<div dir="ltr"><div>OK - I can reproduce this very easily. I believe this is either a config bug or an IKE bug.</div><div><br></div><div>Description: </div><div><div>When a new connection is added to the same server and ipsec is "reloaded" to bring in the new config the newly added connection can not be brought up (Inacceptable error). If however I just restart ipsec I can bring both connections up without any issue at all. It is only when a new connection is added and ipsec is reloaded does the error occur.</div>
<div><br></div><div>Here are the steps to reproduce the bug.</div><div><br></div><div>Step 1: Start with a single connection in Transport mode.</div><div><div><br></div><div>conn 1898.moon.0</div><div> left=%any</div><div>
leftid=sun</div><div> leftprotoport=6/1898</div><div> rightid=moon</div><div> right=10.216.63.253</div><div> rightprotoport=6/%any</div></div><div><br></div><div>Step 2: Bring up the connection with iperf or some other tool.</div>
<div><div>ipsec up 0.sun.1898</div><div>initiating IKE_SA 0.sun.1898[1] to 10.247.11.151</div><div>generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div><div>sending packet: from 10.216.63.253[500] to 10.247.11.151[500] (272 bytes)</div>
<div>received packet: from 10.247.11.151[500] to 10.216.63.253[500] (280 bytes)</div><div>parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]</div><div>remote host is behind NAT</div><div>authentication of 'moon' (myself) with pre-shared key</div>
<div>establishing CHILD_SA 0.sun.1898</div><div>generating IKE_AUTH request 1 [ IDi IDr AUTH N(USE_TRANSP) SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]</div><div>sending packet: from 10.216.63.253[4500] to 10.247.11.151[4500] (264 bytes)</div>
<div>received packet: from 10.247.11.151[4500] to 10.216.63.253[4500] (248 bytes)</div><div>parsed IKE_AUTH response 1 [ IDr AUTH N(USE_TRANSP) SA TSi TSr N(AUTH_LFT) ]</div><div>authentication of 'sun' with pre-shared key successful</div>
<div>IKE_SA 0.sun.1898[1] established between 10.216.63.253[moon]...10.247.11.151[sun]</div><div>scheduling reauthentication in 9810s</div><div>maximum IKE_SA lifetime 10350s</div><div>connection '0.sun.1898' established successfully</div>
</div><div><br></div><div>Step 3: Add another connection to the same server, but on a different port</div><div><div>conn 0.sun.1899</div><div> left=%any</div><div> leftid=moon</div><div> leftprotoport=6/%any</div><div>
rightid=sun</div><div> right=10.247.11.151</div><div> rightprotoport=6/1899</div></div><div><br></div><div>Step 4: Reload charon with ipsec reload command to pick up new config</div><div><br></div><div>Step 5: Try to bring up new connection and it fails with traffic selector unacceptable</div>
<div><div>ipsec up 0.sun.1899</div><div>establishing CHILD_SA 0.sun.1899</div><div>generating CREATE_CHILD_SA request 3 [ N(USE_TRANSP) SA No TSi TSr ]</div><div>sending packet: from 10.216.63.253[4500] to 10.247.11.151[4500] (216 bytes)</div>
<div>received packet: from 10.247.11.151[4500] to 10.216.63.253[4500] (88 bytes)</div><div>parsed CREATE_CHILD_SA response 3 [ N(TS_UNACCEPT) ]</div><div>received TS_UNACCEPTABLE notify, no CHILD_SA built</div><div>failed to establish CHILD_SA, keeping IKE_SA</div>
<div>establishing connection '0.sun.1899' failed</div></div><div><br></div><div>To get both connections to come up simply restart ipsec and both will come up without an issue.</div></div><div>This is either a configuration bug with reload or an IKE issue not seeing the new config from reload.</div>
<div><br></div><div><div>ipsec up 0.sun.1898</div><div>initiating IKE_SA 0.sun.1898[1] to 10.247.11.151</div><div>generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div><div>sending packet: from 10.216.63.253[500] to 10.247.11.151[500] (272 bytes)</div>
<div>received packet: from 10.247.11.151[500] to 10.216.63.253[500] (280 bytes)</div><div>parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]</div><div>remote host is behind NAT</div><div>authentication of 'moon' (myself) with pre-shared key</div>
<div>establishing CHILD_SA 0.sun.1898</div><div>generating IKE_AUTH request 1 [ IDi IDr AUTH N(USE_TRANSP) SA TSi TSr N(MULT_AUTH) N(EAP_ONLY) ]</div><div>sending packet: from 10.216.63.253[4500] to 10.247.11.151[4500] (264 bytes)</div>
<div>received packet: from 10.247.11.151[4500] to 10.216.63.253[4500] (248 bytes)</div><div>parsed IKE_AUTH response 1 [ IDr AUTH N(USE_TRANSP) SA TSi TSr N(AUTH_LFT) ]</div><div>authentication of 'sun' with pre-shared key successful</div>
<div>IKE_SA 0.sun.1898[1] established between 10.216.63.253[moon]...10.247.11.151[sun]</div><div>scheduling reauthentication in 10042s</div><div>maximum IKE_SA lifetime 10582s</div><div>connection '0.sun.1898' established successfully</div>
<div><br></div><div>ipsec up 0.sun.1899</div><div>establishing CHILD_SA 0.sun.1899</div><div>generating CREATE_CHILD_SA request 2 [ N(USE_TRANSP) SA No TSi TSr ]</div><div>sending packet: from 10.216.63.253[4500] to 10.247.11.151[4500] (216 bytes)</div>
<div>received packet: from 10.247.11.151[4500] to 10.216.63.253[4500] (216 bytes)</div><div>parsed CREATE_CHILD_SA response 2 [ N(USE_TRANSP) SA No TSi TSr ]</div><div>connection '0.sun.1899' established successfully</div>
</div><div><br></div><div><br></div><div>Here are my configs:</div><div><br></div><div><div># basic configuration</div><div>config setup</div><div> strictcrlpolicy=no</div><div> uniqueids = no</div><div> charondebug="ike 1, knl 1, cfg 1, chd 1"</div>
</div><div><br></div><div><div>conn %default</div><div> authby=secret</div><div> mobike=no</div><div> closeaction=none</div><div> dpdaction=clear</div><div> dpddelay=30s</div><div> dpdtimeout=150s</div><div> inactivity=30m</div>
<div> ikelifetime=3h</div><div> keyexchange=ikev2</div><div> keyingtries=3</div><div> lifetime=1h</div><div> reauth=yes</div><div> rekey=yes</div><div> margintime=9m</div><div> esp=aes256!</div><div> ike=aes256-sha384-prfsha384-ecp384!</div>
<div> forceencaps=yes</div><div> type=transport</div><div> auto=route</div></div><div><br></div><div><div><div>#</div><div>conn 0.sun.1898</div><div> left=%any</div><div> leftid=moon</div><div> leftprotoport=6/%any</div>
<div> rightid=sun</div><div> right=10.247.11.151</div><div> rightprotoport=6/1898</div><div>#</div><div># Add this second connection after bringing up the first and reload ipsec</div><div>#</div><div>#conn 0.sun.1899</div>
<div># left=%any</div><div># leftid=moon</div><div># leftprotoport=6/%any</div><div># rightid=sun</div><div># right=10.247.11.151</div><div># rightprotoport=6/1899</div></div></div><div><br></div><div><br></div></div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Aug 30, 2013 at 5:37 PM, Dan Cook <span dir="ltr"><<a href="mailto:onedsc@gmail.com" target="_blank">onedsc@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>I am trying to track down a connection issue and I tracked it down to an "inacceptable" traffic selector error on a transport connection with the route=auto. </div><div>What is very strange is I can bring the connection manually using the "ipsec up" command and the connection is established.</div>
<div><br></div><div>I am really stumped on this one... </div><div><br></div><div>I am using 5.1.0 in transport mode with the following config.</div><div><br></div><div><div># basic configuration</div><div>config setup</div>
<div> strictcrlpolicy=no</div><div> uniqueids = no</div><div><br></div></div><div>Here are my connection defaults:</div><div><div>
# Default connection attributes for ipsec.conf</div><div>#</div><div>conn %default</div><div> authby=secret</div><div> mobike=no</div><div> closeaction=none</div><div> dpdaction=clear</div><div> dpddelay=30s</div><div>
dpdtimeout=150s</div><div> inactivity=30m</div><div> ikelifetime=3h</div><div> keyexchange=ikev2</div><div> keyingtries=3</div><div> lifetime=1h</div><div> reauth=yes</div><div> rekey=yes</div><div> margintime=9m</div>
<div> esp=aes256!</div><div> ike=aes256-sha384-prfsha384-ecp384!</div><div> forceencaps=yes</div><div> type=transport</div><div> auto=route</div></div><div><br></div><div>Here is the connections in question:</div>
<div><div>conn 4.6.3000.10-98-108-194.0<br></div><div> left=%any</div><div> leftid=a27</div><div> leftprotoport=6/3000</div><div> rightid=a26</div><div> right=10.98.108.194</div><div> rightprotoport=6/%any</div></div>
<div><br></div><div>I should note there are other connections in transport mode to this server on port 80 and 3306 and they are connected without issue.</div><div><br></div><div>013-08-30T17:22:03-0700 01[MGR] checkout IKE_SA</div>
<div>2013-08-30T17:22:03-0700 01[MGR] IKE_SA 4.17.0.10-98-108-199.11211[6] successfully checked out</div><div>2013-08-30T17:22:03-0700 01[KNL] querying policy <a href="http://10.98.108.199/32%5Btcp/11211%5D" target="_blank">10.98.108.199/32[tcp/11211]</a> === <a href="http://10.98.108.195/32%5Btcp%5D" target="_blank">10.98.108.195/32[tcp]</a> in (mark 0/0x00000000)</div>
<div>2013-08-30T17:22:03-0700 01[MGR] checkin IKE_SA 4.17.0.10-98-108-199.11211[6]</div><div>2013-08-30T17:22:03-0700 01[MGR] check-in of IKE_SA successful.</div><div>2013-08-30T17:22:03-0700 09[NET] received packet: from 10.98.108.194[4500] to 10.98.108.195[4500]</div>
<div>2013-08-30T17:22:03-0700 09[NET] waiting for data on sockets</div><div>2013-08-30T17:22:03-0700 16[MGR] checkout IKE_SA by message</div><div>2013-08-30T17:22:03-0700 16[MGR] IKE_SA 4.6.80.10-98-108-194.0[5] successfully checked out</div>
<div>2013-08-30T17:22:03-0700 16[NET] received packet: from 10.98.108.194[4500] to 10.98.108.195[4500] (248 bytes)</div><div>2013-08-30T17:22:03-0700 16[ENC] parsed CREATE_CHILD_SA request 99 [ N(USE_TRANSP) SA No TSi TSr ]</div>
<div>2013-08-30T17:22:03-0700 16[CFG] looking for a child config for <a href="http://10.98.108.195/32%5Btcp/3000%5D" target="_blank">10.98.108.195/32[tcp/3000]</a> <a href="http://10.98.108.195/32%5Btcp/3000%5D" target="_blank">10.98.108.195/32[tcp/3000]</a> === <a href="http://10.98.108.194/32%5Btcp%5D" target="_blank">10.98.108.194/32[tcp]</a> <a href="http://10.98.108.194/32%5Btcp%5D" target="_blank">10.98.108.194/32[tcp]</a></div>
<div>2013-08-30T17:22:03-0700 16[CFG] looking for a child config for <a href="http://10.98.108.195/32%5Btcp/3000%5D" target="_blank">10.98.108.195/32[tcp/3000]</a> <a href="http://10.98.108.195/32%5Btcp/3000%5D" target="_blank">10.98.108.195/32[tcp/3000]</a> === <a href="http://10.98.108.194/32%5Btcp%5D" target="_blank">10.98.108.194/32[tcp]</a> <a href="http://10.98.108.194/32%5Btcp%5D" target="_blank">10.98.108.194/32[tcp]</a></div>
<div>2013-08-30T17:22:03-0700 16[IKE] traffic selectors <a href="http://10.98.108.195/32%5Btcp/3000%5D" target="_blank">10.98.108.195/32[tcp/3000]</a> <a href="http://10.98.108.195/32%5Btcp/3000%5D" target="_blank">10.98.108.195/32[tcp/3000]</a> === <a href="http://10.98.108.194/32%5Btcp%5D" target="_blank">10.98.108.194/32[tcp]</a> <a href="http://10.98.108.194/32%5Btcp%5D" target="_blank">10.98.108.194/32[tcp]</a> inacceptable</div>
<div>2013-08-30T17:22:03-0700 16[IKE] failed to establish CHILD_SA, keeping IKE_SA</div><div>2013-08-30T17:22:03-0700 16[ENC] generating CREATE_CHILD_SA response 99 [ N(TS_UNACCEPT) ]</div><div>2013-08-30T17:22:03-0700 16[NET] sending packet: from 10.98.108.195[4500] to 10.98.108.194[4500] (88 bytes)</div>
<div>2013-08-30T17:22:03-0700 06[NET] sending packet: from 10.98.108.195[4500] to 10.98.108.194[4500]</div><div>2013-08-30T17:22:03-0700 16[MGR] checkin IKE_SA 4.6.80.10-98-108-194.0[5]</div><div>2013-08-30T17:22:03-0700 16[MGR] check-in of IKE_SA successful. </div>
<div><br></div><div><div>Any suggestions as to why the connection will not come up by itself?</div></div><div><br></div><div>Regards, </div><span class="HOEnZb"><font color="#888888"><div>Dan Cook</div></font></span></div>
</blockquote></div><br></div>