<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body smarttemplateinserted="true" bgcolor="#FFFFFF" text="#000000">
<div id="smartTemplate4-template">I had some of the same problems you experienced. I will say with 5.0.4, there are issues with renegotiating (Issue 317 specifically) when a Cisco device is on the other side. I have since upgraded to 5.1.1 with the patch
and am still having the same issue, but have written scripts to get around it for now.<br>
As for the: Tasks Queued: Quick Mode<br>
I also experienced that in 5.1.1 and found out through some help on this list that I needed to add a new parameter, specifically with PIX on the other end,
<i>modeconfig=push</i> in my connection details for that specific connection. Everything else I kept the same. I now have a successfully established tunnel, I just don't have good routing due to NAT on both ends, but that is a problem I believe I need to
correct.<br>
Try the modeconfig parameter in your ipsec.conf in 5.1.1, and look at <a class="moz-txt-link-freetext" href="http://wiki.strongswan.org/issues/317">
http://wiki.strongswan.org/issues/317</a> specifically for an issue with renegotiations in earlier versions.<br>
<br>
I hope this info helps some. Otherwise please do post logs and we all will do our best to assist.<br>
<br>
Thanks,<br>
Izz <br>
<br>
<b>Izz Abdullah</b><br>
<i>Senior Systems Engineer</i><br>
800.675.7639 Toll Free<br>
<a class="moz-txt-link-abbreviated" href="http://www.wepanow.com">www.wepanow.com</a><br>
</div>
<br>
<div id="smartTemplate4-quoteHeader">
<hr>
<br>
<b>From:</b> Ali Masoudi <a class="moz-txt-link-rfc2396E" href="mailto:masoudi1983@gmail.com">
<masoudi1983@gmail.com></a><br>
<b>Sent:</b> Saturday, November 30, 2013 23:55<br>
<b>To:</b> Matus Straka <a class="moz-txt-link-rfc2396E" href="mailto:straka@ischemaview.com">
<straka@ischemaview.com></a><br>
<b>Cc:</b> <a class="moz-txt-link-abbreviated" href="mailto:users@lists.strongswan.org">
users@lists.strongswan.org</a><br>
<b>Subject: </b>Re: [strongSwan] Problems with StrongSwan 5.x and Cisco<br>
<br>
</div>
<blockquote cite="mid:CAAxMqJpqeX54b9PHNXU-Zq_NM4FXQybyDuF5hcGZiXr9Hen7Gg@mail.gmail.com" type="cite">
<div dir="ltr">
<div>
<div>Hi<br>
<br>
If you can post your logs here, that will be helpful.<br>
<br>
</div>
Best wishes<br>
</div>
Ali<br>
<div>
<div><br>
</div>
</div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Sun, Dec 1, 2013 at 12:37 AM, Matus Straka <span dir="ltr">
<<a moz-do-not-send="true" href="mailto:straka@ischemaview.com" target="_blank">straka@ischemaview.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Dear all,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I would like to ask for help/advice with StrongSWAN and Cisco VPN Devices:</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">We have had a setup with Centos 6.4 64bit Linux and Strongswan 4.6.4, other sites have Cisco gateways. I was able to configure the VPN tunnels just fine, using the examples on internet and parameters/PSK provided by our partners.</p>
<p class="MsoNormal">The setup worked fine for many months, with some occasional glitches (freezing of a tunnel).</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Today, I tried to upgrade to StrongSWAN 5.0.4 (packaged in Centos 6.4 repositories), and ended up with non-functioning system as described below. I tried then to upgrade to StrongSWAN 5.1.1 built from source, with the same results.</p>
<p class="MsoNormal">In the end, I downgraded back to StrongSWAN 4.6.4. and the setup works again.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><b>Our problems:</b></p>
<p class="MsoNormal"><b>With StrongSWAN 5.0.4 and 5.1.1, upon (re)starting the StrongSwan daemon, the creation of the tunnels stops at a certain point, and “ipsec statusall” says: “<i>Tasks queued: QUICK_MODE</i>” and it never gets past that point. The log
files then indicate that after 5 unsuccessful attempts the tunnel creation is stopped.
</b>With 4.6.4 it works without any issues.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">To the extent of my knowledge and expertise I tried to change/modify the parameters in the ipsec.conf file, and reviewed the log files available (pluto.log and charon.log), without any success.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">As my attempt to find any relevant information on internet failed (similar issues, configuration changes), I would like to kindly ask for help and assistance.</p>
<p class="MsoNormal">As the problem is straightly present for all 6 our remote sites, I suspect it is related to our side/configuration, and not to the other side (likely using different Cisco devices).</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">We will be thankful for any information.</p>
<p class="MsoNormal">Best regards,</p>
<p class="MsoNormal"> </p>
<div class="MsoNormal" style="text-align:center" align="center"><span>
<hr align="center" size="2" width="100%">
</span></div>
<p class="MsoNormal"><b><span style="font-size:10.0pt">Matus Straka, PhD</span></b></p>
<p class="MsoNormal"><b><i><span style="font-size:10.0pt;color:#7f7f7f">iSchemaView</span></i></b><i><span style="font-size:10.0pt"></span></i></p>
<p class="MsoNormal"><span style="font-size:9.0pt"> </span></p>
<p class="MsoNormal"><span style="font-size:9.0pt">E-Mail: <a moz-do-not-send="true" href="mailto:straka@ischemaview.com" target="_blank">
<span style="">mailto:straka@ischemaview.com</span></a></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt">iSchemaView, Inc., 323 Olmsted Rd, Stanford, CA 94305, USA</span></p>
<p class="MsoNormal"> </p>
</div>
</div>
<br>
_______________________________________________<br>
Users mailing list<br>
<a moz-do-not-send="true" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a><br>
<a moz-do-not-send="true" href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset> <br>
<pre wrap="">_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>
<a class="moz-txt-link-freetext" href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a></pre>
</blockquote>
<br>
</body>
</html>