<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi, I'm running strongswan 5.1.1 in site-site configuration using NAT-T between 2 VMs where both hosts have been created from the same image. Both sites also have time synced using NTP.<br>
</p>
<p><br>
</p>
<p>Generally its working fine (although getting 5% packet loss when pinging) but periodically (daily) one or more tunnels seem to stop working. After some investigation, it seemed that these coincide with a rekey collision where both sides create a rekey jobs
at (to the nearest second) the same time. When this happens I dont see any specific errors in the logs. <br>
</p>
<p><br>
</p>
<p>The relevant config parameters are<br>
</p>
<p><br>
</p>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:16px; margin-top:0px; margin-bottom:0px">
<font face="Helvetica,Arial,sans-serif" size="2" color="#212121"><span style="font-size:15px"> ikelifetime=3h</span></font><font face="Helvetica,Arial,sans-serif" size="2" color="#212121"><span style="font-size:15px"><br>
keylife=1h</span></font><font face="Helvetica,Arial,sans-serif" size="2" color="#212121"><span style="font-size:15px"><br>
rekeymargin=9m</span></font><font face="Helvetica,Arial,sans-serif" size="2" color="#212121"><span style="font-size:15px"><br>
keyingtries=%forever</span></font></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:16px; margin-top:0px; margin-bottom:0px">
<font face="Helvetica,Arial,sans-serif" size="2" color="#212121"><span style="font-size:15px"> rekeyfuzz=100%</span></font><font face="Calibri,Arial,Helvetica,sans-serif" size="2" color="#212121"><span style="font-size:16px"></span></font><font face="Helvetica,Arial,sans-serif" size="2" color="#212121"><span style="font-size:15px"></span></font></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:16px; margin-top:0px; margin-bottom:0px">
<font face="Helvetica,Arial,sans-serif" size="2" color="#212121"><span style="font-size:15px"> reauth=no</span></font></div>
<p><br>
</p>
<p>So I have a few questions<br>
</p>
<p><br>
</p>
<p>1. Why do we keep seeing the collisions, surely the rekeyfuzz would make this pretty unlikely or does the way the host were built and/or time sync affect the randomness of rekeyfuzz?<br>
</p>
<p>2. When we get a collision why dont we see an error and why doesnt it retry given the keyingtries parameter?<br>
</p>
<p>3. Is it recommended that only one side should do rekeying (i.e. set rekey=no on the other)?<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p>Regards<br>
</p>
<p>Steve Lee<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<div id="Signature">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<div style="color:rgb(40,40,40); font-family:'Segoe UI WPC','Segoe UI',Tahoma,'Microsoft Sans Serif',Verdana,sans-serif; font-size:15px; background-color:rgb(255,255,255); margin:0px">
<div style="margin:0px"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt"><font size="4" face="Arial,sans-serif"><span style="font-size:16pt"><b>Steve Lee</b></span></font></span></font></div>
<div style="margin:0px"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt"><font size="2" face="Arial,sans-serif"><span style="font-size:10pt">Senior Architect</span></font></span></font></div>
<div style="margin:0px"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt"><font size="2" face="Arial,sans-serif"><span style="font-size:10pt">Phone: +44 (0)7474 647674</span></font></span></font></div>
<div style="margin:0px"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt"><a tabindex="0" href="http://www.zynstra.com/" target="_blank"><font size="2" face="Arial,sans-serif"><span style="font-size:10pt"><font color="#0563C1">www.zynstra.com</font></span></font></a></span></font></div>
<div style="margin:0px"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt"> </span></font><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt"> </span></font><span style="font-size:11pt; font-family:Calibri,sans-serif">
</span></div>
<div style="margin:0px"><font size="2" face="Calibri,sans-serif"><span style="font-size:11pt"><font size="1" color="gray"><span style="font-size:8pt">Zynstra is a private limited company registered in England and Wales (registered number 07864369). Our registered
office is 5 New Street Square, London, EC4A 3TW and our headquarters are at Bath Ventures, Broad Quay, Bath, BA1 1UD.</span></font></span></font></div>
</div>
</div>
</div>
</body>
</html>