<div dir="ltr">Hi all,<div><br></div><div>I'm using strongswan to do IKEv2 Mobike. The ipsec.conf is</div><div><br></div><div><div><i>config setup</i></div><div><i> strictcrlpolicy=no</i></div><div><i> # charonstart=yes</i></div>
<div><i> # plutostart=no</i></div><div><i><br></i></div><div><i>conn %default</i></div><div><i> ikelifetime=28800s</i></div><div><i> keylife=28800s</i></div><div><i> rekeymargin=3m</i></div><div><i> keyingtries=3</i></div>
<div><i> keyexchange=ikev2</i></div><div><i> ike=3des-sha1-modp1024</i></div><div><i> esp=3des-sha1</i></div><div><i><br></i></div><div><i>conn client</i></div><div><i> #left=%any</i></div><div><i> #left=%defaultroute</i></div>
<div><i> left=12.12.1.201</i></div><div><i> leftsourceip=%config</i></div><div><i> leftcert=client1_cert.pem</i></div><div><i> leftid="/C=CN/ST=SH/O=SNWL/CN=IKEv2_Client1"</i></div><div><i> right=11.11.11.200</i></div>
<div><i> rightid="/C=CN/ST=SH/O=SNWL/CN=11.11.11.200"</i></div><div><i> rightsubnet=<a href="http://192.168.168.0/24">192.168.168.0/24</a></i></div><div><i> auto=add</i></div></div><div><br></div><div>left side is a CentOS 5.9 pc, right side is a SonicWall box which support IKEv2 Mobike.</div>
<div>PC has two interface. <br></div><div>eth1 ip is 12.12.1.201</div><div>eth2 ip is 12.12.2.202</div><div>SonicWall box wan ip is 11.11.11.200</div><div><br></div><div>First PC-eth1 connect to the SonicWall box and get a dynamic ip address from SonicWall box 172.16.1.20, ping to right subnet 192.168.168.2 pass The ipsec status is</div>
<div><div><i>Security Associations (1 up, 0 connecting):</i></div><div><i> client[8]: ESTABLISHED 31 seconds ago, 12.12.1.201[C=CN, ST=SH, O=SNWL, CN=IKEv2_Client1]...11.11.11.200[C=CN, ST=SH, O=SNWL, CN=11.11.11.200]</i></div>
<div><i> client{8}: INSTALLED, TUNNEL, ESP SPIs: c6fd4979_i c183bc8c_o</i></div><div><i> client{8}: <a href="http://172.16.1.20/32">172.16.1.20/32</a> === <a href="http://192.168.168.0/24">192.168.168.0/24</a> </i></div>
</div><div><i><br></i></div><div>The I ifconfig eth1 down, ifup eth2, the detailed commands is</div><div>ifup eth2</div><div>route add -net 11.11.11.0 netmask 255.255.255.0 gw 12.12.2.101<br></div><div>ifconfig eth1 down</div>
<div><br></div><div>The check ipsec status</div><div><div><i>Security Associations (1 up, 0 connecting):</i></div><div><i> client[12]: ESTABLISHED 8 minutes ago, 12.12.2.202[C=CN, ST=SH, O=SNWL, CN=IKEv2_Client1]...11.11.11.200[C=CN, ST=SH, O=SNWL, CN=11.11.11.200]</i></div>
<div><i> client{12}: INSTALLED, TUNNEL, ESP SPIs: c84ed7a1_i 0dbbeb51_o</i></div><div><i> client{12}: <a href="http://172.16.1.20/32">172.16.1.20/32</a> === <a href="http://192.168.168.0/24">192.168.168.0/24</a></i></div>
</div><div><i><br></i></div><div>The left side ip has changed from 12.12.1.201 to 12.12.2.202.</div><div>But ping to right subnet 192.168.168.2 fail.</div><div>I don't konw why ping to right subnet fail. it should be pass. </div>
<div><br></div><div>The charon log is below. There are log I have marked to red. Is this error cause ping fail?<i style="color:rgb(204,0,0);background-color:rgb(238,238,238)">error uninstalling route installed with policy <a href="http://192.168.168.0/24">192.168.168.0/24</a> === <a href="http://172.16.1.20/32">172.16.1.20/32</a> fwd</i></div>
<div><br></div><div><br></div><div><div><i>Aug 21 18:29:39 03[IKE] initiating IKE_SA client[12] to 11.11.11.200</i></div><div><i>Aug 21 18:29:39 03[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</i></div>
<div><i>Aug 21 18:29:39 03[NET] sending packet: from 12.12.1.201[500] to 11.11.11.200[500] (536 bytes)</i></div><div><i>Aug 21 18:29:39 02[NET] received packet: from 11.11.11.200[500] to 12.12.1.201[500] (337 bytes)</i></div>
<div><i>Aug 21 18:29:39 02[ENC] parsed IKE_SA_INIT response 0 [ SA KE No CERTREQ N(NATD_S_IP) N(NATD_D_IP) V ]</i></div><div><i>Aug 21 18:29:39 02[ENC] received unknown vendor ID: 2a:67:75:d0:ad:2a:a7:88:7c:33:fe:1d:68:ba:f3:08:96:6f:00:01</i></div>
<div><i>Aug 21 18:29:39 02[IKE] received cert request for "C=CN, ST=SH, O=SNWL, CN=ROOTCA"</i></div><div><i>Aug 21 18:29:39 02[IKE] sending cert request for "C=CN, ST=SH, O=SNWL, CN=ROOTCA"</i></div><div>
<i>Aug 21 18:29:39 02[IKE] authentication of 'C=CN, ST=SH, O=SNWL, CN=IKEv2_Client1' (myself) with RSA signature successful</i></div><div><i>Aug 21 18:29:39 02[IKE] sending end entity cert "C=CN, ST=SH, O=SNWL, CN=IKEv2_Client1"</i></div>
<div><i>Aug 21 18:29:39 02[IKE] establishing CHILD_SA client</i></div><div><i>Aug 21 18:29:39 02[ENC] generating IKE_AUTH request 1 [ IDi CERT N(INIT_CONTACT) CERTREQ IDr AUTH CP(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(EAP_ONLY) ]</i></div>
<div><i>Aug 21 18:29:39 02[NET] sending packet: from 12.12.1.201[4500] to 11.11.11.200[4500] (1188 bytes)</i></div><div><i>Aug 21 18:29:39 10[NET] received packet: from 11.11.11.200[4500] to 12.12.1.201[4500] (988 bytes)</i></div>
<div><i>Aug 21 18:29:39 10[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH CP(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) ]</i></div><div><i>Aug 21 18:29:39 10[IKE] received end entity cert "C=CN, ST=SH, O=SNWL, CN=11.11.11.200"</i></div>
<div><i>Aug 21 18:29:39 10[CFG] using certificate "C=CN, ST=SH, O=SNWL, CN=11.11.11.200"</i></div><div><i>Aug 21 18:29:39 10[CFG] using trusted ca certificate "C=CN, ST=SH, O=SNWL, CN=ROOTCA"</i></div>
<div><i>Aug 21 18:29:39 10[CFG] checking certificate status of "C=CN, ST=SH, O=SNWL, CN=11.11.11.200"</i></div><div><i>Aug 21 18:29:39 10[CFG] certificate status is not available</i></div><div><i>Aug 21 18:29:39 10[CFG] reached self-signed root ca with a path length of 0</i></div>
<div><i>Aug 21 18:29:39 10[IKE] authentication of 'C=CN, ST=SH, O=SNWL, CN=11.11.11.200' with RSA signature successful</i></div><div><i>Aug 21 18:29:39 10[IKE] IKE_SA client[12] established between 12.12.1.201[C=CN, ST=SH, O=SNWL, CN=IKEv2_Client1]...11.11.11.200[C=CN, ST=SH, O=SNWL, CN=11.11.11.200]</i></div>
<div><i>Aug 21 18:29:39 10[IKE] scheduling reauthentication in 28502s</i></div><div><i>Aug 21 18:29:39 10[IKE] maximum IKE_SA lifetime 28682s</i></div><div><i>Aug 21 18:29:39 10[IKE] installing DNS server 11.11.11.111 to /etc/resolv.conf</i></div>
<div><i>Aug 21 18:29:39 10[IKE] installing new virtual IP 172.16.1.20</i></div><div><i>Aug 21 18:29:39 10[IKE] CHILD_SA client{12} established with SPIs c84ed7a1_i 0dbbeb51_o and TS <a href="http://172.16.1.20/32">172.16.1.20/32</a> === <a href="http://192.168.168.0/24">192.168.168.0/24</a></i></div>
</div><div><div><i>Aug 21 18:29:39 10[IKE] peer supports MOBIKE</i></div><div><i>Aug 21 18:29:56 07[KNL] interface eth2 activated</i></div><div><i>Aug 21 18:29:56 04[IKE] sending address list update using MOBIKE</i></div>
<div><i>Aug 21 18:29:56 04[ENC] generating INFORMATIONAL request 2 [ N(ADD_4_ADDR) ]</i></div><div><i>Aug 21 18:29:56 04[NET] sending packet: from 12.12.1.201[4500] to 11.11.11.200[4500] (68 bytes)</i></div><div><i>Aug 21 18:29:56 11[NET] received packet: from 11.11.11.200[4500] to 12.12.1.201[4500] (60 bytes)</i></div>
<div><i>Aug 21 18:29:56 11[ENC] parsed INFORMATIONAL response 2 [ ]</i></div><div><i>Aug 21 18:29:57 08[KNL] 12.12.2.202 appeared on eth2</i></div><div><i>Aug 21 18:29:57 02[IKE] sending address list update using MOBIKE</i></div>
<div><i>Aug 21 18:29:57 02[ENC] generating INFORMATIONAL request 3 [ N(ADD_4_ADDR) N(ADD_4_ADDR) ]</i></div><div><i>Aug 21 18:29:57 02[NET] sending packet: from 12.12.1.201[4500] to 11.11.11.200[4500] (84 bytes)</i></div>
<div><i>Aug 21 18:29:57 05[NET] received packet: from 11.11.11.200[4500] to 12.12.1.201[4500] (60 bytes)</i></div><div><i>Aug 21 18:29:57 05[ENC] parsed INFORMATIONAL response 3 [ ]</i></div><div><i>Aug 21 18:30:19 09[KNL] interface eth1 deactivated</i></div>
<div><i>Aug 21 18:30:19 06[IKE] old path is not available anymore, try to find another</i></div><div><i>Aug 21 18:30:19 06[IKE] looking for a route to 11.11.11.200 ...</i></div><div><i>Aug 21 18:30:19 06[IKE] requesting address change using MOBIKE</i></div>
<div><i>Aug 21 18:30:19 06[ENC] generating INFORMATIONAL request 4 [ ]</i></div><div><i>Aug 21 18:30:19 06[IKE] checking path 12.12.2.202[4500] - 11.11.11.200[4500]</i></div><div><i>Aug 21 18:30:19 06[NET] sending packet: from 12.12.2.202[4500] to 11.11.11.200[4500] (60 bytes)</i></div>
<div><i>Aug 21 18:30:19 05[NET] received packet: from 11.11.11.200[4500] to 12.12.2.202[4500] (60 bytes)</i></div><div><i>Aug 21 18:30:19 05[ENC] parsed INFORMATIONAL response 4 [ ]</i></div><div><span style="background-color:rgb(238,238,238)"><font color="#cc0000"><i>Aug 21 18:30:19 05[KNL] unable to copy replay state from old SAD entry with SPI c84ed7a1</i></font></span></div>
<div><span style="background-color:rgb(238,238,238)"><font color="#cc0000"><i>Aug 21 18:30:19 05[KNL] unable to copy replay state from old SAD entry with SPI 0dbbeb51</i></font></span></div><div><span style="background-color:rgb(238,238,238)"><font color="#cc0000"><i>Aug 21 18:30:19 05[KNL] error uninstalling route installed with policy <a href="http://192.168.168.0/24">192.168.168.0/24</a> === <a href="http://172.16.1.20/32">172.16.1.20/32</a> fwd</i></font></span></div>
</div><div><div><i>Aug 21 18:30:19 05[NET] sending packet: from 12.12.2.202[4500] to 11.11.11.200[4500] (156 bytes)</i></div><div><i>Aug 21 18:30:19 09[NET] received packet: from 11.11.11.200[4500] to 12.12.2.202[4500] (140 bytes)</i></div>
<div><i>Aug 21 18:30:19 09[ENC] parsed INFORMATIONAL response 5 [ N(NATD_S_IP) N(NATD_D_IP) N(COOKIE2) ]</i></div></div><div><br></div><div><br></div><div>Thanks</div><div>Amy</div></div>