<html><head></head><body><div class="ydp303c94d2yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div></div>
<div>Hi all,</div><div><br></div><div>In further testing, whenever I see the issue, I see that <span>XfrmInTmplMismatch counter is increasing. Any clues on what might be going wrong? </span></div><div><span><br></span></div><div><span><span><div>sankar@ipsecgw02:~$ cat /proc/net/xfrm_stat</div><div>XfrmInError 0</div><div>XfrmInBufferError 0</div><div>XfrmInHdrError 0</div><div>XfrmInNoStates 0</div><div>XfrmInStateProtoError 0</div><div>XfrmInStateModeError 0</div><div>XfrmInStateSeqError 0</div><div>XfrmInStateExpired 0</div><div>XfrmInStateMismatch 0</div><div>XfrmInStateInvalid 0</div><div>XfrmInTmplMismatch 4654</div><div>XfrmInNoPols 0</div><div>XfrmInPolBlock 0</div><div>XfrmInPolError 0</div><div>XfrmOutError 0</div><div>XfrmOutBundleGenError 0</div><div>XfrmOutBundleCheckError 0</div><div>XfrmOutNoStates 0</div><div>XfrmOutStateProtoError 0</div><div>XfrmOutStateModeError 0</div><div>XfrmOutStateSeqError 0</div><div>XfrmOutStateExpired 0</div><div>XfrmOutPolBlock 0</div><div>XfrmOutPolDead 0</div><div>XfrmOutPolError 0</div><div>XfrmFwdHdrError 0</div><div>XfrmOutStateInvalid 0</div><div>XfrmAcquireError 0</div><div><br></div></span>Thanks,</span></div><div><span>Sankar</span></div><div><br></div>
</div><div id="yahoo_quoted_2160148533" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Thursday, 8 November, 2018, 6:36:10 PM IST, sankrp@yahoo.com <sankrp@yahoo.com> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div id="yiv9237179615"><div><div>Hi all,</div><div><br></div><div>I am using Strongswan 5.3.5 on Linux <span>4.4.0</span></div><div><span><span style="color:rgb(0, 0, 0);font-family:Helvetica Neue, Helvetica, Arial, sans-serif;">I have setup a site to site tunnel with Cisco ISR. </span></span>Tunnel comes up fine but some times, Linux is not sending the outgoing packets over the tunnel. Issue is intermittent and reproducible only one few machines. </div><div><br></div><div>I have enabled iptables tracing and see packet is dropped after hitting PREROUTING mangle table. </div><div><br></div><div><span><div>2018-11-08T09:14:00.916017+00:00 ipsecgw02 kernel: [74044.919903] TRACE: raw:PREROUTING:policy:2 IN=tunc1 OUT= MAC= SRC=136.147.41.172 DST=192.168.119.19 LEN=52 TOS=0x00 PREC=0x00 TTL=60 ID=0 DF PROTO=TCP SPT=443 DPT=57250 SEQ=1620161194 ACK=1126866778 WINDOW=29200 RES=0x00 ACK SYN URGP=0 OPT (020405B40101040201030305)</div><div>2018-11-08T09:14:00.916027+00:00 ipsecgw02 kernel: [74044.919917] TRACE: mangle:PREROUTING:rule:2 IN=tunc1 OUT= MAC= SRC=136.147.41.172 DST=192.168.119.19 LEN=52 TOS=0x00 PREC=0x00 TTL=60 ID=0 DF PROTO=TCP SPT=443 DPT=57250 SEQ=1620161194 ACK=1126866778 WINDOW=29200 RES=0x00 ACK SYN URGP=0 OPT (020405B40101040201030305)</div><div>2018-11-08T09:14:00.916028+00:00 ipsecgw02 kernel: [74044.919930] TRACE: mangle:PREROUTING:policy:3 IN=tunc1 OUT= MAC= SRC=136.147.41.172 DST=192.168.119.19 LEN=52 TOS=0x00 PREC=0x00 TTL=60 ID=0 DF PROTO=TCP SPT=443 DPT=57250 SEQ=1620161194 ACK=1126866778 WINDOW=29200 RES=0x00 ACK SYN URGP=0 OPT (020405B40101040201030305) MARK=0x3</div></span><br></div><div><br></div><div><span><div>sankar@ipsecgw02:~$ sudo ip xfrm policy</div><div>src 0.0.0.0/0 dst 0.0.0.0/0</div><div> dir fwd priority 3075</div><div> mark 0x3/0xffffffff</div><div> tmpl src 182.156.75.158 dst 192.168.102.80</div><div> proto esp reqid 3 mode tunnel</div><div>src 0.0.0.0/0 dst 0.0.0.0/0</div><div> dir in priority 3075</div><div> mark 0x3/0xffffffff</div><div> tmpl src 182.156.75.158 dst 192.168.102.80</div><div> proto esp reqid 3 mode tunnel</div><div>src 0.0.0.0/0 dst 0.0.0.0/0</div><div> dir out priority 3075</div><div> mark 0x3/0xffffffff</div><div> tmpl src 192.168.102.80 dst 182.156.75.158</div><div> proto esp reqid 3 mode tunnel</div><div><br></div></span></div><div><span><div>sankar@ipsecgw02:~$ sudo ip xfrm state</div><div>src 192.168.102.80 dst 182.156.75.158</div><div> proto esp spi 0x46394a21 reqid 3 mode tunnel</div><div> replay-window 32 flag af-unspec</div><div> mark 0x3/0xffffffff</div><div> aead rfc4106(gcm(aes)) 0x83ff21ce5910815a0dd8d0cbdd79af34911d28540c79cad6347e1de27e9e48a0276f1769 128</div><div> encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</div><div> anti-replay context: seq 0x0, oseq 0x21d, bitmap 0x00000000</div><div>src 182.156.75.158 dst 192.168.102.80</div><div> proto esp spi 0xc1f23c40 reqid 3 mode tunnel</div><div> replay-window 32 flag af-unspec</div><div> mark 0x3/0xffffffff</div><div> aead rfc4106(gcm(aes)) 0x62800cd6c8489b8478c0977f88bf64f5a8990894732a6cab92ec3da362deb998db9533ac 128</div><div> encap type espinudp sport 4500 dport 4500 addr 0.0.0.0</div><div> anti-replay context: seq 0x21d, oseq 0x0, bitmap 0xffffffff</div><div><br></div></span>Any help on how to troubleshoot the issue is highly appreciated.</div><div><br></div><div>Thanks,<br>Sankar</div><div class="yiv9237179615ydpb21a2c45yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"></div></div></div></div>
</div>
</div></body></html>