<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hello all,<div class=""><br class=""></div><div class="">I’ve got a Strongswan 5.3.5 installation compiled from source installed on Centos 6.7 box connecting to a Cisco ASA which exhibits the following behavior.</div><div class=""><br class=""></div><div class="">On start it runs fine for an indeterminate period of time, then the tunnels begin to flap up and down. Time could be several days to several weeks.</div><div class=""><br class=""></div><div class="">When running an ‘ipsec statusall’ it shows (truncated to remove tunnel configs):</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">Status of IKE charon daemon (strongSwan 5.3.5, Linux 2.6.32-573.8.1.el6.x86_64, x86_64):</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class=""> uptime: 4 days, since Dec 02 21:19:31 2015</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class=""> malloc: sbrk 913408, mmap 0, used 545392, free 368016</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class=""> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 340</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class=""> loaded plugins: charon aesni aes des rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt f</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">ips-prf gmp xcbc cmac hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown xauth-generic</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">Listening IP addresses:</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class=""> 100.93.64.90</font></div><div style="margin: 0px; line-height: normal; min-height: 14px;" class=""><font face="Courier" class=""><br class=""></font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">Security Associations (1 up, 0 connecting):</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">xxx-yyy-zzz-10-228-0-0-16[2621]: ESTABLISHED 29 seconds ago, 100.93.64.90[52.89.229.66]...166.108.248.1[166.108.248.1]</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">xxx-yyy-zzz-10-228-0-0-16[2621]: IKEv1 SPIs: 88c593b6b7148d7d_i* c11b33192527a0f2_r, pre-shared key reauthentication in 7 hours</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">xxx-yyy-zzz-10-228-0-0-16[2621]: IKE proposal: 3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">xxx-yyy-zzz-10-228-0-0-16[2621]: Tasks queued: QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MOD</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">E QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE Q</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">UICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUIC</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">K_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_M</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">ODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class=""> QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QU</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">ICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MO</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">DE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUI</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">CK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MOD</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">E QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE Q</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">UICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUIC</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">K_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_M</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">ODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE QUICK_MODE …</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">xxx-yyy-zzz-10-228-0-0-16[2621]: Tasks active: QUICK_MODE</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">xxx-yyy-zzz-10-228-0-0-16[2621]: Tasks passive: QUICK_MODE QUICK_MODE QUICK_MODE</font></div></div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">We updated to 5.3.5 hoping we’d fix this because when it’s showing this, we see in the logs</div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class=""><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">Dec 7 18:24:39 ip-100-93-64-90 charon: 07[ENC] invalid HASH_V1 payload length, decryption failed?</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">Dec 7 18:24:39 ip-100-93-64-90 charon: 07[ENC] could not decrypt payloads</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">Dec 7 18:24:39 ip-100-93-64-90 charon: 07[IKE] message parsing failed</font></div><div style="margin: 0px; line-height: normal;" class=""><font face="Courier" class="">Dec 7 18:24:39 ip-100-93-64-90 charon: 07[ENC] generating INFORMATIONAL_V1 request 2524142361 [ HASH N(PLD_MAL) ]</font></div></div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">It looked like the below resolved fix would resolve it, but I seem to be missing a piece.</div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class=""><a href="https://wiki.strongswan.org/issues/1120" class="">https://wiki.strongswan.org/issues/1120</a></div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">Restarting ipsec doesn’t seem to fix it, only a reboot of the machine at this point, leading me to a resource exhaustion thought.</div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class=""><div style="margin: 0px; line-height: normal;" class="">Any thoughts on what we can do to stabilize the tunnel?</div><div class=""><br class=""></div></div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">Thanks</div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class="">EKG</div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; line-height: normal;" class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>