<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body smarttemplateinserted="true" text="#000000" bgcolor="#FFFFFF">
<div id="smartTemplate4-template">Can you give a working example using the uniqueids=no? I have tried this but end up with what appears to be multiple tunnels to the same endpoint after renegotiating the initial tunnel. I would imagine this would require
the use of dpd on strongSwan end, but have yet to have a successful trial without any downtime. Again, my check script seems to be the better alternative, but I am still giving way to a possible 59s downtime. and this is not a production solution.<br>
Assistance is greatly appreciated.<br>
<br>
Regards.<br>
Izz<br>
<br>
<b>Izz Abdullah</b><br>
<i>Senior Systems Engineer</i><br>
<a href="mailto:izz.abdullah@wepanow.com">Izz.Abdullah@wepanow.com</a><br>
<a class="moz-txt-link-abbreviated" href="http://www.wepanow.com">www.wepanow.com</a><br>
<div style="line-height:50%"><br>
</div>
</div>
<br>
<div id="smartTemplate4-quoteHeader">
<hr>
<br>
<b>From:</b> Izz Abdullah <a class="moz-txt-link-rfc2396E" href="mailto:izz.abdullah@wepanow.com">
<izz.abdullah@wepanow.com></a><br>
<b>Sent:</b> Monday, September 16, 2013 :06AM<br>
<b>To:</b> Martin Willi <a class="moz-txt-link-rfc2396E" href="mailto:martin@strongswan.org">
<martin@strongswan.org></a><br>
<b>Cc:</b> <a class="moz-txt-link-abbreviated" href="mailto:users@lists.strongswan.org">
users@lists.strongswan.org</a> <a class="moz-txt-link-rfc2396E" href="mailto:users@lists.strongswan.org">
<users@lists.strongswan.org></a><br>
<b>Subject: </b>Re: [strongSwan] site-to-site vpn tunnel drops exactly every 6 <br>
hours : StrongSwan <-> Cisco ASA<br>
<br>
</div>
<blockquote cite="mid:1t364a9idhgh4vbfurvbqkde.1379329525352@email.android.com" type="cite">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
<div>
<div>I thought that was the issue initially, and have posted on issue 317, I believe it is, but was second guessing myself once the lifetime of the peer has changed from 8 hours to 24.</div>
<div>Thank you Martin.</div>
<div><br>
</div>
<div><br>
</div>
--
<div><b><i>Izz</i></b></div>
<div><i>Sent using Android™</i></div>
<br>
<br>
<br>
-------- Original message --------<br>
From: Martin Willi <a class="moz-txt-link-rfc2396E" href="mailto:martin@strongswan.org">
<martin@strongswan.org></a> <br>
Date: 09/16/2013 2:55 AM (GMT-06:00) <br>
To: Izz Abdullah <a class="moz-txt-link-rfc2396E" href="mailto:izz.abdullah@wepanow.com">
<izz.abdullah@wepanow.com></a> <br>
Cc: <a class="moz-txt-link-abbreviated" href="mailto:users@lists.strongswan.org">
users@lists.strongswan.org</a> <br>
Subject: Re: [strongSwan] site-to-site vpn tunnel drops exactly every 6 hours : StrongSwan <-> Cisco ASA
<br>
<br>
<br>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Hi,<br>
<br>
> Sep 15 16:34:02 bhm-ipsec-221 charon: 16[ENC] parsed ID_PROT request 0 [ SA V V V V ]<br>
<br>
> Sep 15 16:34:02 bhm-ipsec-221 charon: 15[IKE] deleting duplicate IKE_SA for peer 'XXX.YYY.2.20' due to uniqueness policy<br>
> Sep 15 16:34:02 bhm-ipsec-221 charon: 15[IKE] deleting IKE_SA school-tunnel02[144] between 10.10.100.221[wepa]...XXX.YYY.2.20[XXX.YYY.2.20]<br>
> Sep 15 16:34:02 bhm-ipsec-221 charon: 15[IKE] sending DELETE for IKE_SA school-tunnel02[144]<br>
> Sep 15 16:34:02 bhm-ipsec-221 charon: 15[ENC] generating INFORMATIONAL_V1 request 3554893475 [ HASH D ]<br>
> Sep 15 16:34:02 bhm-ipsec-221 charon: 15[NET] sending packet: from 10.10.100.221[4500] to XXX.YYY.2.20[4500] (84 bytes)<br>
> Sep 15 16:34:02 bhm-ipsec-221 charon: 15[IKE] IKE_SA school-tunnel02[152] established between 10.10.100.221[wepa]...XXX.YYY.2.20[XXX.YYY.2.20]<br>
> Sep 15 16:34:02 bhm-ipsec-221 charon: 15[ENC] generating ID_PROT response 0 [ ID HASH ]<br>
> Sep 15 16:34:02 bhm-ipsec-221 charon: 15[NET] sending packet: from 10.10.100.221[4500] to XXX.YYY.2.20[4500] (68 bytes)<br>
> Sep 15 16:34:02 bhm-ipsec-221 charon: 14[NET] received packet: from XXX.YYY.2.20[4500] to 10.10.100.221[4500] (68 bytes)<br>
> Sep 15 16:34:02 bhm-ipsec-221 charon: 14[ENC] parsed INFORMATIONAL_V1 request 3654723502 [ HASH D ]<br>
> Sep 15 16:34:02 bhm-ipsec-221 charon: 14[IKE] received DELETE for ESP CHILD_SA with SPI aadc2798<br>
<br>
The peer tries to re-authenticate the ISAKMP SA. Due to your unique<br>
policy and a limitation of our new IKEv1 implementation, this leads to a<br>
problem: The uniqueness policy deletes the old ISAKMP during<br>
re-authentication before it can complete.<br>
<br>
This is a know issue, and I hope I'll find some time to fix this. In the<br>
mean time, you should consider setting uniqueids=no in ipsec.conf, have<br>
a look at the manpage for details.<br>
<br>
Regards<br>
Martin<br>
<br>
</div>
</span></font><br>
<fieldset class="mimeAttachmentHeader"></fieldset> <br>
<pre wrap="">_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>
<a class="moz-txt-link-freetext" href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a></pre>
</blockquote>
<br>
</body>
</html>