<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 04/02/2014 09:30 AM, Andreas Steffen
wrote:<br>
</div>
<blockquote cite="mid:533BBC8A.6010802@strongswan.org" type="cite">Hi
Gupta,
<br>
<br>
if you are using the setkey command which is part of the
ipsec-tools
<br>
package to flush a CHILD_SA in the kernel then you cannot expect
the
<br>
strongSwan IKE daemon to take notice of this event.</blockquote>
<br>
The same seems to happen if you use the ip command (from iproute).<br>
<br>
ip x s deleteall reqid <reqid><br>
<br>
<blockquote cite="mid:533BBC8A.6010802@strongswan.org" type="cite">
If you want
<br>
an IKE DELETE notify message to be generated then you must take
down
<br>
the SA with the strongSwan command
<br>
<br>
sudo ipsec down <connection name>{<requid>}
<br>
<br>
Best regards
<br>
<br>
Andreas
<br>
<br>
On 02.04.2014 08:57, Gupta, Rohan 1. (NSN - IN/Bangalore) wrote:
<br>
<blockquote type="cite">Hi,
<br>
Recently during my testing of charon with strongswan version
4.3.1, I
<br>
observed that after establishment of the tunnel if I flush the
<br>
child_sa(or the phase 2 SA’s) using setkey –F the DELETE payload
is not
<br>
sent to the peer.
<br>
Due to this the peer doesn’t delete its child_sa and keeps on
sending
<br>
traffic with the old SA.
<br>
I have gone through the RFC and found the flowing line
<br>
“/If an IKE endpoint chooses to/
<br>
/ delete CHILD_SAs, it MUST send Delete payloads to the other
end/
<br>
/ notifying it of the deletion/”
<br>
Is the above statement applicable for this scenario?
<br>
Can anyone help on what might be wrong?
<br>
Thanks,
<br>
Rohan
<br>
<br>
<br>
_______________________________________________
<br>
Users mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>
<br>
<a class="moz-txt-link-freetext" href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a>
<br>
<br>
</blockquote>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>
<a class="moz-txt-link-freetext" href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a></pre>
</blockquote>
<br>
</body>
</html>