<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:10pt"><div class="" style="">Hi, </div><div class="" style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><br></div><div class="" style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;">I have been using strong swan 5.1.2 for quite some time as a gateway for iPhone vpn clients. this is all working great. </div><div class="" style="">Suddenly today, my iPhone stopped connecting to internet even though the vpn tunnel is established. i can see that tunnel established both on phone logs and server logs. i am pasting logs
below.</div><div class="" style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">From phone console logs:</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">1. vpn tunnel establishment seems pretty normal</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">2. if i turn off the vpn,
vpn disconnect log has some issues</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class=""><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">From server logs:</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">1. <span style="font-size: 10pt;" class="">during connection - </span><span style="background-color: transparent;" class="">looks like policy already exists once this state - "policy 0.0.0.0/0 === 10.10.128.2/32 out (mark 0/0x00000000) already
exists, increasing refcount"</span></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">2. during disconnection - can't delete the policy once in this state - "policy still used by another CHILD_SA, not removed"</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class=""><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">Here are some things i tried:</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida
Grande', sans-serif; background-color: transparent; font-style: normal;" class="">a. I restarted strongswan - didn't help</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">b. i manually flushed/deleted xfrm policies by using commands ip xfrm policy flush and ip xfrm policy deleteall - didn't do any good</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">c. checked ipsec listcounters - found that ikeInInvalidSpi and ikeChildSaRekey are non-zero.</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style:
normal;" class=""><br></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">Any help would be greatly appreciated, thanks in advance</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">- Naveen</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class=""><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class=""><br class=""
style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">my ipsec.conf</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class="">----------------</div><div style="background-color: transparent;" class="">config setup</div><div style="background-color: transparent;" class=""> # uniqueids=never</div><div style="background-color: transparent;" class=""> # plutodebug=all</div><div style="background-color: transparent;" class=""> # crlcheckinterval=600</div><div style="background-color: transparent;" class=""> # strictcrlpolicy=yes</div><div style="background-color: transparent;" class="">
# cachecrls=yes</div><div style="background-color: transparent;" class=""> # nat_traversal=yes</div><div style="background-color: transparent;" class=""> # charonstart=no</div><div style="background-color: transparent;" class=""> # plutostart=no</div><div style="background-color: transparent;" class=""><br class="" style=""></div><div style="background-color: transparent;" class=""># Add connections here.</div><div style="background-color: transparent;" class=""><br class="" style=""></div><div style="background-color: transparent;" class="">conn %default</div><div style="background-color: transparent;" class=""> keyexchange=ikev1</div><div style="background-color: transparent;" class=""> auto=add</div><div style="background-color: transparent;" class=""> authby=xauthrsasig</div><div style="background-color: transparent;"
class=""> xauth=server</div><div style="background-color: transparent;" class=""><br class="" style=""></div><div style="background-color: transparent;" class="">conn ios_client</div><div style="background-color: transparent;" class=""> left=%any</div><div style="background-color: transparent;" class=""> leftsubnet=0.0.0.0/0</div><div style="background-color: transparent;" class=""> #leftfirewall=yes</div><div style="background-color: transparent;" class=""> leftcert=serverCert.pem</div><div style="background-color: transparent;" class=""> right=%any</div><div style="background-color: transparent;" class=""> rightsourceip=10.10.0.0/21</div><div style="background-color: transparent;" class=""> rightid="C=US, O=Self, CN=*"</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family:
HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class=""><br class="" style=""></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;" class=""><br class="" style=""></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;" class=""><br class="" style=""></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;" class="">VPN Gateway / strongswan logs during connection:</div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size:
13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;" class="">----------<span style="font-size: 10pt;" class="">----------</span><span style="font-size: 10pt;" class="">----------</span><span style="font-size: 10pt;" class="">----------</span><span style="font-size: 10pt;" class="">----------</span><span style="font-size: 10pt;" class="">---------</span></div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[NET] received packet: from 108.226.162.131[500] to server_ip[500] (668 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V V ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received NAT-T (RFC 3947) vendor ID</div><div
style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received draft-ietf-ipsec-nat-t-ike vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received draft-ietf-ipsec-nat-t-ike-08 vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received draft-ietf-ipsec-nat-t-ike-07 vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received draft-ietf-ipsec-nat-t-ike-06 vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received draft-ietf-ipsec-nat-t-ike-05 vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received
draft-ietf-ipsec-nat-t-ike-04 vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received XAuth vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received Cisco Unity vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX:
03[IKE] received FRAGMENTATION vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] received DPD vendor ID</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[IKE] 108.226.162.131 is initiating a Main Mode IKE_SA</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[ENC] generating ID_PROT response 0 [ SA V V V ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:15 a18-03-01 charon-MAX: 03[NET] sending packet: from server_ip[500] to 108.226.162.131[500] (136 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 06[NET] received packet: from 108.226.162.131[500] to server_ip[500] (292 bytes)</div><div style="background-color: transparent; font-size:
10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 06[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 06[IKE] remote host is behind NAT</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 06[IKE] sending cert request for "C=US, O=Self, CN=Dev Server CA"</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 06[ENC] generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 06[NET] sending packet: from server_ip[500] to 108.226.162.131[500] (370 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[NET] received packet: from
108.226.162.131[4500] to server_ip[4500] (1276 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[ENC] parsed ID_PROT request 0 [ ID CERT SIG CERTREQ N(INITIAL_CONTACT) ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[IKE] ignoring certificate request without data</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[IKE] received end entity cert "C=US, O=Self, CN=i18bc3e54cba14fa3adce4297629a9a63"</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[CFG] looking for XAuthInitRSA peer configs matching server_ip...108.226.162.131[C=US, O=Self, CN=i18bc3e54cba14fa3adce4297629a9a63]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX:
04[CFG] selected peer config "ios_client"</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[CFG] using certificate "C=US, O=Self, CN=i18bc3e54cba14fa3adce4297629a9a63"</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[CFG] using trusted ca certificate "C=US, O=Self, CN=Dev Server CA"</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[CFG] checking certificate status of "C=US, O=Self, CN=i18bc3e54cba14fa3adce4297629a9a63"</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[CFG] certificate status is not available</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[CFG] reached self-signed root ca with a path length
of 0</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[IKE] authentication of 'C=US, O=Self, CN=i18bc3e54cba14fa3adce4297629a9a63' with RSA successful</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[IKE] authentication of 'C=US, O=Self, CN=server_dns' (myself) successful</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[IKE] sending end entity cert "C=US, O=Self, CN=server_dns"</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[ENC] generating ID_PROT response 0 [ ID CERT SIG ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[NET] sending packet: from server_ip[4500] to 108.226.162.131[4500] (1276 bytes)</div><div
style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[ENC] generating TRANSACTION request 2204276323 [ HASH CPRQ(X_USER X_PWD) ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 04[NET] sending packet: from server_ip[4500] to 108.226.162.131[4500] (76 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 08[NET] received packet: from 108.226.162.131[4500] to server_ip[4500] (124 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 08[ENC] parsed TRANSACTION response 2204276323 [ HASH CPRP(X_USER X_PWD) ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 08[IKE] XAuth authentication of 'i18bc3e54cba14fa3adce4297629a9a63' successful</div><div
style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 08[ENC] generating TRANSACTION request 2600414014 [ HASH CPS(X_STATUS) ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:16 a18-03-01 charon-MAX: 08[NET] sending packet: from server_ip[4500] to 108.226.162.131[4500] (76 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 05[NET] received packet: from 108.226.162.131[4500] to server_ip[4500] (76 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 05[ENC] parsed TRANSACTION response 2600414014 [ HASH CPA(X_STATUS) ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 05[IKE] IKE_SA ios_client[5] established between server_ip[C=US, O=Self,
CN=server_dns]...108.226.162.131[C=US, O=Self, CN=i18bc3e54cba14fa3adce4297629a9a63]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 05[IKE] scheduling reauthentication in 10027s</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 05[IKE] maximum IKE_SA lifetime 10567s</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 09[NET] received packet: from 108.226.162.131[4500] to server_ip[4500] (172 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 09[ENC] unknown attribute type (28683)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 09[ENC] parsed TRANSACTION request 799928909 [ HASH CPRQ(ADDR MASK DNS NBNS EXP VER U_BANNER U_DEFDOM
U_SPLITDNS U_SPLITINC U_LOCALLAN U_PFS U_SAVEPWD U_FWTYPE U_BKPSRV (28683)) ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 09[IKE] peer requested virtual IP %any</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 09[CFG] assigning new lease to 'i18bc3e54cba14fa3adce4297629a9a63'</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 09[CHD] sfloadbalancer acquire new address 10.10.128.2 from 10.10.128.0/22 for lease i18bc3e54cba14fa3adce4297629a9a63</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 09[IKE] assigning virtual IP 10.10.128.2 to peer 'i18bc3e54cba14fa3adce4297629a9a63'</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 09[CHD]
sfloadbalancer create_attribute_enumerator</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 09[ENC] generating TRANSACTION response 799928909 [ HASH CPRP(ADDR DNS DNS) ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 09[NET] sending packet: from server_ip[4500] to 108.226.162.131[4500] (92 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 11[NET] received packet: from 108.226.162.131[4500] to server_ip[4500] (300 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 11[ENC] parsed QUICK_MODE request 1190983258 [ HASH SA No ID ID ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 11[KNL] getting SPI for reqid {4}</div><div
style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 11[KNL] got SPI c40cd352 for reqid {4}</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 11[ENC] generating QUICK_MODE response 1190983258 [ HASH SA No ID ID ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 11[NET] sending packet: from server_ip[4500] to 108.226.162.131[4500] (172 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[NET] received packet: from 108.226.162.131[4500] to server_ip[4500] (60 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[ENC] parsed QUICK_MODE request 1190983258 [ HASH ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17
05:09:17 a18-03-01 charon-MAX: 10[KNL] adding SAD entry with SPI c40cd352 and reqid {4} (mark 0/0x00000000)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] using encryption algorithm AES_CBC with key size 128</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] using integrity algorithm HMAC_SHA1_96 with key size 160</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] using replay window of 32 packets</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] adding SAD entry with SPI 090480e7 and reqid {4} (mark 0/0x00000000)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL]
using encryption algorithm AES_CBC with key size 128</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] using integrity algorithm HMAC_SHA1_96 with key size 160</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] using replay window of 32 packets</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] adding policy 0.0.0.0/0 === 10.10.128.2/32 out (mark 0/0x00000000)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] adding policy 10.10.128.2/32 === 0.0.0.0/0 in (mark 0/0x00000000)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] adding policy 10.10.128.2/32 === 0.0.0.0/0 fwd (mark
0/0x00000000)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] getting a local address in traffic selector 0.0.0.0/0</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] using host %any</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] using server_local_ip as nexthop to reach 108.226.162.131</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] server_ip is on interface bond0</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] installing route: 10.10.128.2/32 via server_local_ip src %any dev bond0</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX:
10[KNL] getting iface index for bond0</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] policy 0.0.0.0/0 === 10.10.128.2/32 out (mark 0/0x00000000) already exists, increasing refcount</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] updating policy 0.0.0.0/0 === 10.10.128.2/32 out (mark 0/0x00000000)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] policy 10.10.128.2/32 === 0.0.0.0/0 in (mark 0/0x00000000) already exists, increasing refcount</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] updating policy 10.10.128.2/32 === 0.0.0.0/0 in (mark 0/0x00000000)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17
a18-03-01 charon-MAX: 10[KNL] policy 10.10.128.2/32 === 0.0.0.0/0 fwd (mark 0/0x00000000) already exists, increasing refcount</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] updating policy 10.10.128.2/32 === 0.0.0.0/0 fwd (mark 0/0x00000000)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] getting a local address in traffic selector 0.0.0.0/0</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] using host %any</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] using server_local_ip as nexthop to reach 108.226.162.131</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[KNL] server_ip is on interface
bond0</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[IKE] CHILD_SA ios_client{4} established with SPIs c40cd352_i 090480e7_o and TS 0.0.0.0/0 === 10.10.128.2/32</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[CHD] sfupdown connection up</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:17 a18-03-01 charon-MAX: 10[CHD] clientId fetch success with Try1-XAuth1:i18bc3e54cba14fa3adce4297629a9a63</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:19 a18-03-01 charon-MAX: 14[NET] received packet: from 50.161.45.101[4500] to server_ip[4500] (92 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:19 a18-03-01 charon-MAX: 14[ENC] parsed INFORMATIONAL_V1 request 106010779 [ HASH N(DPD) ]</div><div
style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:19 a18-03-01 charon-MAX: 14[ENC] generating INFORMATIONAL_V1 request 736058675 [ HASH N(DPD_ACK) ]</div><div style="background-color: transparent; font-size: 10pt;" class="">Sep 17 05:09:19 a18-03-01 charon-MAX: 14[NET] sending packet: from server_ip[4500] to 50.161.45.101[4500] (92 bytes)</div><div style="background-color: transparent; font-size: 10pt;" class=""><br class="" style=""></div><div style="background-color: transparent; font-size: 13px; color: rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;" class=""><br class="" style=""></div><div style="background-color: transparent; font-size: 13px; color: rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;" class=""><br class="" style=""></div><div style="background-color:
transparent; font-size: 13px; color: rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;" class=""><br class="" style=""></div><div class="" style="background-color: transparent;">VPN Gateway / strongswan logs during vpn disconnect:</div><div class="" style="background-color: transparent;">----------<span class="" style="font-size: 10pt;">----------</span><span class="" style="font-size: 10pt;">----------</span><span class="" style="font-size: 10pt;">----------</span><span class="" style="font-size: 10pt;">----------</span><span class="" style="font-size: 10pt;">-------------</span></div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[NET] received packet: from 108.226.162.131[4500] to server_ip[4500] (76 bytes)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01
charon-MAX: 14[ENC] parsed INFORMATIONAL_V1 request 2126946462 [ HASH D ]</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[IKE] received DELETE for ESP CHILD_SA with SPI 0a34ddd0</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] querying SAD entry with SPI c6b877d9 (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] querying SAD entry with SPI 0a34ddd0 (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[IKE] closing CHILD_SA ios_client{34} with SPIs c6b877d9_i (883 bytes) 0a34ddd0_o (2037 bytes) and TS 0.0.0.0/0 === 10.10.128.4/32</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01
charon-MAX: 14[CHD] sfupdown connection down</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[CHD] clientId fetch success with Try1-XAuth1:i18bc3e54cba14fa3adce4297629a9a63</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] deleting SAD entry with SPI c6b877d9 (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] deleted SAD entry with SPI c6b877d9 (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] deleting SAD entry with SPI 0a34ddd0 (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] deleted SAD entry with SPI 0a34ddd0 (mark
0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] deleting policy 0.0.0.0/0 === 10.10.128.4/32 out (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] policy still used by another CHILD_SA, not removed</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] updating policy 0.0.0.0/0 === 10.10.128.4/32 out (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] deleting policy 10.10.128.4/32 === 0.0.0.0/0 in (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] policy still used by another CHILD_SA, not removed</div><div class=""
style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] updating policy 10.10.128.4/32 === 0.0.0.0/0 in (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] deleting policy 10.10.128.4/32 === 0.0.0.0/0 fwd (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] policy still used by another CHILD_SA, not removed</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] updating policy 10.10.128.4/32 === 0.0.0.0/0 fwd (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] getting a local address in traffic selector 0.0.0.0/0</div><div class="" style="background-color:
transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] using host %any</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] using server_local_ip as nexthop to reach 108.226.162.131</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] server_ip is on interface bond0</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] deleting policy 0.0.0.0/0 === 10.10.128.4/32 out (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] deleting policy 10.10.128.4/32 === 0.0.0.0/0 in (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] deleting policy 10.10.128.4/32
=== 0.0.0.0/0 fwd (mark 0/0x00000000)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[KNL] getting iface index for bond0</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[NET] received packet: from 108.226.162.131[4500] to server_ip[4500] (92 bytes)</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[ENC] parsed INFORMATIONAL_V1 request 2991813150 [ HASH D ]</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[IKE] received DELETE for IKE_SA ios_client[46]</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[IKE] deleting IKE_SA ios_client[46] between server_ip[C=US, O=Self, CN=server_dns]...108.226.162.131[C=US, O=Self,
CN=i18bc3e54cba14fa3adce4297629a9a63]</div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[CFG] lease 10.10.128.4 by 'i18bc3e54cba14fa3adce4297629a9a63' went offline</div><div class="" style="background-color: transparent; font-size: 10pt;"><span class="" style="font-size: 10pt;"></span></div><div class="" style="background-color: transparent; font-size: 10pt;">Sep 17 04:48:24 a18-03-01 charon-MAX: 14[CHD] sfloadbalancer release address 10.10.128.4 from 10.10.128.0/22</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class=""><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"
class=""><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class=""><br class="" style=""></div><div class="" style="background-color: transparent;">phone logs during disconnection:</div><div class="" style="background-color: transparent;">----------<span class="" style="font-size: 10pt;">----------</span><span class="" style="font-size: 10pt;">----------</span><span class="" style="font-size: 10pt;">--------</span></div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 configd[56] <Notice>: SCNC: stop, triggered by (1967) Preferences, type IPSec, reason User Requested</div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 configd[56] <Notice>: IPSec disconnecting from server_ip</div><div class=""
style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 kernel[0] <Debug>: SIOCPROTODETACH_IN6: utun0 error=6</div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 configd[56] <Error>: ioctl(SIOCGIFFLAGS) failed: Device not configured</div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 configd[56] <Error>: SCNC Controller: service_ending_verify_primaryservice, waiting for PrimaryService. status = 1.</div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 configd[56] <Notice>: network changed: v4(en0:192.168.0.102, pdp_ip0, utun0-:10.10.128.4) DNS! Proxy!</div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 configd[56] <Notice>: network changed.</div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 configd[56] <Error>: SCNC
Controller: ipv4_state_changed, done waiting for ServiceID.</div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 racoon[2375] <Notice>: IPSec disconnecting from server <span class="" style="font-size: 10pt;">server_ip</span></div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 racoon[2375] <Error>: failed to send vpn_control message: Broken pipe</div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 mDNSResponder[32] <Error>: getExtendedFlags: SIOCGIFEFLAGS failed, errno = 6 (Device not configured)</div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 racoon[2375] <Warning>: glob found no matches for path "/var/run/racoon/*.conf"</div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 racoon[2375] <Notice>: IPSec disconnecting from
server <span class="" style="font-size: 10pt;">server_ip</span></div><div class="" style="background-color: transparent;">Sep 16 17:58:31 Naveens-iPhone5 racoon[2375] <Error>: pfkey DELETE failed: No such file or directory</div><div class="" style=""><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;" class=""><br class="" style=""></div></div></body></html>