<html><head></head><body><div>Hi all,</div><div><br></div><div>I am using Strongswan 5.3.5 on Linux <span>4.4.0</span></div><div><span><span style="color: rgb(0, 0, 0); font-family: Helvetica Neue, Helvetica, Arial, sans-serif;">I have setup a site to site tunnel with Cisco ISR. </span></span>Tunnel comes up fine but some times, Linux is not sending the outgoing packets over the tunnel. Issue is intermittent and reproducible only one few machines. </div><div><br></div><div>I have enabled iptables tracing and see packet is dropped after hitting PREROUTING mangle table. </div><div><br></div><div><span><div>2018-11-08T09:14:00.916017+00:00 ipsecgw02 kernel: [74044.919903] TRACE: raw:PREROUTING:policy:2 IN=tunc1 OUT= MAC= SRC=136.147.41.172 DST=192.168.119.19 LEN=52 TOS=0x00 PREC=0x00 TTL=60 ID=0 DF PROTO=TCP SPT=443 DPT=57250 SEQ=1620161194 ACK=1126866778 WINDOW=29200 RES=0x00 ACK SYN URGP=0 OPT (020405B40101040201030305)</div><div>2018-11-08T09:14:00.916027+00:00 ipsecgw02 kernel: [74044.919917] TRACE: mangle:PREROUTING:rule:2 IN=tunc1 OUT= MAC= SRC=136.147.41.172 DST=192.168.119.19 LEN=52 TOS=0x00 PREC=0x00 TTL=60 ID=0 DF PROTO=TCP SPT=443 DPT=57250 SEQ=1620161194 ACK=1126866778 WINDOW=29200 RES=0x00 ACK SYN URGP=0 OPT (020405B40101040201030305)</div><div>2018-11-08T09:14:00.916028+00:00 ipsecgw02 kernel: [74044.919930] TRACE: mangle:PREROUTING:policy:3 IN=tunc1 OUT= MAC= SRC=136.147.41.172 DST=192.168.119.19 LEN=52 TOS=0x00 PREC=0x00 TTL=60 ID=0 DF PROTO=TCP SPT=443 DPT=57250 SEQ=1620161194 ACK=1126866778 WINDOW=29200 RES=0x00 ACK SYN URGP=0 OPT (020405B40101040201030305) MARK=0x3</div></span><br></div><div><br></div><div><span><div>sankar@ipsecgw02:~$ sudo ip xfrm policy</div><div>src 0.0.0.0/0 dst 0.0.0.0/0</div><div> dir fwd priority 3075</div><div> mark 0x3/0xffffffff</div><div> tmpl src 182.156.75.158 dst 192.168.102.80</div><div> proto esp reqid 3 mode tunnel</div><div>src 0.0.0.0/0 dst 0.0.0.0/0</div><div> dir in priority 3075</div><div> mark 0x3/0xffffffff</div><div> tmpl src 182.156.75.158 dst 192.168.102.80</div><div> proto esp reqid 3 mode tunnel</div><div>src 0.0.0.0/0 dst 0.0.0.0/0</div><div> dir out priority 3075</div><div> mark 0x3/0xffffffff</div><div> tmpl src 192.168.102.80 dst 182.156.75.158</div><div> proto esp reqid 3 mode tunnel</div><div><br></div></span></div><div><span><div>sankar@ipsecgw02:~$ sudo ip xfrm state</div><div>src 192.168.102.80 dst 182.156.75.158</div><div> proto esp spi 0x46394a21 reqid 3 mode tunnel</div><div> replay-window 32 flag af-unspec</div><div> mark 0x3/0xffffffff</div><div> aead rfc4106(gcm(aes)) 0x83ff21ce5910815a0dd8d0cbdd79af34911d28540c79cad6347e1de27e9e48a0276f1769 128</div><div> encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</div><div> anti-replay context: seq 0x0, oseq 0x21d, bitmap 0x00000000</div><div>src 182.156.75.158 dst 192.168.102.80</div><div> proto esp spi 0xc1f23c40 reqid 3 mode tunnel</div><div> replay-window 32 flag af-unspec</div><div> mark 0x3/0xffffffff</div><div> aead rfc4106(gcm(aes)) 0x62800cd6c8489b8478c0977f88bf64f5a8990894732a6cab92ec3da362deb998db9533ac 128</div><div> encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</div><div> anti-replay context: seq 0x21d, oseq 0x0, bitmap 0xffffffff</div><div><br></div></span>Any help on how to troubleshoot the issue is highly appreciated.</div><div><br></div><div>Thanks,<br>Sankar</div><div class="ydpb21a2c45yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"></div></body></html>