libexec/strongswan/_updown fail to find iptables?</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</div>
_______________________________________________<br class="">
Dev mailing list<br class="">
<a href="mailto:Dev@lists.strongswan.org" class="">Dev@lists.strongswan.org</a><br class="">
https://lists.strongswan.org/mailman/listinfo/dev</div>
</blockquote>
</div>
<br class="">
</body>
</html>