<div>Hi</div>
<div> </div>
<div>i don't know whether the following info would help in solving the issue. But have a look at the reauth option anyway as adviced by Tobias. I don't recall the post in which this reply was given...i kept it for reference...</div>
<div> </div>
<div>when i saw that your log shows mutiple child-sa's...i thought maybe this solve it</div>
<div>-------------------------------------------------------------------------------------------------------------------</div>
<div> </div>
<div>> conn toevm2-psk<br>> ...<br>> auto=route</div>
<div>The problem is the combination of auto=route and reauth=yes (which is<br>the default). With reauth=yes the IKE_SA is not rekeyed but<br>reauthenticated. This means that the IKE_SA is first deleted and then<br>reestablished. During this (albeit short) downtime there is no IPsec SA<br>
installed in the Linux kernel. That is, the policy that is installed<br>with auto=route has now no IPsec SA associated with it, so any matching<br>traffic will trigger another acquire from the kernel. This makes charon<br>
queue a CREATE_CHILD_SA exchange which it handles after the IKE_SA is<br>reestablished - together with all previously established CHILD_SAs. So<br>you eventually end up with an additional CHILD_SA for each acquire that<br>
fires during a reauthentication phase.</div>
<div>To fix this simply set reauth=no which causes charon to do a regular<br>rekey of the IKE_SA without deleting it and the installed IPsec SAs first.</div>
<div>Regards,<br>Tobias</div>
<div>...</div>
<div>...</div>
<div>------------------------------------------------------------------------</div>
<div> </div>
<div>thanks</div>
<div><br><br> </div>
<div class="gmail_quote">On Thu, May 30, 2013 at 3:13 PM, Alan Ford <span dir="ltr"><<a href="mailto:alan.ford@gmail.com" target="_blank">alan.ford@gmail.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">
<div dir="ltr">Hi all,
<div><br></div>
<div>Nobody's replied to this issue or my other, similar asymmetry issue (<a href="https://lists.strongswan.org/pipermail/users/2013-May/009245.html" target="_blank">https://lists.strongswan.org/pipermail/users/2013-May/009245.html</a>).</div>
<div><br></div>
<div>Really hoping someone could give me some pointers here on how this could be further debugged... Is there anything else I can look at here, or should be doing?</div>
<div><br></div>
<div>Many thanks,</div>
<div>Alan
<div>
<div class="h5"><br>
<div class="gmail_extra"><br><br>
<div class="gmail_quote">On 20 May 2013 13:57, Alan Ford <span dir="ltr"><<a href="mailto:alan.ford@gmail.com" target="_blank">alan.ford@gmail.com</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT:rgb(204,204,204) 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">
<div dir="ltr">
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">Hello,</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">I am having some strange issues with IPSec tunnels failing after an IKE SA rekey. charon rekeys an IKE SA and then ends up with different policy and multiple Child SAs on each host, thus leading to no traffic possible between them. This resolves itself after another IKE SA rekey. This issue happens about once a week or so. I am wondering if this is a known bug, an unknown bug, or user error. I am using the most recent Debian unstable strongSwan (4.6.4). Details below…</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">My ipsec.conf is trivial on box2 (and mirror left/right on box1)</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">conn %default</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> left=10.1.1.2</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> leftcert=cert.pem</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> right=10.1.1.1</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> rightca=%same</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> auto=route</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> type=transport</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> mobike=no</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> ike=aes256-sha512-modp4096!</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> esp=aes256-sha512-modp4096!</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> keyingtries=%forever</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">To work through an example. Prior to the rekey, we had this configuration:</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">Box 1:</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2[17]: ESTABLISHED 2 hours ago, 10.1.1.1[10.1.1.1]...10.1.1.2[10.1.1.1.2]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2[17]: IKE SPIs: 24606edaf5e07323_i* edb04d3909a6a051_r, public key reauthentication in 11 minutes</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2[17]: IKE proposal: AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2{18}: INSTALLED, TRANSPORT, ESP SPIs: ca5076a9_i ce4154d9_o</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2{18}: AES_CBC_256/HMAC_SHA2_512_256, 314243 bytes_i (0s ago), 117352 bytes_o (1s ago), rekeying in 34 minutes</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2{18}: <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a> === <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a></p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">(ip xfrm policy)</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">src <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> dst <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> dir in priority 1795</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> tmpl src 0.0.0.0 dst 0.0.0.0</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> proto esp reqid 18 mode transport</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">src <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a> dst <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> dir out priority 1795</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> tmpl src 0.0.0.0 dst 0.0.0.0</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> proto esp reqid 18 mode transport</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">Box 2:</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">(ipsec statusall)</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1[17]: ESTABLISHED 2 hours ago, 10.1.1.2[10.1.1.2]...10.1.1.1[10.1.1.1]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1[17]: IKE SPIs: 24606edaf5e07323_i edb04d3909a6a051_r*, public key reauthentication in 20 minutes</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1[17]: IKE proposal: AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1{15}: INSTALLED, TRANSPORT, ESP SPIs: ce4154d9_i ca5076a9_o</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1{15}: AES_CBC_256/HMAC_SHA2_512_256, 116893 bytes_i (0s ago), 333125 bytes_o (1s ago), rekeying in 30 minutes</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1{15}: <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> === <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a></p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">(ip xfrm policy)</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">src <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> dst <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> dir in priority 1795</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> tmpl src 0.0.0.0 dst 0.0.0.0</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> proto esp reqid 15 mode transport</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">src <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a> dst <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> dir out priority 1795</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> tmpl src 0.0.0.0 dst 0.0.0.0</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> proto esp reqid 15 mode transport</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">Then an IKE rekey happened, and we ended up with:</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">Box 1:</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">(ipsec statusall)</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2[21]: ESTABLISHED 8 minutes ago, 10.1.1.1[10.1.1.1]...10.1.1.2[10.1.1.1.2]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2[21]: IKE SPIs: 0bb3104f1e3a8c8f_i* c0d5c74941b82678_r, public key reauthentication in 2 hours</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2[21]: IKE proposal: AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2{25}: INSTALLED, TRANSPORT, ESP SPIs: c9744ff1_i c1dc0653_o</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2{25}: AES_CBC_256/HMAC_SHA2_512_256, 130 bytes_i (1s ago), 66 bytes_o (1s ago), rekeying in 33 minutes</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2{25}: <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a> === <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2{26}: INSTALLED, TRANSPORT, ESP SPIs: c325ac33_i c58ecbc2_o</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2{26}: AES_CBC_256/HMAC_SHA2_512_256, 207339 bytes_i (1s ago), 0 bytes_o, rekeying in 37 minutes</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2{26}: <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a> === <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2{6}: INSTALLED, TRANSPORT, ESP SPIs: ce41cacc_i c24af98a_o</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2{6}: AES_CBC_256/HMAC_SHA2_512_256, 0 bytes_i, 59138 bytes_o (1s ago), rekeying in 35 minutes</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box2{6}: <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a> === <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a></p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">(ip xfrm policy)</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">src <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> dst <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> dir in priority 1795</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> tmpl src 0.0.0.0 dst 0.0.0.0</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> proto esp reqid 6 mode transport</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">src <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a> dst <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> dir out priority 1795</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> tmpl src 0.0.0.0 dst 0.0.0.0</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> proto esp reqid 6 mode transport</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">Box 2:</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">(ipsec statusall)</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1[20]: ESTABLISHED 8 minutes ago, 10.1.1.2[10.1.1.2]...10.1.1.1[10.1.1.1]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1[20]: IKE SPIs: 0bb3104f1e3a8c8f_i c0d5c74941b82678_r*, public key reauthentication in 2 hours</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1[20]: IKE proposal: AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1{20}: INSTALLED, TRANSPORT, ESP SPIs: c1dc0653_i c9744ff1_o</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1{20}: AES_CBC_256/HMAC_SHA2_512_256, 66 bytes_i (1s ago), 130 bytes_o (1s ago), rekeying in 40 minutes</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1{20}: <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> === <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1{21}: INSTALLED, TRANSPORT, ESP SPIs: c24af98a_i ce41cacc_o</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1{21}: AES_CBC_256/HMAC_SHA2_512_256, 59138 bytes_i (1s ago), 0 bytes_o, rekeying in 34 minutes</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1{21}: <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> === <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1{3}: INSTALLED, TRANSPORT, ESP SPIs: c58ecbc2_i c325ac33_o</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1{3}: AES_CBC_256/HMAC_SHA2_512_256, 0 bytes_i, 207570 bytes_o (1s ago), rekeying in 40 minutes</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">box1{3}: <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> === <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a></p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">(ip xfrm policy)</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">src <a href="http://10.44.99.2/32" target="_blank">10.44.99.2/32</a> dst <a href="http://10.47.2.43/32" target="_blank">10.47.2.43/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> dir in priority 1795</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> tmpl src 0.0.0.0 dst 0.0.0.0</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> proto esp reqid 3 mode transport</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">src <a href="http://10.47.2.43/32" target="_blank">10.47.2.43/32</a> dst <a href="http://10.44.99.2/32" target="_blank">10.44.99.2/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> dir out priority 1795</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> tmpl src 0.0.0.0 dst 0.0.0.0</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"> proto esp reqid 3 mode transport</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">So as can be seen, Box 1 thinks it should be using the SPIs child SA {6}, whereas Box 2 thinks it should be using those of {3} - the packet counters show how one is receiving only and the other is sending only. So no traffic is possible between the boxes.</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">The syslogs on each box read:</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">Box 1:</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.896+00:00 box1 charon: 05[IKE] reauthenticating IKE_SA box2[17]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.896+00:00 box1 charon: 05[IKE] deleting IKE_SA box2[17] between 10.1.1.1[10.1.1.1]...10.1.1.2[10.1.1.2]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.896+00:00 box1 charon: 05[IKE] sending DELETE for IKE_SA box2[17]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.896+00:00 box1 charon: 05[ENC] generating INFORMATIONAL request 8 [ D ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.896+00:00 box1 charon: 05[NET] sending packet: from 10.1.1.1[500] to 10.1.1.2[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.971+00:00 box1 charon: 15[NET] received packet: from 10.1.1.2[500] to 10.1.1.1[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.971+00:00 box1 charon: 15[ENC] parsed INFORMATIONAL response 8 [ ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.971+00:00 box1 charon: 15[IKE] IKE_SA deleted</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.971+00:00 box1 charon: 15[IKE] restarting CHILD_SA box2</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.971+00:00 box1 charon: 15[IKE] initiating IKE_SA box2[21] to 10.1.1.2</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.019+00:00 box1 charon: 15[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.019+00:00 box1 charon: 15[NET] sending packet: from 10.1.1.1[500] to 10.1.1.2[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.145+00:00 box1 charon: 02[KNL] creating acquire job for policy <a href="http://10.1.1.1/32%5Budp/8005%5D" target="_blank">10.1.1.1/32[udp/8005]</a> === <a href="http://10.1.1.2/32%5Budp/8005%5D" target="_blank">10.1.1.2/32[udp/8005]</a> with reqid {6}</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.196+00:00 box1 charon: 16[NET] received packet: from 10.1.1.2[500] to 10.1.1.1[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.196+00:00 box1 charon: 16[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.244+00:00 box1 charon: 16[IKE] received cert request for "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.244+00:00 box1 charon: 16[IKE] sending cert request for "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.257+00:00 box1 charon: 16[IKE] authentication of '10.1.1.1' (myself) with RSA signature successful</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.257+00:00 box1 charon: 16[IKE] sending end entity cert "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.257+00:00 box1 charon: 16[IKE] establishing CHILD_SA box2</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.257+00:00 box1 charon: 16[ENC] generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH N(USE_TRANSP) SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.257+00:00 box1 charon: 16[NET] sending packet: from 10.1.1.1[500] to 10.1.1.2[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.334+00:00 box1 charon: 13[NET] received packet: from 10.1.1.2[500] to 10.1.1.1[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.334+00:00 box1 charon: 13[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH N(USE_TRANSP) SA TSi TSr N(AUTH_LFT) ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[IKE] received end entity cert "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[CFG] using certificate "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[CFG] using trusted ca certificate "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[CFG] checking certificate status of "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[CFG] certificate status is not available </p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[CFG] reached self-signed root ca with a path length of 0</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[IKE] authentication of '10.1.1.2' with RSA signature successful</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[IKE] IKE_SA box2[21] established between 10.1.1.1[10.1.1.1]...10.1.1.2[10.1.1.2]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[IKE] scheduling reauthentication in 9742s</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[IKE] maximum IKE_SA lifetime 10282s</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[IKE] CHILD_SA box2{25} established with SPIs c9744ff1_i c1dc0653_o and TS <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a> === <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> </p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[IKE] received AUTH_LIFETIME of 10047s, scheduling reauthentication in 9507s</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.335+00:00 box1 charon: 13[IKE] establishing CHILD_SA box2{6}</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.383+00:00 box1 charon: 13[ENC] generating CREATE_CHILD_SA request 2 [ N(USE_TRANSP) SA No KE TSi TSr ] </p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.383+00:00 box1 charon: 13[NET] sending packet: from 10.1.1.1[500] to 10.1.1.2[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.396+00:00 box1 charon: 10[NET] received packet: from 10.1.1.2[500] to 10.1.1.1[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.396+00:00 box1 charon: 10[ENC] parsed CREATE_CHILD_SA request 0 [ N(USE_TRANSP) SA No KE TSi TSr ] </p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.493+00:00 box1 charon: 10[IKE] CHILD_SA box2{26} established with SPIs c325ac33_i c58ecbc2_o and TS <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a> === <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> </p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.493+00:00 box1 charon: 10[ENC] generating CREATE_CHILD_SA response 0 [ N(USE_TRANSP) SA No KE TSi TSr ] </p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.493+00:00 box1 charon: 10[NET] sending packet: from 10.1.1.1[500] to 10.1.1.2[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.563+00:00 box1 charon: 14[NET] received packet: from 10.1.1.2[500] to 10.1.1.1[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.563+00:00 box1 charon: 14[ENC] parsed CREATE_CHILD_SA response 2 [ N(USE_TRANSP) SA No KE TSi TSr ] </p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.611+00:00 box1 charon: 14[IKE] CHILD_SA box2{6} established with SPIs ce41cacc_i c24af98a_o and TS <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a> === <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> </p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">Box 2:</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.924+00:00 box2 charon: 15[NET] received packet: from 10.1.1.1[500] to 10.1.1.2[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.924+00:00 box2 charon: 15[ENC] parsed INFORMATIONAL request 8 [ D ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.924+00:00 box2 charon: 15[IKE] received DELETE for IKE_SA box1[17]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.924+00:00 box2 charon: 15[IKE] deleting IKE_SA box1[17] between 10.1.1.2[10.1.1.2]...10.1.1.1[10.1.1.1]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.924+00:00 box2 charon: 15[IKE] IKE_SA deleted</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.924+00:00 box2 charon: 15[ENC] generating INFORMATIONAL response 8 [ ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:35.924+00:00 box2 charon: 15[NET] sending packet: from 10.1.1.2[500] to 10.1.1.1[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.048+00:00 box2 charon: 14[NET] received packet: from 10.1.1.1[500] to 10.1.1.2[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.048+00:00 box2 charon: 14[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.048+00:00 box2 charon: 14[IKE] 10.1.1.1 is initiating an IKE_SA</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.169+00:00 box2 charon: 14[IKE] sending cert request for "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.169+00:00 box2 charon: 14[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.169+00:00 box2 charon: 14[NET] sending packet: from 10.1.1.2[500] to 10.1.1.1[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.288+00:00 box2 charon: 13[NET] received packet: from 10.1.1.1[500] to 10.1.1.2[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.288+00:00 box2 charon: 13[ENC] parsed IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH N(USE_TRANSP) SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.288+00:00 box2 charon: 13[IKE] received cert request for "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.288+00:00 box2 charon: 13[IKE] received end entity cert "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.288+00:00 box2 charon: 13[CFG] looking for peer configs matching 10.1.1.2[10.1.1.2]...10.1.1.1[10.1.1.1]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.288+00:00 box2 charon: 13[CFG] selected peer config 'box1'</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.288+00:00 box2 charon: 13[CFG] using certificate "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.288+00:00 box2 charon: 13[CFG] using trusted ca certificate "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.288+00:00 box2 charon: 13[CFG] checking certificate status of "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.288+00:00 box2 charon: 13[CFG] certificate status is not available</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.289+00:00 box2 charon: 13[CFG] reached self-signed root ca with a path length of 0</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.289+00:00 box2 charon: 13[IKE] authentication of '10.1.1.1' with RSA signature successful</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.298+00:00 box2 charon: 02[KNL] creating acquire job for policy <a href="http://10.1.1.2/32%5Budp/8005%5D" target="_blank">10.1.1.2/32[udp/8005]</a> === <a href="http://10.1.1.1/32%5Budp/8005%5D" target="_blank">10.1.1.1/32[udp/8005]</a> with reqid {3}</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.306+00:00 box2 charon: 13[IKE] authentication of '10.1.1.2' (myself) with RSA signature successful</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.306+00:00 box2 charon: 13[IKE] IKE_SA box1[20] established between 10.1.1.2[10.1.1.2]...10.1.1.1[10.1.1.1]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.306+00:00 box2 charon: 13[IKE] scheduling reauthentication in 10047s</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.306+00:00 box2 charon: 13[IKE] maximum IKE_SA lifetime 10587s</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.306+00:00 box2 charon: 13[IKE] sending end entity cert "..."</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.306+00:00 box2 charon: 13[IKE] CHILD_SA box1{20} established with SPIs c1dc0653_i c9744ff1_o and TS <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> === <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.306+00:00 box2 charon: 13[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH N(USE_TRANSP) SA TSi TSr N(AUTH_LFT) ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.306+00:00 box2 charon: 13[NET] sending packet: from 10.1.1.2[500] to 10.1.1.1[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.306+00:00 box2 charon: 10[IKE] establishing CHILD_SA box1{3}</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.368+00:00 box2 charon: 10[ENC] generating CREATE_CHILD_SA request 0 [ N(USE_TRANSP) SA No KE TSi TSr ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.368+00:00 box2 charon: 10[NET] sending packet: from 10.1.1.2[500] to 10.1.1.1[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.414+00:00 box2 charon: 05[NET] received packet: from 10.1.1.1[500] to 10.1.1.2[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.414+00:00 box2 charon: 05[ENC] parsed CREATE_CHILD_SA request 2 [ N(USE_TRANSP) SA No KE TSi TSr ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.536+00:00 box2 charon: 05[IKE] CHILD_SA box1{21} established with SPIs c24af98a_i ce41cacc_o and TS <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> === <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.536+00:00 box2 charon: 05[ENC] generating CREATE_CHILD_SA response 2 [ N(USE_TRANSP) SA No KE TSi TSr ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.536+00:00 box2 charon: 05[NET] sending packet: from 10.1.1.2[500] to 10.1.1.1[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.547+00:00 box2 charon: 11[NET] received packet: from 10.1.1.1[500] to 10.1.1.2[500]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.548+00:00 box2 charon: 11[ENC] parsed CREATE_CHILD_SA response 0 [ N(USE_TRANSP) SA No KE TSi TSr ]</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">2013-05-20T10:31:36.610+00:00 box2 charon: 11[IKE] CHILD_SA box1{3} established with SPIs c58ecbc2_i c325ac33_o and TS <a href="http://10.1.1.2/32" target="_blank">10.1.1.2/32</a> === <a href="http://10.1.1.1/32" target="_blank">10.1.1.1/32</a></p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">Does anybody have any idea what is going on here? This feels like a bug, but I have been unable to find anything in the mailing list archives discussing it.</p>
<p style="MARGIN:0px;MIN-HEIGHT:14px;FONT-FAMILY:Helvetica;FONT-SIZE:12px"><br></p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">Many thanks,</p>
<p style="MARGIN:0px;FONT-FAMILY:Helvetica;FONT-SIZE:12px">Alan</p>
<div><br></div></div></blockquote></div><br></div></div></div></div></div><br>_______________________________________________<br>Users mailing list<br><a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br></blockquote></div><br>