<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="GENERATOR" content="MSHTML 8.00.6001.19190">
</head>
<body>
<div><font size="2" face="Arial"><span class="250313410-13062012">Hi,</span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012"></span></font> </div>
<div><font size="2" face="Arial"><span class="250313410-13062012">I am facing a issue with IKEv1 where multiple IPSec SAs are seen for same tunnel.</span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012">I had setup two Linux PC with strongswan 4.6.2 and with below configurations. Have also attached plutologs of both the PC's.
</span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012"><span lang="EN"></span></span></font> </div>
<div><font size="2" face="Arial"><span class="250313410-13062012"><span lang="EN">I would really appreciate some help.</span></span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012"><span lang="EN"></span></span></font> </div>
<div><font size="2" face="Arial"><span class="250313410-13062012"><span lang="EN">Thanks,</span></span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012"><span lang="EN">Vinay</span></span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012"><span lang="EN"> </div>
</span></span></font><font size="2" face="Arial"><span class="250313410-13062012"></span></font><font size="2" face="Arial"><span class="250313410-13062012"></span></font>
<div><font size="2" face="Arial"><span class="250313410-13062012"><strong>PC1:</strong></span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012">[root@linuxpc2 etc]# cat ipsec.conf
<br>
config setup <br>
plutostart=yes <br>
plutodebug=controlmore<br>
nat_traversal=no <br>
uniqueids=no <br>
charonstart=yes <br>
plutostderrlog=/tmp/plutolog.txt <br>
charondebug="dmn 1, mgr 1, ike 1, chd 1, job 1, cfg 1, knl 1, net 1, enc 1, lib 1"
</span></font></div>
<div> </div>
<div><font size="2" face="Arial"><span class="250313410-13062012">ca rootca0 <br>
cacert=cacert.pem<br>
auto=start</span></font></div>
<div> </div>
<div><font size="2" face="Arial"><span class="250313410-13062012">conn %default <br>
leftcert=/usr/local/etc/ipsec.d/certs/bts_cert.pem <br>
auto=start<br>
pfs=no <br>
keyingtries=%forever <br>
forceencaps=no <br>
mobike=no</span></font></div>
<div> </div>
<div><font size="2" face="Arial"><span class="250313410-13062012">conn conn100 <br>
type=tunnel <br>
leftsubnet=10.10.10.6/24 <br>
rightsubnet=10.10.10.7/24 <br>
left=10.10.10.6<br>
right=10.10.10.7<br>
keyexchange=ikev1<br>
reauth=no <br>
ike=3des-sha1-modp1024! <br>
ikelifetime=83376s <br>
esp=3des-sha1!<br>
authby=pubkey <br>
rightid=%any<br>
keylife=300s <br>
dpdaction=restart <br>
dpddelay=10s <br>
dpdtimeout=120s <br>
rekeyfuzz=50% <br>
rekeymargin=180s<br>
leftprotoport=1<br>
rightprotoport=1<br>
</span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012"><strong>PC2:</strong></span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012">[root@Fed14 etc]# cat ipsec.conf<br>
config setup<br>
plutostart=yes<br>
plutodebug=none<br>
nat_traversal=no<br>
uniqueids=no<br>
charonstart=yes<br>
plutostderrlog=/tmp/plutolog.txt<br>
charondebug="dmn 1, mgr 1, ike 2, chd 1, job 1, cfg 2, knl 1, net 1, enc 2, lib 1"</span></font></div>
<div> </div>
<div><font size="2" face="Arial"><span class="250313410-13062012">ca rootca0<br>
cacert=cacert.pem</span></font></div>
<div> </div>
<div><font size="2" face="Arial"><span class="250313410-13062012">conn %default<br>
leftcert=/etc/ipsec.d/certs/oms_cert.pem<br>
auto=add<br>
pfs=no<br>
keyingtries=%forever<br>
forceencaps=no<br>
mobike=no</span></font></div>
<div> </div>
<div><font size="2" face="Arial"><span class="250313410-13062012">conn conn502<br>
type=tunnel<br>
leftsubnet=10.10.10.7/24<br>
rightsubnet=10.10.10.6/24<br>
left=10.10.10.7<br>
right=10.10.10.6<br>
keyexchange=ikev1<br>
reauth=no<br>
ike=3des-sha1-modp1024!<br>
ikelifetime=83376s<br>
esp=3des-sha1!<br>
authby=pubkey<br>
rightid=%any<br>
keylife=86400s<br>
dpdaction=restart<br>
dpddelay=10s<br>
dpdtimeout=120s<br>
rekeyfuzz=50%<br>
rekeymargin=180s<br>
leftprotoport=1<br>
rightprotoport=1</span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012"></span></font> </div>
<div><font size="2" face="Arial"><span class="250313410-13062012"><strong>Statusall of PC1:</strong></span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012">[root@linuxpc2 etc]# ipsec statusall<br>
000 Status of IKEv1 pluto daemon (strongSwan 4.6.2):<br>
000 interface lo/lo ::1:500<br>
000 interface lo/lo 127.0.0.1:500<br>
000 interface eth1/eth1 10.10.10.6:500<br>
000 interface eth2/eth2 10.125.40.64:500<br>
000 interface virbr0/virbr0 192.168.122.1:500<br>
000 %myid = '%any'<br>
000 loaded plugins: aes des sha1 sha2 md5 random x509 pkcs1 pkcs8 pgp dnskey pem gmp hmac xauth attr kernel-netlink resolve<br>
000 debug options: controlmore<br>
000 <br>
000 "conn100": 10.10.10.0/24===10.10.10.6[C=IN, ST=BLR, O=Wipro Technologies, OU=RA, CN=ftm]:1/0...10.10.10.7[10.10.10.7]:1/0===10.10.10.0/24; erouted; eroute owner: #6<br>
000 "conn100": CAs: "O=Wipro Technologies, OU=RA, <a href="mailto:E=karanjot.singh@wipro.com">
E=karanjot.singh@wipro.com</a>, L=BLR, ST=BLR, C=IN, CN=NSN ODC Test CA"...%any<br>
000 "conn100": ike_life: 83376s; ipsec_life: 300s; rekey_margin: 180s; rekey_fuzz: 50%; keyingtries: 0<br>
000 "conn100": dpd_action: restart; dpd_delay: 10s; dpd_timeout: 120s;<br>
000 "conn100": policy: PUBKEY+ENCRYPT+TUNNEL+UP; prio: 24,24; interface: eth1; <br>
000 "conn100": newest ISAKMP SA: #1; newest IPsec SA: #6; <br>
000 "conn100": IKE proposal: 3DES_CBC/HMAC_SHA1/MODP_1024<br>
000 "conn100": ESP proposal: 3DES_CBC/HMAC_SHA1/<N/A><br>
000 <br>
000 #6: "conn100" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 70s; newest IPSEC; eroute owner<br>
000 #6: "conn100" <a href="mailto:esp.cd1fefd2@10.10.10.7">esp.cd1fefd2@10.10.10.7</a> (0 bytes)
<a href="mailto:esp.c361a998@10.10.10.6">esp.c361a998@10.10.10.6</a> (0 bytes); tunnel<br>
000 #5: "conn100" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_EXPIRE in 231s<br>
000 #5: "conn100" <a href="mailto:esp.c1c20f9a@10.10.10.7">esp.c1c20f9a@10.10.10.7</a> (0 bytes)
<a href="mailto:esp.c9efac8d@10.10.10.6">esp.c9efac8d@10.10.10.6</a> (0 bytes); tunnel<br>
000 #4: "conn100" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_EXPIRE in 185s<br>
000 #4: "conn100" <a href="mailto:esp.c1a2c0d0@10.10.10.7">esp.c1a2c0d0@10.10.10.7</a> (0 bytes)
<a href="mailto:esp.c9adba01@10.10.10.6">esp.c9adba01@10.10.10.6</a> (0 bytes); tunnel<br>
000 #3: "conn100" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_EXPIRE in 138s<br>
000 #3: "conn100" <a href="mailto:esp.c96eb76e@10.10.10.7">esp.c96eb76e@10.10.10.7</a> (0 bytes)
<a href="mailto:esp.c2df58a4@10.10.10.6">esp.c2df58a4@10.10.10.6</a> (0 bytes); tunnel<br>
000 #2: "conn100" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_EXPIRE in 85s<br>
000 #2: "conn100" <a href="mailto:esp.c29abdd9@10.10.10.7">esp.c29abdd9@10.10.10.7</a> (0 bytes)
<a href="mailto:esp.c11e8f13@10.10.10.6">esp.c11e8f13@10.10.10.6</a> (0 bytes); tunnel<br>
000 #1: "conn100" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 82911s; newest ISAKMP; DPD active<br>
000 <br>
Status of IKEv2 charon daemon (strongSwan 4.6.2):<br>
uptime: 3 minutes, since Jun 13 15:39:21 2012<br>
malloc: sbrk 135168, mmap 0, used 76544, free 58624<br>
worker threads: 8 of 16 idle, 7/1/0/0 working, job queue: 0/0/0/0, scheduled: 0<br>
loaded plugins: aes des sha1 sha2 md5 random x509 revocation constraints pubkey pkcs1 pkcs8 pgp pem fips-prf gmp xcbc hmac attr kernel-netlink resolve socket-raw stroke updown<br>
Listening IP addresses:<br>
10.10.10.6<br>
10.125.40.64<br>
192.168.122.1<br>
Connections:<br>
Security Associations (0 up, 0 connecting):<br>
none</span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012"></span></font> </div>
<div><font size="2" face="Arial"><span class="250313410-13062012">
<div><font size="2" face="Arial"><span class="250313410-13062012"><strong>Statusall of PC2:</strong></span></font></div>
<div><font size="2" face="Arial"><span class="250313410-13062012">[root@Fed14 etc]# ipsec statusall<br>
000 Status of IKEv1 pluto daemon (strongSwan 4.6.2):<br>
000 interface lo/lo ::1:500<br>
000 interface lo/lo 127.0.0.1:500<br>
000 interface eth1/eth1 10.10.10.7:500<br>
000 interface eth0/eth0 10.125.47.47:500<br>
000 interface eth2/eth2 20.20.20.2:500<br>
000 interface eth1.400/eth1.400 12.1.1.10:500<br>
000 interface eth1.500/eth1.500 16.1.1.10:500<br>
000 interface eth2.400/eth2.400 11.1.1.1:500<br>
000 interface eth2.500/eth2.500 22.1.1.1:500<br>
000 %myid = '%any'<br>
000 loaded plugins: aes des sha1 sha2 md5 random x509 pkcs1 pkcs8 pgp dnskey pem gmp hmac xauth attr kernel-netlink resolve<br>
000 debug options: none<br>
000 <br>
000 "conn502": 10.10.10.0/24===10.10.10.7[C=IN, ST=BLR, O=Wipro Technologies, OU=RA, CN=oms]:1/0...10.10.10.6[10.10.10.6]:1/0===10.10.10.0/24; erouted; eroute owner: #6<br>
000 "conn502": CAs: "O=Wipro Technologies, OU=RA, <a href="mailto:E=karanjot.singh@wipro.com">
E=karanjot.singh@wipro.com</a>, L=BLR, ST=BLR, C=IN, CN=NSN ODC Test CA"...%any<br>
000 "conn502": ike_life: 83376s; ipsec_life: 86400s; rekey_margin: 180s; rekey_fuzz: 50%; keyingtries: 0<br>
000 "conn502": dpd_action: restart; dpd_delay: 10s; dpd_timeout: 120s;<br>
000 "conn502": policy: PUBKEY+ENCRYPT+TUNNEL; prio: 24,24; interface: eth1; <br>
000 "conn502": newest ISAKMP SA: #1; newest IPsec SA: #6; <br>
000 "conn502": IKE proposal: 3DES_CBC/HMAC_SHA1/MODP_1024<br>
000 "conn502": ESP proposal: 3DES_CBC/HMAC_SHA1/<N/A><br>
000 <br>
000 #6: "conn502" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 202s; newest IPSEC; eroute owner<br>
000 #6: "conn502" <a href="mailto:esp.c361a998@10.10.10.6">esp.c361a998@10.10.10.6</a> (0 bytes)
<a href="mailto:esp.cd1fefd2@10.10.10.7">esp.cd1fefd2@10.10.10.7</a> (0 bytes); tunnel<br>
000 #5: "conn502" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 149s<br>
000 #5: "conn502" <a href="mailto:esp.c9efac8d@10.10.10.6">esp.c9efac8d@10.10.10.6</a> (0 bytes)
<a href="mailto:esp.c1c20f9a@10.10.10.7">esp.c1c20f9a@10.10.10.7</a> (0 bytes); tunnel<br>
000 #4: "conn502" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 103s<br>
000 #4: "conn502" <a href="mailto:esp.c9adba01@10.10.10.6">esp.c9adba01@10.10.10.6</a> (0 bytes)
<a href="mailto:esp.c1a2c0d0@10.10.10.7">esp.c1a2c0d0@10.10.10.7</a> (0 bytes); tunnel<br>
000 #3: "conn502" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 55s<br>
000 #3: "conn502" <a href="mailto:esp.c2df58a4@10.10.10.6">esp.c2df58a4@10.10.10.6</a> (0 bytes)
<a href="mailto:esp.c96eb76e@10.10.10.7">esp.c96eb76e@10.10.10.7</a> (0 bytes); tunnel<br>
000 #2: "conn502" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 3s<br>
000 #2: "conn502" <a href="mailto:esp.c11e8f13@10.10.10.6">esp.c11e8f13@10.10.10.6</a> (0 bytes)
<a href="mailto:esp.c29abdd9@10.10.10.7">esp.c29abdd9@10.10.10.7</a> (0 bytes); tunnel<br>
000 #1: "conn502" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 83079s; newest ISAKMP; DPD active<br>
000 <br>
Status of IKEv2 charon daemon (strongSwan 4.6.2):<br>
uptime: 3 minutes, since Jun 13 15:40:12 2012<br>
malloc: sbrk 135168, mmap 0, used 81296, free 53872<br>
worker threads: 8 of 16 idle, 7/1/0/0 working, job queue: 0/0/0/0, scheduled: 0<br>
loaded plugins: aes des sha1 sha2 md5 random x509 revocation constraints pubkey pkcs1 pkcs8 pgp pem fips-prf gmp xcbc hmac attr kernel-netlink resolve socket-raw stroke updown<br>
Listening IP addresses:<br>
10.10.10.7<br>
10.125.47.47<br>
20.20.20.2<br>
12.1.1.10<br>
16.1.1.10<br>
11.1.1.1<br>
22.1.1.1<br>
Connections:<br>
Security Associations (0 up, 0 connecting):<br>
none<br>
</span></font></span></font></div>
</div>
<P><strong><span style='font-size:10.0pt;font-family:
"Palatino Linotype","serif";color:green'> Please do not print this email unless it is absolutely necessary. </span></strong><span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
<p> The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. </p>
<p>WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. </p>
<p>
www.wipro.com
</p>
</body>
</html>