<html><body><div style="color:#000; background-color:#fff; font-family:lucida console, sans-serif;font-size:12pt"><div></div><span><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style='color: black; font-family: "Comic Sans MS"; font-size: 10pt; mso-bidi-font-family: Arial;'>Hi Martin,<o:p></o:p></span></div><div><font face="Times New Roman">
</font></div><div style="margin: 0in 0in 10pt;"><span style='color: black; font-family: "Comic Sans MS"; font-size: 10pt; mso-bidi-font-family: Arial;'>I really appreciate yours instant response. I modified
the strongswan codes to set the value of /proc/sys/net/core/xfrm_acq_expires to
1000 seconds (kernel_netlink_ipsec.c) instead of 165 seconds. </span><span style='font-family: "Comic Sans MS"; font-size: 10pt; mso-bidi-font-family: Arial;'><o:p></o:p></span></div><div><font face="Times New Roman">
</font></div><div><span style='color: black; font-family: "Comic Sans MS"; font-size: 10pt; mso-bidi-font-family: Arial;'>Thereafter I tested in 600 IPsec connections (with modified
code) for 8 times without any issue. Always, it could able bring up all the 600
tunnels at both sides (IKE initiator and responder). Thereafter I increased the
connections from 600 to 1000 and run the scenario four times. In first couple
of runs, <span style="mso-spacerun: yes;"> </span>all the IKE/child SAs were
created successfully. <span style="mso-spacerun: yes;"> </span>I mean to say, <span style="mso-spacerun: yes;"> </span>I used the “#ip xfrm state count” command at
both ends and <span style="mso-spacerun: yes;"> </span>found the SAD count to be 2000.
But in 3<sup>rd</sup> <sup><span style="mso-spacerun: yes;"> </span></sup>and 4<sup>th</sup>
<span style="mso-spacerun: yes;"> </span>run, <span style="mso-spacerun: yes;"> </span>the SAD count was 1788 SAD and 1664. Note that, after
each run, I do #ipsec stop and then #ipsec start command.<o:p></o:p></span></div><div><font face="Times New Roman">
</font></div><div><span style='color: black; font-family: "Comic Sans MS"; font-size: 10pt; mso-bidi-font-family: Arial;'>Then I reduced the connections from 1000 to 600 and run. Surprisingly
this time, I found only 934 SAD counts where I was expecting 1200. <span style="mso-spacerun: yes;"> </span>What I observe/notice, once it fails, it does
not recover and starts failing. Do I have to tune <span style="mso-spacerun: yes;"> </span>“xfrm_acq_expires” parameter with different
values and see which value suits to our setup? Please clarify.<o:p></o:p></span></div><div><font face="Times New Roman">
</font></div><div><span style='color: black; font-family: "Comic Sans MS"; font-size: 10pt; mso-bidi-font-family: Arial;'>Thanks again for your suggestion.<o:p></o:p></span></div><div><font face="Times New Roman">
</font></div><div><span style='color: black; font-family: "Comic Sans MS"; font-size: 10pt; mso-bidi-font-family: Arial;'>Regards,<o:p></o:p></span></div><div><font face="Times New Roman">
</font></div><div><span style='color: black; font-family: "Comic Sans MS"; font-size: 10pt; mso-bidi-font-family: Arial;'>Chinmaya<o:p></o:p></span></div><div><font face="Times New Roman">
</font></div></span><div></div><div><br></div> <div style="font-family: lucida console, sans-serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <div class="hr" style="margin: 5px 0px; padding: 0px; border: 1px solid rgb(204, 204, 204); height: 0px; line-height: 0; font-size: 0px;" contenteditable="false" readonly="true"></div> <font face="Arial" size="2"> <b><span style="font-weight: bold;">From:</span></b> Martin Willi <martin@strongswan.org><br> <b><span style="font-weight: bold;">To:</span></b> Chinmaya Dwibedy <ckdwibedy@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "users@lists.strongswan.org" <users@lists.strongswan.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Thursday, August 8, 2013 1:47 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [strongSwan] IPsec/IKEv2 tunnels scalability issue with
load-tester plugin (using strongSwan 5.0.4)<br> </font> </div> <div class="y_msg_container"><br>
<br>> I modified the strongswan codes to set the soft_add_expires_seconds,<br>> hard_add_expires_seconds, soft_use_expires_seconds and<br>> hard_use_expires_seconds to 86400 seconds (i.e., 24 hours) in add_sa()<br>> (kernel_netlink_ipsec.c).<br><br>Maybe I was not clear enough: my suggestion was to change the value<br>of /proc/sys/net/core/xfrm_acq_expires. This is set on line 2669 of<br>kernel_netlink_ipsec.c.<br><br>Should the IKE_AUTH exchange take longer than 165s, the kernel will<br>remove the SA larval created during SPI allocation, and the installation<br>of the negotiated SA fails.<br><br>Regards<br>Martin<br><br><br><br></div> </div> </div> </div></body></html>