<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>what is the difference between hold and clear in dpd-action for IKEv2</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">Hi,</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">I</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">’</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">ve been trying to find out what</FONT> <FONT SIZE=2 FACE="Courier New">is the difference between hold and clear in strongswan (IKEv2).</FONT> <FONT SIZE=2 FACE="Courier New"> T</FONT><FONT SIZE=2 FACE="Courier New">he documentation is very vague!</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"></FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> </SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">I made a very simple setup, to test a dead peer</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">.</FONT><FONT SIZE=2 FACE="Courier New"> </FONT> <FONT SIZE=2 FACE="Courier New">After configur</FONT><FONT SIZE=2 FACE="Courier New">ing two ends, start ping to see an</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">established</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"></FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">IPSec SA in SAD.</FONT><FONT SIZE=2 FACE="Courier New"> T</FONT><FONT SIZE=2 FACE="Courier New">hen</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"></FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">just</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">“</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">kill -</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">sigstop</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">”</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"></FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">o</FONT><FONT SIZE=2 FACE="Courier New">ne</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> end, and see what the other end does.</FONT> <FONT SIZE=2 FACE="Courier New"></FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> </SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">Here is conf file used on both</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">ends (of course, after switching the IP addresses around)</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">, which is supposed to be very simple example</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">config setup</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> charonstart</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">yes</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> plutostart</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">no</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> charondebug</FONT><FONT SIZE=2 FACE="Courier New">="</FONT><FONT SIZE=2 FACE="Courier New">knl</FONT> <FONT SIZE=2 FACE="Courier New">2</FONT><FONT SIZE=2 FACE="Courier New">,</FONT> <FONT SIZE=2 FACE="Courier New">dmn</FONT> <FONT SIZE=2 FACE="Courier New">2</FONT><FONT SIZE=2 FACE="Courier New">,</FONT> <FONT SIZE=2 FACE="Courier New">ike</FONT> <FONT SIZE=2 FACE="Courier New">2</FONT><FONT SIZE=2 FACE="Courier New">,</FONT> <FONT SIZE=2 FACE="Courier New">net</FONT> <FONT SIZE=2 FACE="Courier New">2</FONT><FONT SIZE=2 FACE="Courier New">,</FONT><FONT SIZE=2 FACE="Courier New"></FONT> <FONT SIZE=2 FACE="Courier New">cfg</FONT> <FONT SIZE=2 FACE="Courier New">2</FONT><FONT SIZE=2 FACE="Courier New">,</FONT> <FONT SIZE=2 FACE="Courier New">job</FONT> <FONT SIZE=2 FACE="Courier New">2</FONT><FONT SIZE=2 FACE="Courier New">"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">conn</FONT> <FONT SIZE=2 FACE="Courier New">%</FONT><FONT SIZE=2 FACE="Courier New">default</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> keyexchange</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">ikev</FONT><FONT SIZE=2 FACE="Courier New">2</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> auto</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">route</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> mobike</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">no</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">ca strongswan</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> </FONT> <FONT SIZE=2 FACE="Courier New">cacert</FONT><FONT SIZE=2 FACE="Courier New">=/</FONT><FONT SIZE=2 FACE="Courier New">etc</FONT><FONT SIZE=2 FACE="Courier New">/</FONT><FONT SIZE=2 FACE="Courier New">ipsec</FONT><FONT SIZE=2 FACE="Courier New">/</FONT><FONT SIZE=2 FACE="Courier New">certs</FONT><FONT SIZE=2 FACE="Courier New">/</FONT><FONT SIZE=2 FACE="Courier New">ipsec</FONT><FONT SIZE=2 FACE="Courier New">.</FONT><FONT SIZE=2 FACE="Courier New">d</FONT><FONT SIZE=2 FACE="Courier New">/</FONT><FONT SIZE=2 FACE="Courier New">cacerts</FONT><FONT SIZE=2 FACE="Courier New">/</FONT><FONT SIZE=2 FACE="Courier New">cacert</FONT><FONT SIZE=2 FACE="Courier New">.</FONT><FONT SIZE=2 FACE="Courier New">pem</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">conn CONFIG</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> rekeymargin</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">2880</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> rekeyfuzz</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">100%</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> </FONT> <FONT SIZE=2 FACE="Courier New"> left</FONT><FONT SIZE=2 FACE="Courier New">=</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">4</FONT><FONT SIZE=2 FACE="Courier New">0.0.0.1</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> right</FONT><FONT SIZE=2 FACE="Courier New">=</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">20.</FONT><FONT SIZE=2 FACE="Courier New">0.</FONT><FONT SIZE=2 FACE="Courier New">0.</FONT><FONT SIZE=2 FACE="Courier New">1</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> leftsubnet</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">30.0.0.0/24</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> rightsubnet</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">10.0.0.0/24</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> leftprotoport</FONT><FONT SIZE=2 FACE="Courier New">=%</FONT><FONT SIZE=2 FACE="Courier New">any</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> rightprotoport</FONT><FONT SIZE=2 FACE="Courier New">=%</FONT><FONT SIZE=2 FACE="Courier New">any</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> authby</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">secret</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> leftid</FONT><FONT SIZE=2 FACE="Courier New">=</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">40.0.0.1</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> rightid</FONT><FONT SIZE=2 FACE="Courier New">=</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">2</FONT><FONT SIZE=2 FACE="Courier New">0.0.0.1</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> ike</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">aes</FONT><FONT SIZE=2 FACE="Courier New">128</FONT><FONT SIZE=2 FACE="Courier New">-</FONT><FONT SIZE=2 FACE="Courier New">md</FONT><FONT SIZE=2 FACE="Courier New">5</FONT><FONT SIZE=2 FACE="Courier New">-</FONT><FONT SIZE=2 FACE="Courier New">modp</FONT><FONT SIZE=2 FACE="Courier New">1536</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> esp</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">aes</FONT><FONT SIZE=2 FACE="Courier New">128</FONT><FONT SIZE=2 FACE="Courier New">-</FONT><FONT SIZE=2 FACE="Courier New">sha</FONT><FONT SIZE=2 FACE="Courier New">1</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> type</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">tunnel</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> ikelifetime</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">28800</FONT><FONT SIZE=2 FACE="Courier New">s</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> keylife</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">28800</FONT><FONT SIZE=2 FACE="Courier New">s</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> dpdaction</FONT><FONT SIZE=2 FACE="Courier New">=</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">h</FONT><FONT SIZE=2 FACE="Courier New">old</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> dpddelay</FONT><FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">10</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">H</FONT><FONT SIZE=2 FACE="Courier New">ere</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">a</FONT><FONT SIZE=2 FACE="Courier New">re</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> the logs from the end which was not stopped</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">, for two cases, first when dpdaction is clear, and second is when dpdaction is hold:</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">d</FONT><FONT SIZE=2 FACE="Courier New">pdaction = clear:</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">------------------</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">09[IK</FONT><FONT SIZE=2 FACE="Courier New">E] giving up after 5 retransmits</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">09[IKE] IKE_SA CONFIG[1] state change: ESTABLISHED => DESTROYING</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">09[KNL] deleting SAD entry with SPI c6edb535</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">09[KNL] deleted SAD entry with SPI c6edb535</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">09[KNL] deleting SAD entry with SPI c44de4f7</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">09[KNL] deleted SAD entr</FONT><FONT SIZE=2 FACE="Courier New">y with SPI c44de4f7</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">09[KNL] deleting policy 30.0.0.0/24 === 10.0.0.0/24 out</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">09[KNL] policy still used by another CHILD_SA, not removed</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">09[KNL] deleting policy 10.0.0.0/24 === 30.0.0.0/24 in</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">09[KNL] policy still used by another CHILD_SA, not removed</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">09[KNL]</FONT><FONT SIZE=2 FACE="Courier New"> deleting policy 10.0.0.0/24 === 30.0.0.0/24 fwd</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">09[KNL] policy still used by another CHILD_SA, not removed</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">01[JOB] got event, queuing job for execution</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">01[JOB] next event in 22774s 467ms, waiting</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">d</FONT><FONT SIZE=2 FACE="Courier New">pdaction = hold:</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">-----------------</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">IKE</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">giving up after</FONT> <FONT SIZE=2 FACE="Courier New">5</FONT> <FONT SIZE=2 FACE="Courier New">retransmits</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">CFG</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">CHILD</FONT><FONT SIZE=2 FACE="Courier New">_</FONT><FONT SIZE=2 FACE="Courier New">SA named</FONT> <FONT SIZE=2 FACE="Courier New">'</FONT><FONT SIZE=2 FACE="Courier New">CONFIG</FONT><FONT SIZE=2 FACE="Courier New">'</FONT> <FONT SIZE=2 FACE="Courier New">already routed</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">IKE</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">IKE</FONT><FONT SIZE=2 FACE="Courier New">_</FONT><FONT SIZE=2 FACE="Courier New">SA CONFIG</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">1</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">state change</FONT><FONT SIZE=2 FACE="Courier New">:</FONT> <FONT SIZE=2 FACE="Courier New">ESTABLISHED</FONT> <FONT SIZE=2 FACE="Courier New">=</FONT><FONT SIZE=2 FACE="Courier New">></FONT> <FONT SIZE=2 FACE="Courier New">DESTROYING</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">KNL</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">deleting SAD entry with SPI c</FONT><FONT SIZE=2 FACE="Courier New">58</FONT><FONT SIZE=2 FACE="Courier New">b</FONT><FONT SIZE=2 FACE="Courier New">0</FONT><FONT SIZE=2 FACE="Courier New">d</FONT><FONT SIZE=2 FACE="Courier New">94</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">KNL</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">deleted SAD entry with SPI c</FONT><FONT SIZE=2 FACE="Courier New">58</FONT><FONT SIZE=2 FACE="Courier New">b</FONT><FONT SIZE=2 FACE="Courier New">0</FONT><FONT SIZE=2 FACE="Courier New">d</FONT><FONT SIZE=2 FACE="Courier New">94</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">KNL</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">deleting SAD entry with SPI c</FONT><FONT SIZE=2 FACE="Courier New">0</FONT><FONT SIZE=2 FACE="Courier New">cdabf</FONT><FONT SIZE=2 FACE="Courier New">0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">KNL</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">de</FONT><FONT SIZE=2 FACE="Courier New">leted SAD entry with SPI c</FONT><FONT SIZE=2 FACE="Courier New">0</FONT><FONT SIZE=2 FACE="Courier New">cdabf</FONT><FONT SIZE=2 FACE="Courier New">0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">KNL</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">deleting policy</FONT> <FONT SIZE=2 FACE="Courier New">30.0.0.0/24</FONT><FONT SIZE=2 FACE="Courier New"> ===</FONT> <FONT SIZE=2 FACE="Courier New">10.0.0.0/24</FONT><FONT SIZE=2 FACE="Courier New"> out</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">KNL</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">policy still used by another CHILD</FONT><FONT SIZE=2 FACE="Courier New">_</FONT><FONT SIZE=2 FACE="Courier New">SA</FONT><FONT SIZE=2 FACE="Courier New">,</FONT> <FONT SIZE=2 FACE="Courier New">not removed</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">KNL</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">deleting policy</FONT> <FONT SIZE=2 FACE="Courier New">10.0.0.0/24</FONT><FONT SIZE=2 FACE="Courier New"> ===</FONT> <FONT SIZE=2 FACE="Courier New">30.0.0.0/24</FONT><FONT SIZE=2 FACE="Courier New"> in</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">KNL</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">policy still used by another CHILD</FONT><FONT SIZE=2 FACE="Courier New">_</FONT><FONT SIZE=2 FACE="Courier New">SA</FONT><FONT SIZE=2 FACE="Courier New">,</FONT> <FONT SIZE=2 FACE="Courier New">not r</FONT><FONT SIZE=2 FACE="Courier New">emoved</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">KNL</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">deleting policy</FONT> <FONT SIZE=2 FACE="Courier New">10.0.0.0/24</FONT><FONT SIZE=2 FACE="Courier New"> ===</FONT> <FONT SIZE=2 FACE="Courier New">30.0.0.0/24</FONT><FONT SIZE=2 FACE="Courier New"> fwd</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">14</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">KNL</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">policy still used by another CHILD</FONT><FONT SIZE=2 FACE="Courier New">_</FONT><FONT SIZE=2 FACE="Courier New">SA</FONT><FONT SIZE=2 FACE="Courier New">,</FONT> <FONT SIZE=2 FACE="Courier New">not removed</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">01</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">JOB</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">got event</FONT><FONT SIZE=2 FACE="Courier New">,</FONT> <FONT SIZE=2 FACE="Courier New">queuing job for execution</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">01</FONT><FONT SIZE=2 FACE="Courier New">[</FONT><FONT SIZE=2 FACE="Courier New">JOB</FONT><FONT SIZE=2 FACE="Courier New">]</FONT> <FONT SIZE=2 FACE="Courier New">next event in</FONT> <FONT SIZE=2 FACE="Courier New">21045</FONT><FONT SIZE=2 FACE="Courier New">s</FONT> <FONT SIZE=2 FACE="Courier New">504</FONT><FONT SIZE=2 FACE="Courier New">ms</FONT><FONT SIZE=2 FACE="Courier New">,</FONT> <FONT SIZE=2 FACE="Courier New">waitin</FONT><FONT SIZE=2 FACE="Courier New">g</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">In both cases, when giving up, SAD is cleared (ip xfrm</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">state</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"></FONT> <FONT SIZE=2 FACE="Courier New">returns nothing)</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">.</FONT> <FONT SIZE=2 FACE="Courier New"></FONT> <FONT SIZE=2 FACE="Courier New"> H</FONT><FONT SIZE=2 FACE="Courier New">owever, as evident from the log, SPD policies are not touched.</FONT> <FONT SIZE=2 FACE="Courier New">(</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">I</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"></FONT> <FONT SIZE=2 FACE="Courier New">wonder which</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"></FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"> <FONT SIZE=2 FACE="Courier New">is the other CHILD_SA</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">…</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> there isn</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">’</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">t any other IPsec</FONT> <FONT SIZE=2 FACE="Courier New">configurations)</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">dpdaction = restart seems to be meaning full, it immediately tries to renegotiate IK</FONT><FONT SIZE=2 FACE="Courier New">E SA</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New"> (log not shown here)</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Courier New">.</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
</BODY>
</HTML>