<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hi,</div>
<div> </div>
<div>When configuring road warrior as below in strongswan version 4.3.6, we observe an odd behavior w.r.t the Server leases. </div>
<div> </div>
<div> </div>
<div>Server :-</div>
<div> </div>
<div>conn r1~v1</div>
<div> left=40.0.0.1</div>
<div> right=%any</div>
<div> leftsubnet=40.0.0.1/32</div>
<div> rightsourceip=99.0.0.0/30</div>
<div> authby=secret</div>
<div> leftid=40.0.0.1</div>
<div> rightid=%any</div>
<div> </div>
<div> </div>
<div>Client :-</div>
<div> </div>
<div>conn r1~v1</div>
<div> left=25.0.0.2</div>
<div> right=40.0.0.1</div>
<div> leftsourceip=%config</div>
<div> rightsubnet=40.0.0.1/32</div>
<div> authby=secret</div>
<div> leftid=25.0.0.2</div>
<div> rightid=%any</div>
<div> </div>
<div> </div>
<div> </div>
<div>The Server assigns all IPs from its pool to connecting client r1~v1, if r1~v1 connects to it several times, but maintains only the latest virtual ip address entry in the lease. The client has multiple xfrm policies corresponding to all virtual IPs assigned.</div>
<div> </div>
<div># ipsec leases</div>
<div>Leases in pool 'r1~v1', usage: 1/3, 1 online</div>
<div> 99.0.0.1 online '(vr*)25.0.0.2'</div>
<div> </div>
<div># ipsec leases</div>
<div>Leases in pool 'r1~v1', usage: 1/3, 1 online</div>
<div> 99.0.0.2 online '(vr*)25.0.0.2'</div>
<div> </div>
<div> </div>
<div> </div>
<div>Deleting r1~v1 connection from client, disables the lease from the server, but the client does not delete all virtual IPs and has the respective xfrm policies still in kernel.</div>
<div> </div>
<div># ipsec leases</div>
<div>Leases in pool 'r1~v1', usage: 1/3, 0 online</div>
<div> 99.0.0.2 offline '(vr*)25.0.0.2'</div>
<div> </div>
<div> </div>
<div>Client side :</div>
<div> </div>
<div># ip xfrm policy</div>
<div>40.0.0.1/32[0] 99.0.0.2/32[0]</div>
<div> upspec 1 dev (none) uid 0</div>
<div> in allow index 0x00001208 priority 1678 share any flags 0x00000000</div>
<div> tmpl-1:</div>
<div> 40.0.0.1 25.0.0.2</div>
<div> esp spi 0(0x00000000) reqid 4 tunnel</div>
<div> level required share any algo-mask:E=32, A=32, C=32</div>
<div> fpid 0x000000a4</div>
<div> policy type main</div>
<div>99.0.0.2/32[0] 40.0.0.1/32[0]</div>
<div> upspec 1 dev (none) uid 0</div>
<div> out allow index 0x00001201 priority 1678 share any flags 0x00000000</div>
<div> tmpl-1:</div>
<div> 25.0.0.2 40.0.0.1</div>
<div> esp spi 0(0x00000000) reqid 4 tunnel</div>
<div> level required share any algo-mask:E=32, A=32, C=32</div>
<div> fpid 0x000000a3</div>
<div> policy type main</div>
<div> </div>
<div> </div>
<div>It is possible in this scenario, that server gives 99.0.0.2 virtual ip address to a new connection(it assumes 99.0.0.2 is offline), but 99.0.0.2 is still present on a previous connection.</div>
<div> </div>
<div> </div>
<div>The above behavior seems to be incorrect. Ideally, at first place itself, server should not assign different virtual IPs to the same client even if the client tries to connect to it several times.</div>
<div> </div>
<div>Can someone provide inputs on this.</div>
<div> </div>
<div>Thanks</div>
<div>Sumit</div>
<div> </div>
</span></font>
</body>
</html>