<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
I’ve been performing some rekey testing, and purposely configured low lifetimes to force rekey’s to happen frequently in order to test the system.</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
I’m seeing that any rekey values less than 10m or so winds up causing issues, such as tunnels completely down, or the outbound SA deleted on one side (but the inbound SA remains).</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
I’ve just ran a test with two back to back Linux machines running 5.2.2. In this case, I’m running the tunnel as transport mode over a GRE tunnel, but the problem seems to happen without the GRE tunnel as well:</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<br>
</div>
<div style="color: rgb(0, 0, 0);">
<div><font face="Courier" style="font-size: 12px;">conn b2b</font></div>
<div><font face="Courier" style="font-size: 12px;"> left=198.168.73.101</font></div>
<div><font face="Courier" style="font-size: 12px;"> leftsubnet=198.168.73.101/32[gre]</font></div>
<div><font face="Courier" style="font-size: 12px;"> leftid=198.168.73.101</font></div>
<div><font face="Courier" style="font-size: 12px;"> right=198.168.73.102</font></div>
<div><font face="Courier" style="font-size: 12px;"> rightsubnet=198.168.73.102/32[gre]</font></div>
<div><font face="Courier" style="font-size: 12px;"> rightid=198.168.73.102</font></div>
<div><font face="Courier" style="font-size: 12px;"> ike=aes-128-sha1-modp2048</font></div>
<div><font face="Courier" style="font-size: 12px;"> esp=null-sha256-noesn!</font></div>
<div><font face="Courier" style="font-size: 12px;"> type=transport</font></div>
<div><font face="Courier" style="font-size: 12px;"> auto=add</font></div>
</div>
<div style="color: rgb(0, 0, 0);"><font face="Courier" style="font-size: 12px;"><br>
</font></div>
<div style="color: rgb(0, 0, 0);">
<div><font face="Courier" style="font-size: 12px;">conn b2b</font></div>
<div><font face="Courier" style="font-size: 12px;"> left=198.168.73.102</font></div>
<div><font face="Courier" style="font-size: 12px;"> leftsubnet=198.168.73.102/32[gre]</font></div>
<div><font face="Courier" style="font-size: 12px;"> leftid=198.168.73.102</font></div>
<div><font face="Courier" style="font-size: 12px;"> right=198.168.73.101</font></div>
<div><font face="Courier" style="font-size: 12px;"> rightsubnet=198.168.73.101/32[gre]</font></div>
<div><font face="Courier" style="font-size: 12px;"> rightid=198.168.73.101</font></div>
<div><font face="Courier" style="font-size: 12px;"> ike=aes-128-sha1-modp2048</font></div>
<div><font face="Courier" style="font-size: 12px;"> esp=null-sha256-noesn!</font></div>
<div><font face="Courier" style="font-size: 12px;"> type=transport</font></div>
<div><font face="Courier" style="font-size: 12px;"> auto=add</font></div>
</div>
<div style="color: rgb(0, 0, 0);"><font face="Courier" style="font-size: 12px;"><br>
</font></div>
<div>I<font style="color: rgb(0, 0, 0);"> brought up the tunnel and left it running. When I came back about 30 minutes later, both machines show:</font></div>
<div><font style="color: rgb(0, 0, 0);"><br>
</font></div>
<div><font style="color: rgb(0, 0, 0);">
<div>Every 2.0s: setkey -D Mon May 4 23:44:54 2015</div>
<div><br>
</div>
<div>No SAD entries.</div>
<div><br>
</div>
<div>I noticed this in one of the logs:</div>
<div>
<div>May 4 23:25:54 a198-168-73-102 charon: 04[IKE] initiator did not reauthenticate as requested</div>
<div>May 4 23:25:54 a198-168-73-102 charon: 04[IKE] reauthenticating IKE_SA b2b[5] actively</div>
</div>
<div><br>
</div>
<div>And the other side seems to be scheduling a re-auth event earlier:</div>
<div>
<div>May 4 23:15:54 a198-168-73-101 charon: 10[IKE] scheduling reauthentication in 600s</div>
<div>May 4 23:15:54 a198-168-73-101 charon: 10[IKE] maximum IKE_SA lifetime 600s</div>
<div>May 4 23:15:54 a198-168-73-101 charon: 10[IKE] received AUTH_LIFETIME of 600s, reauthentication already scheduled in 600s</div>
</div>
</font></div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
Any ideas? Is the reauth to blame?</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
I know this lifetime is unusually short, but I’m concerned that the same type of rekey issue may happen if I let the system run for much longer periods of time.</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
Thanks!</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
/Ryan</div>
<div style="color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div id="MAC_OUTLOOK_SIGNATURE"></div>
</div>
</body>
</html>