<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div dir="ltr">Hi Andreas,
<div><br>
</div>
<div>Thanks for the input. Appreciate it.</div>
<div><br>
</div>
<div>The behaviour I observe makes sense now.</div>
<div><br>
</div>
<div>We have the following in ipsec.conf</div>
<div><br>
</div>
<div>ikelifetime=86400s</div>
<div>keylife=3600s</div>
<div><br>
</div>
<div>So CHILD_SAs get closed after keylife reaches 1 hour mark if there is no traffic sent / received.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Terry</div>
<div><br>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On 12 September 2017 at 16:38, Andreas Steffen <span dir="ltr">
<<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Terry,<br>
<br>
by default no inactivity timer is set. In the default case<br>
the CHILD SA exists until it expires.<br>
<br>
Regards<br>
<br>
Andreas<br>
<br>
On 12.09.2017 08:50, Terry Wang wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi folks,<br>
<br>
I've been assigned to review IPsec VPN deployment configurations<br>
(hundreds of strongSwan 5.3.2).<br>
<br>
I want to understand how CHILD_SAs are closed if there is no traffic<br>
sent or received.<br>
<br>
Based on: <a href="https://wiki.strongswan.org/projects/strongswan/wiki/ConnSection" rel="noreferrer" target="_blank">
https://wiki.strongswan.org/pr<wbr>ojects/strongswan/wiki/ConnSec<wbr>tion</a><br>
<br>
`inactivity` defines the timeout interval after which a CHILD_SA (phase<br>
2 SA) is closed if it does not send or receive any traffic.<br>
<br>
I've looked at the source code:<br>
<br>
* src/libcharon/config/child_cfg<wbr>.c<br>
* src/libcharon/config/child_cfg<wbr>.h<br>
<br>
There is no default value assigned to the variable inactivity<br>
(uint32_t). So how does charon (strongSwan) decide when to close a<br>
CHILD_SA if no traffic is sent/received.<br>
<br>
Thanks,<br>
Terry<br>
<br>
<span class="HOEnZb"><font color="#888888"></font></span></blockquote>
<span class="HOEnZb"><font color="#888888"><br>
-- <br>
==============================<wbr>==============================<wbr>==========<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.<wbr>org</a><br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org" rel="noreferrer" target="_blank">
www.strongswan.org</a><br>
Institute for Networked Solutions<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
==============================<wbr>=============================[<wbr>INS-HSR]==<br>
</font></span></blockquote>
</div>
<br>
</div>
</div>
</body>
</html>