<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hi I see some strange behavior about ipsec update.
<div class=""><br class="">
</div>
<div class="">I have two questions regarding ipsec update.</div>
<div class=""><br class="">
</div>
<div class="">Please see the question inline along the procedure below.<br class="">
<div class=""><br class="">
</div>
<div class="">First of all, I am trying to configure IPSec based on port.
<div class=""><br class="">
</div>
<div class="">Mode is transport.</div>
<div class="">Version 5.2.1</div>
<div class=""><br class="">
</div>
<div class="">My setup is </div>
<div class=""><br class="">
</div>
<div class="">Carol(54.68.129.251) is initiator, and Alice(54.148.133.92) is responder.</div>
<div class=""><br class="">
</div>
<div class="">Alice </div>
<div class=""><br class="">
</div>
<div class="">conn Carol</div>
<div class=""> leftauth=psk</div>
<div class=""> left=%any</div>
<div class=""> leftid=Alice</div>
<div class=""> leftsubnet=0.0.0.0/0[tcp/5001], 0.0.0.0/0[tcp/8080]</div>
<div class=""> rightauth=psk</div>
<div class=""> rightid=%any</div>
<div class=""> right=54.68.129.251</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">And Alice is running iperf server on 5001 and 8080.</div>
<div class=""><br class="">
</div>
<div class="">Now Carol start configuration</div>
<div class=""><br class="">
</div>
<div class="">conn Alice</div>
<div class=""> leftauth=psk</div>
<div class=""> left=%any</div>
<div class=""> leftid=Carol</div>
<div class=""> rightauth=psk</div>
<div class=""> rightid=%any</div>
<div class=""> right=54.148.133.92</div>
<div class=""> rightsubnet=54.148.133.92[tcp/5001]</div>
<div class=""><br class="">
</div>
<div class="">And do iperf client to Alice on port 5001.</div>
<div class=""><br class="">
</div>
<div class="">And the status of SA is </div>
<div class=""><br class="">
</div>
<div class="">
<div class="" style="margin: 0px; font-family: Courier;">Security Associations (1 up, 0 connecting):</div>
<div class="" style="margin: 0px; font-family: Courier;"> Ubuntu-1[1]: ESTABLISHED 53 seconds ago, 172.31.3.88[a1143]...54.148.133.92[a1144]</div>
<div class="" style="margin: 0px; font-family: Courier;"> Ubuntu-1{1}: INSTALLED, TRANSPORT, ESP in UDP SPIs: c1af5c4b_i c1373ed9_o</div>
<div class="" style="margin: 0px; font-family: Courier;"> Ubuntu-1{1}: 172.31.3.88/32 === 54.148.133.92/32[tcp/5001]</div>
</div>
<div class="" style="margin: 0px; font-family: Courier;"><br class="">
</div>
<div class="" style="margin: 0px; font-family: Courier;">and the data flows correct over encrypted channel.</div>
<div class="" style="margin: 0px; font-family: Courier;"><br class="">
</div>
<div class="" style="margin: 0px; font-family: Courier;">Now if I update the connection of Carol with following </div>
<div class="" style="margin: 0px; font-family: Courier;"><br class="">
</div>
<div class="" style="margin: 0px;">
<div class="" style="font-family: Courier; margin: 0px;">conn Alice</div>
<div class="" style="font-family: Courier; margin: 0px;"> leftauth=psk</div>
<div class="" style="font-family: Courier; margin: 0px;"> left=%any</div>
<div class="" style="font-family: Courier; margin: 0px;"> leftid=a1143</div>
<div class="" style="font-family: Courier; margin: 0px;"> rightauth=psk</div>
<div class="" style="font-family: Courier; margin: 0px;"> rightid=%any</div>
<div class="" style="font-family: Courier; margin: 0px;"> right=54.148.133.92</div>
<div class="" style="font-family: Courier; margin: 0px;"> rightsubnet=54.148.133.92[tcp/5001]</div>
<div class="" style="font-family: Courier; margin: 0px; min-height: 14px;"><br class="">
</div>
<div class="" style="font-family: Courier; margin: 0px;">conn Alice-2</div>
<div class="" style="font-family: Courier; margin: 0px;"> also=Ubuntu-1</div>
<div class="" style="font-family: Courier; margin: 0px;"> rightsubnet=54.148.133.92<span class="" style="background-color: rgb(0, 230, 229);">[</span>tcp/8080<span class="" style="background-color: rgb(0, 230, 229);">]</span></div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="margin: 0px;">
<div class="" style="font-family: Courier; margin: 0px;">Security Associations (2 up, 0 connecting):</div>
<div class="" style="font-family: Courier; margin: 0px;"> Ubuntu-1[2]: ESTABLISHED 11 seconds ago, 172.31.3.88[a1143]...54.148.133.92[a1144]</div>
<div class="" style="font-family: Courier; margin: 0px;"> Ubuntu-1-2{2}: INSTALLED, TRANSPORT, ESP in UDP SPIs: cc0fa925_i c7ba5044_o</div>
<div class="" style="font-family: Courier; margin: 0px;"> Ubuntu-1-2{2}: 172.31.3.88/32 === 54.148.133.92/32[tcp/http-alt] </div>
<div class="" style="font-family: Courier; margin: 0px;"> Ubuntu-1[1]: ESTABLISHED 4 minutes ago, 172.31.3.88[a1143]...54.148.133.92[a1144]</div>
<div class="" style="font-family: Courier; margin: 0px;"> Ubuntu-1{1}: INSTALLED, TRANSPORT, ESP in UDP SPIs: c1af5c4b_i c1373ed9_o</div>
<div class="" style="font-family: Courier; margin: 0px;"> Ubuntu-1{1}: 172.31.3.88/32 === 54.148.133.92/32[tcp/5001] </div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="font-family: Courier; margin: 0px;">I can see the status update, but data over 5001 is interrupted while I still can make new iperf to 8080.</div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="font-family: Courier; margin: 0px;"><b class=""><font size="4" class="">So the first question is why data over 5001 is interrupted, and I cannot make it again ever?</font></b></div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="font-family: Courier; margin: 0px;">So I reverted the connection conn back to </div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="margin: 0px;">
<div class="" style="font-family: Courier; margin: 0px;">conn Alice</div>
<div class="" style="font-family: Courier; margin: 0px;"> leftauth=psk</div>
<div class="" style="font-family: Courier; margin: 0px;"> left=%any</div>
<div class="" style="font-family: Courier; margin: 0px;"> leftid=a1143</div>
<div class="" style="font-family: Courier; margin: 0px;"> rightauth=psk</div>
<div class="" style="font-family: Courier; margin: 0px;"> rightid=%any</div>
<div class="" style="font-family: Courier; margin: 0px;"> right=54.148.133.92</div>
<div class="" style="font-family: Courier; margin: 0px;"> rightsubnet=54.148.133.92[tcp/5001]</div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="font-family: Courier; margin: 0px;">and do ipsec update.</div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="font-family: Courier; margin: 0px;">However I still cannot make any data over 5001 while the data still flows over 8080.</div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="font-family: Courier; margin: 0px;">And when I do ipsec status, I still see the two SAs.</div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="margin: 0px;">
<div class="" style="font-family: Courier; margin: 0px;">Security Associations (2 up, 0 connecting):</div>
<div class="" style="font-family: Courier; margin: 0px;"> Ubuntu-1[2]: ESTABLISHED 11 seconds ago, 172.31.3.88[a1143]...54.148.133.92[a1144]</div>
<div class="" style="font-family: Courier; margin: 0px;"> Ubuntu-1-2{2}: INSTALLED, TRANSPORT, ESP in UDP SPIs: cc0fa925_i c7ba5044_o</div>
<div class="" style="font-family: Courier; margin: 0px;"> Ubuntu-1-2{2}: 172.31.3.88/32 === 54.148.133.92/32[tcp/http-alt] </div>
<div class="" style="font-family: Courier; margin: 0px;"> Ubuntu-1[1]: ESTABLISHED 4 minutes ago, 172.31.3.88[a1143]...54.148.133.92[a1144]</div>
<div class="" style="font-family: Courier; margin: 0px;"> Ubuntu-1{1}: INSTALLED, TRANSPORT, ESP in UDP SPIs: c1af5c4b_i c1373ed9_o</div>
<div class="" style="font-family: Courier; margin: 0px;"> Ubuntu-1{1}: 172.31.3.88/32 === 54.148.133.92/32[tcp/5001]</div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="font-family: Courier; margin: 0px;"><br class="">
</div>
<div class="" style="margin: 0px;">
<div class="" style="margin: 0px;"><b class=""><font size="4" class=""><font face="Courier" class="">The second question is why data over 5001 is still in interrupted status and the deleted SA is still alive?</font></font></b></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>