<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi Folks,<br>
<br>
I'm running a Ubuntu Server 10.04.03 LTS with latest patches. I'm
using Strongswan from Ubuntu Lucid packages. Ipsec version shows
following output:<font face="Consolas"> Linux strongSwan
U4.3.2/K2.6.32-35-server</font><br>
I have 26 ipsec tunnels. Some connections setup's are equal and some
setups differ.<br>
When I do a ipsec status I got the following %aquire-netlink
messages:<br>
<br>
000 "internal LAN Address"/32:55155 -> "Remote LAN
Address"/32:161 => %hold:17 0 %acquire-netlink<br>
000 "internal LAN Address" -> "Remote LAN Address"/32:2889 =>
%hold:6 0 %acquire-netlink<br>
000 "internal LAN Address"/32:1536 -> "Remote LAN
Address"/32:12346 => %hold:6 0 %acquire-netlink<br>
000 "internal LAN Address"/32:4639 -> "Remote LAN
Address"/32:2889 => %hold:6 0 %acquire-netlink<br>
<br>
When i restart the ipsec daemon everything is ok. After daemon
restart the ipsec status shows no %aquire-netlink messages and
everything looks good. The tunnels work fine although these messages
appear. After a few days the %aquire-netlink messages will appear
again.<br>
<br>
Here is an example configuration for a tunnel setup with the
message. Its a ADSL Line with a connection reset after 24h.<br>
<br>
<font face="Consolas">config setup<br>
#charondebug=ike3,enc3,dmn3,chd3,net3<br>
#plutodebug=control<br>
strictcrlpolicy=no<br>
nat_traversal=yes<br>
keep_alive = 20s<br>
charonstart=yes<br>
plutostart=yes<br>
interfaces=%defaultroute<br>
<br>
include /var/lib/strongswan/ipsec.conf.inc<br>
<br>
conn xyz<br>
auth=esp<br>
esp=3des-md5<br>
ike=3des-md5-modp1024<br>
left=%defaultroute<br>
leftnexthop=xxx.xxx.xxx.xxx<br>
right=xxx.xxx.xxx.xxx<br>
rightsubnet=xxx.xxx.xxx.xxx<br>
authby=secret<br>
pfs=yes<br>
leftsubnet=xxx.xxx.xxx.xxx<br>
auto=start<br>
dpdaction=restart<br>
dpddelay=10<br>
dpdtimeout=60</font><br>
<br>
I found some "netlink" messages in the log: netlink recvfrom() of
response to our XFRM_MSG_DELPOLICY message for policy <a
class="moz-txt-link-abbreviated"
href="mailto:int.0@xxx.xxx.xxx.xxx">int.0@xxx.xxx.xxx.xxx</a> was
too long: 100 > 36<br>
<br>
When in the Log file a netlink recvfrom()... messages comes up, in
syslog this message is logged:<br>
<font face="Consolas">Nov 25 06:17:41 vpngate charon: 16[KNL]
creating delete job for ESP CHILD_SA with SPI 6945dd20 and reqid
{16389}<br>
Nov 25 06:17:41 vpngate charon: 17[JOB] CHILD_SA with reqid 16389
not found for delete</font><br>
<br>
I don't know if it is at the moment a real problem while
communication looks good. But maybe it could be a problem in future?
Hopefully somebody could help. Searching in the Internet and the
mailing list didn't help me.<br>
<br>
Here is the full log file:<br>
<br>
<font face="Consolas">Nov 25 05:14:20 vpngate pluto[31774]: "xyz"
#541: DPD: No response from peer - declaring peer dead<br>
Nov 25 05:14:20 vpngate pluto[31774]: "xyz" #541: DPD: Terminating
all SAs using this connection<br>
Nov 25 05:14:20 vpngate pluto[31774]: "xyz" #538: deleting state
(STATE_QUICK_I2)<br>
Nov 25 05:14:20 vpngate pluto[31774]: "xyz" #541: deleting state
(STATE_MAIN_I4)<br>
Nov 25 05:14:20 vpngate pluto[31774]: DPD: Restarting connection
"xyz"<br>
Nov 25 05:14:20 vpngate pluto[31774]: netlink recvfrom() of
response to our XFRM_MSG_DELPOLICY message for policy <a
class="moz-txt-link-abbreviated"
href="mailto:int.0@xxx.xxx.xxx.xxx">int.0@xxx.xxx.xxx.xxx</a>
was too long: 100 > 36<br>
Nov 25 05:14:20 vpngate pluto[31774]: netlink recvfrom() of
response to our XFRM_MSG_DELPOLICY message for policy <a
class="moz-txt-link-abbreviated"
href="mailto:int.0@xxx.xxx.xxx.xxx">int.0@xxx.xxx.xxx.xxx</a>
was too long: 100 > 36<br>
Nov 25 05:14:20 vpngate pluto[31774]: "xyz" #559: initiating Main
Mode<br>
Nov 25 05:15:30 vpngate pluto[31774]: "xyz" #559: max number of
retransmissions (2) reached STATE_MAIN_I1. No response (or no
acceptable response) to our first IKE message<br>
Nov 25 05:15:30 vpngate pluto[31774]: "xyz" #559: starting keying
attempt 2 of at most 3<br>
Nov 25 05:15:30 vpngate pluto[31774]: "xyz" #560: initiating Main
Mode to replace #559<br>
Nov 25 05:16:40 vpngate pluto[31774]: "xyz" #560: max number of
retransmissions (2) reached STATE_MAIN_I1. No response (or no
acceptable response) to our first IKE message<br>
Nov 25 05:16:40 vpngate pluto[31774]: "xyz" #560: starting keying
attempt 3 of at most 3<br>
Nov 25 05:16:40 vpngate pluto[31774]: "xyz" #564: initiating Main
Mode to replace #560<br>
Nov 25 05:16:49 vpngate pluto[31774]: packet from
xxx.xxx.xxx.xxx:500: received Vendor ID payload [Dead Peer
Detection]<br>
Nov 25 05:16:49 vpngate pluto[31774]: "xyz" #565: responding to
Main Mode<br>
Nov 25 05:16:51 vpngate pluto[31774]: packet from
xxx.xxx.xxx.xxx:500: received Vendor ID payload [Dead Peer
Detection]<br>
Nov 25 05:16:51 vpngate pluto[31774]: "xyz" #566: responding to
Main Mode<br>
Nov 25 05:16:59 vpngate pluto[31774]: packet from
xxx.xxx.xxx.xxx:500: received Vendor ID payload [Dead Peer
Detection]<br>
Nov 25 05:16:59 vpngate pluto[31774]: "xyz" #567: responding to
Main Mode<br>
Nov 25 05:16:59 vpngate pluto[31774]: "xyz" #567: Peer ID is
ID_IPV4_ADDR: 'xxx.xxx.xxx.xxx'<br>
Nov 25 05:16:59 vpngate pluto[31774]: "xyz" #567: sent MR3, ISAKMP
SA established<br>
Nov 25 05:16:59 vpngate pluto[31774]: "xyz" #568: responding to
Quick Mode<br>
Nov 25 05:17:00 vpngate pluto[31774]: "xyz" #568: Dead Peer
Detection (RFC 3706) enabled<br>
Nov 25 05:17:00 vpngate pluto[31774]: "xyz" #568: IPsec SA
established {ESP=>0x1003da1d <0xcfbb107a}<br>
Nov 25 05:17:10 vpngate pluto[31774]: "xyz" #564: received Vendor
ID payload [Dead Peer Detection]<br>
Nov 25 05:17:11 vpngate pluto[31774]: "xyz" #564: Peer ID is
ID_IPV4_ADDR: 'xxx.xxx.xxx.xxx'<br>
Nov 25 05:17:11 vpngate pluto[31774]: "xyz" #564: ISAKMP SA
established<br>
Nov 25 05:17:11 vpngate pluto[31774]: "xyz" #569: initiating Quick
Mode PSK+ENCRYPT+TUNNEL+PFS+UP {using isakmp#564}<br>
Nov 25 05:17:11 vpngate pluto[31774]: "xyz" #569: Dead Peer
Detection (RFC 3706) enabled<br>
Nov 25 05:17:11 vpngate pluto[31774]: "xyz" #569: sent QI2, IPsec
SA established {ESP=>0x1003da1e <0x39f8270f}<br>
Nov 25 05:17:11 vpngate pluto[31774]: "xyz" #564: received Delete
SA(0x1003da1d) payload: deleting IPSEC State #568<br>
Nov 25 05:17:59 vpngate pluto[31774]: "xyz" #565: max number of
retransmissions (2) reached STATE_MAIN_R1</font><br>
<br>
Best regards<br>
Sascha Kinz<br>
<br>
</body>
</html>