<div dir="ltr">Hello,<div>I have the following configuration for L2TP connection used by Android phone:</div><div><br></div><div><div>config setup</div><div> plutostart=yes</div><div> plutodebug="control controlmore"</div>
<div> charonstart=yes</div><div> nocrsend=yes</div><div> nat_traversal=yes</div><div> virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12</a></div>
<div><br></div><div>conn %default</div><div> ikelifetime=60m</div><div> keylife=20m</div><div> rekeymargin=3m</div><div> keyingtries=%forever</div><div> authby=secret</div><div> mobike=no</div>
</div><div><br></div><div><br></div><div><div>conn L2TP</div><div> authby=secret</div><div> auto=add</div><div> rekey=no</div><div> pfs=no</div><div> type=transport</div><div> forceencaps=yes</div>
<div> compress=yes</div><div> left=212.25.51.133</div><div> leftnexthop=212.25.51.1</div><div> leftprotoport=17/1701</div><div> right=%any</div><div> rightprotoport=17/%any</div>
<div>
rightsubnet=vhost:%no,%priv</div><div> keyexchange=ikev1</div><div> dpdaction=clear</div><div> dpdtimeout=60</div><div> dpddelay=10</div></div><div><br></div><div style>Phone connects OK. But when phone is disconnected, SA stays indefinitely. With my configuration it should remove SA association in 60seconds or so, but it stays like this:</div>
<div style><br></div><div style><div>000 "L2TP": 212.25.51.133[212.25.51.133]:17/1701---212.25.51.1...%virtual[%any]:17/%any===?; unrouted; eroute owner: #0</div><div>000 "L2TP": ike_life: 3600s; ipsec_life: 1200s; rekey_margin: 180s; rekey_fuzz: 100%; keyingtries: 0</div>
<div>000 "L2TP": dpd_action: clear; dpd_delay: 10s; dpd_timeout: 60s;</div><div>000 "L2TP": policy: PSK+ENCRYPT+COMPRESS+DONTREKEY; prio: 32,32; interface: eth1; </div><div>000 "L2TP": newest ISAKMP SA: #0; newest IPsec SA: #0; </div>
<div>000 "L2TP"[2]: 212.25.51.133:4500[212.25.51.133]:17/1701---212.25.51.1...213.226.63.142:33677[10.181.105.171]:17/0; unrouted; eroute owner: #0</div><div>000 "L2TP"[2]: ike_life: 3600s; ipsec_life: 1200s; rekey_margin: 180s; rekey_fuzz: 100%; keyingtries: 0</div>
<div>000 "L2TP"[2]: dpd_action: clear; dpd_delay: 10s; dpd_timeout: 60s;</div><div>000 "L2TP"[2]: policy: PSK+ENCRYPT+COMPRESS+DONTREKEY; prio: 32,32; interface: eth1; </div><div>000 "L2TP"[2]: newest ISAKMP SA: #1; newest IPsec SA: #0; </div>
<div>000 "L2TP"[2]: IKE proposal: 3DES_CBC/HMAC_SHA1/MODP_1024</div><div>000 </div><div>000 #341: "L2TP"[2] <a href="http://213.226.63.142:33677">213.226.63.142:33677</a> STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT in 39s</div>
<div>000 #1: "L2TP"[2] <a href="http://213.226.63.142:33677">213.226.63.142:33677</a> STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_EXPIRE in 3972s; newest ISAKMP</div><div><br></div><div style>When I look on tcpdump on udp ports 500/4500, I see no packets(DPD) from IPSec gateway, to remote device (Android).</div>
<div style>Is this a bug, or I have misconfigured something? Thank you.</div></div></div>