[root@linuxpc2 etc]# ipsec statusall 000 Status of IKEv1 pluto daemon (strongSwan 4.6.2): 000 interface lo/lo ::1:500 000 interface lo/lo 127.0.0.1:500 000 interface eth1/eth1 10.10.10.6:500 000 interface eth2/eth2 10.125.40.64:500 000 interface virbr0/virbr0 192.168.122.1:500 000 interface eth1.5/eth1.5 30.30.30.3:500 000 interface eth1.6/eth1.6 60.60.60.3:500 000 interface eth1.7/eth1.7 70.70.70.3:500 000 interface eth1.8/eth1.8 80.80.80.3:500 000 interface eth1.9/eth1.9 90.90.90.3:500 000 interface eth1.10/eth1.10 95.95.95.3:500 000 %myid = '%any' 000 loaded plugins: aes des sha1 sha2 md5 random x509 pkcs1 pkcs8 pgp dnskey pem gmp hmac xauth attr kernel-netlink resolve 000 debug options: controlmore 000 000 "conn102": 70.70.70.0/24===70.70.70.3[CN=FTM/Flexi Node SerialNo#L9080200062]:1/0...70.70.70.8[70.70.70.8]:1/0===70.70.70.0/24; erouted; eroute owner: #19 000 "conn102": CAs: "C=de, O=NSN DUS, CN=NSN DUS Test Root CA"...%any 000 "conn102": ike_life: 83376s; ipsec_life: 86400s; rekey_margin: 180s; rekey_fuzz: 50%; keyingtries: 0 000 "conn102": dpd_action: restart; dpd_delay: 10s; dpd_timeout: 120s; 000 "conn102": policy: PUBKEY+ENCRYPT+TUNNEL; prio: 24,24; interface: eth1.7; 000 "conn102": newest ISAKMP SA: #17; newest IPsec SA: #19; 000 "conn102": IKE proposal: 3DES_CBC/HMAC_SHA1/MODP_1024 000 "conn102": ESP proposal: 3DES_CBC/HMAC_SHA1/ 000 "conn103": 80.80.80.0/24===80.80.80.3[CN=FTM/Flexi Node SerialNo#L9080200062]:1/0...80.80.80.8[80.80.80.8]:1/0===80.80.80.0/24; erouted; eroute owner: #20 000 "conn103": CAs: "C=de, O=NSN DUS, CN=NSN DUS Test Root CA"...%any 000 "conn103": ike_life: 83376s; ipsec_life: 86400s; rekey_margin: 180s; rekey_fuzz: 50%; keyingtries: 0 000 "conn103": dpd_action: restart; dpd_delay: 10s; dpd_timeout: 120s; 000 "conn103": policy: PUBKEY+ENCRYPT+TUNNEL; prio: 24,24; interface: eth1.8; 000 "conn103": newest ISAKMP SA: #18; newest IPsec SA: #20; 000 "conn103": IKE proposal: 3DES_CBC/HMAC_SHA1/MODP_1024 000 "conn103": ESP proposal: 3DES_CBC/HMAC_SHA1/ 000 000 #19: "conn102" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 85237s; newest IPSEC; eroute owner 000 #19: "conn102" esp.c0730864@70.70.70.8 (0 bytes) esp.c5b98679@70.70.70.3 (0 bytes); tunnel 000 #17: "conn102" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 82212s; newest ISAKMP; DPD active 000 #12: "conn102" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 85116s 000 #12: "conn102" esp.c9cdb2c0@70.70.70.8 (0 bytes) esp.c01c41e1@70.70.70.3 (0 bytes); tunnel 000 #10: "conn102" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 82090s; DPD active 000 #8: "conn102" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 85105s 000 #8: "conn102" esp.c9689d82@70.70.70.8 (0 bytes) esp.ca8a1077@70.70.70.3 (0 bytes); tunnel 000 #6: "conn102" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 82079s; DPD active 000 #4: "conn102" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 85094s 000 #4: "conn102" esp.cd75c3e2@70.70.70.8 (0 bytes) esp.c0d75d25@70.70.70.3 (0 bytes); tunnel 000 #2: "conn102" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 82069s; DPD active 000 #7: "conn103" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 85104s 000 #7: "conn103" esp.c834a13c@80.80.80.8 (0 bytes) esp.cc20247d@80.80.80.3 (0 bytes); tunnel 000 #5: "conn103" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 82079s; DPD active 000 #3: "conn103" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 85094s 000 #3: "conn103" esp.cfe2307d@80.80.80.8 (0 bytes) esp.c5cefe5d@80.80.80.3 (0 bytes); tunnel 000 #1: "conn103" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 82068s; DPD active 000 #20: "conn103" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 85237s; newest IPSEC; eroute owner 000 #20: "conn103" esp.c05e9af0@80.80.80.8 (0 bytes) esp.c7567032@80.80.80.3 (0 bytes); tunnel 000 #18: "conn103" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 82213s; newest ISAKMP; DPD active 000 #11: "conn103" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 85115s 000 #11: "conn103" esp.c171aa8d@80.80.80.8 (0 bytes) esp.c26518b7@80.80.80.3 (0 bytes); tunnel 000 #9: "conn103" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 82090s; DPD active 000 Status of IKEv2 charon daemon (strongSwan 4.6.2): uptime: 25 minutes, since Jul 16 11:38:02 2012 malloc: sbrk 135168, mmap 0, used 94136, free 41032 worker threads: 8 of 16 idle, 7/1/0/0 working, job queue: 0/0/0/0, scheduled: 41 loaded plugins: aes des sha1 sha2 md5 random x509 revocation constraints pubkey pkcs1 pkcs8 pgp pem fips-prf gmp xcbc hmac attr kernel-netlink resolve socket-raw stroke updown Listening IP addresses: 10.10.10.6 10.125.40.64 192.168.122.1 30.30.30.3 60.60.60.3 70.70.70.3 80.80.80.3 90.90.90.3 95.95.95.3 Connections: conn100: 30.30.30.3...30.30.30.8, dpddelay=10s conn100: local: [CN=FTM/Flexi Node SerialNo#L9080200062] uses public key authentication conn100: cert: "CN=FTM/Flexi Node SerialNo#L9080200062" conn100: remote: [%any] uses any authentication conn100: child: 30.30.30.0/24[tcp] === 30.30.30.0/24[tcp] TUNNEL, dpdaction=restart conn101: 60.60.60.3...60.60.60.8, dpddelay=10s conn101: local: [CN=FTM/Flexi Node SerialNo#L9080200062] uses public key authentication conn101: cert: "CN=FTM/Flexi Node SerialNo#L9080200062" conn101: remote: [%any] uses any authentication conn101: child: 60.60.60.0/24[udp] === 60.60.60.0/24[udp/gtp-user] TUNNEL, dpdaction=restart Security Associations (6 up, 0 connecting): conn100[10]: ESTABLISHED 17 minutes ago, 30.30.30.3[CN=FTM/Flexi Node SerialNo#L9080200062]...30.30.30.8[CN=FTM/Flexi Node SerialNo#L9080200062] conn100[10]: IKE SPIs: 54b1ae5e43f31a1e_i* 1c318a600337df1a_r, rekeying in 22 hours conn100[10]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024 conn100{9}: INSTALLED, TUNNEL, ESP SPIs: cbddd69f_i c170e5ca_o conn100{9}: 3DES_CBC/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 23 hours conn100{9}: 30.30.30.0/24[tcp] === 30.30.30.0/24[tcp] conn101[11]: ESTABLISHED 17 minutes ago, 60.60.60.3[CN=FTM/Flexi Node SerialNo#L9080200062]...60.60.60.8[CN=FTM/Flexi Node SerialNo#L9080200062] conn101[11]: IKE SPIs: 9c3a414fc4e11c54_i* faa4f2421c5d162c_r, rekeying in 22 hours conn101[11]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024 conn101{10}: INSTALLED, TUNNEL, ESP SPIs: c9385798_i c8d5ad33_o conn101{10}: 3DES_CBC/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 23 hours conn101{10}: 60.60.60.0/24[udp] === 60.60.60.0/24[udp/gtp-user] conn100[12]: ESTABLISHED 17 minutes ago, 30.30.30.3[CN=FTM/Flexi Node SerialNo#L9080200062]...30.30.30.8[CN=FTM/Flexi Node SerialNo#L9080200062] conn100[12]: IKE SPIs: 81a461421245a3b3_i* 7142ab19227b5f70_r, rekeying in 22 hours conn100[12]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024 conn100{11}: INSTALLED, TUNNEL, ESP SPIs: c16f4e5f_i c0b95cbd_o conn100{11}: 3DES_CBC/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 23 hours conn100{11}: 30.30.30.0/24[tcp] === 30.30.30.0/24[tcp] conn101[13]: ESTABLISHED 17 minutes ago, 60.60.60.3[CN=FTM/Flexi Node SerialNo#L9080200062]...60.60.60.8[CN=FTM/Flexi Node SerialNo#L9080200062] conn101[13]: IKE SPIs: 75090c27b6277233_i* 6a4bceff45ca376a_r, rekeying in 22 hours conn101[13]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024 conn101{12}: INSTALLED, TUNNEL, ESP SPIs: c3c934ad_i ca4516f3_o conn101{12}: 3DES_CBC/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 23 hours conn101{12}: 60.60.60.0/24[udp] === 60.60.60.0/24[udp/gtp-user] conn101[14]: ESTABLISHED 17 minutes ago, 60.60.60.3[CN=FTM/Flexi Node SerialNo#L9080200062]...60.60.60.8[CN=FTM/Flexi Node SerialNo#L9080200062] conn101[14]: IKE SPIs: 64a6908304f58965_i* 286a73fd58252a71_r, rekeying in 22 hours conn101[14]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024 conn101{13}: INSTALLED, TUNNEL, ESP SPIs: c676e71d_i c4a02263_o conn101{13}: 3DES_CBC/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 23 hours conn101{13}: 60.60.60.0/24[udp] === 60.60.60.0/24[udp/gtp-user] conn100[15]: ESTABLISHED 17 minutes ago, 30.30.30.3[CN=FTM/Flexi Node SerialNo#L9080200062]...30.30.30.8[CN=FTM/Flexi Node SerialNo#L9080200062] conn100[15]: IKE SPIs: cce694110ac39415_i* 7ec537256f336275_r, rekeying in 22 hours conn100[15]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024 conn100{14}: INSTALLED, TUNNEL, ESP SPIs: c00e7707_i ca240122_o conn100{14}: 3DES_CBC/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 23 hours conn100{14}: 30.30.30.0/24[tcp] === 30.30.30.0/24[tcp]