<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>We've seen different roadwarrior users with the same IP address on ESTABLISHED connections in swanctl --list-sas. I'm posting here the details of our setup and what we think the problem is in case someone might have a different idea or in case this could be useful for someone else. We are probably going to retry enabling the DHCP plugin in a testing environment at a later date.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We're using a Strongswan 5.5.3 vpn gateway on Linux (Centos 7) with Android clients road-warriors .<o:p></o:p></p><p class=MsoNormal>We rely on unique=replace in swanctl.conf to clean up old dead connection from clients which ended their connection while not able to reach the gateway. <o:p></o:p></p><p class=MsoNormal>(The next time this client connects the old connection is replaced.) We are not using dead peer detection or rekeys on the gateway.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We are using the DHCP plugin to assign IP addresses. Our DHCP server is not configured to ping an IP address before making an assignment.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Some of our users were complaining about connectivity issues. When we checked "swanctl --list-sas" we could see that the users complaining were on "ESTABLISHED" connections and shared an IP address with another user.<o:p></o:p></p><p class=MsoNormal>We reviewed the logs of our DHCP server and it did not seem to assign IP addresses unless they had been previously released.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We looked at strongswan's log and it seemed like "deleting duplicate IKE_SA for peer ..." was often followed by a DHCP release a few minutes later. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We think we managed reproduce with the following steps:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>1. RW1 connects to the gateway<o:p></o:p></p><p class=MsoNormal>2. RW1 roams to a wifi where the gateway is unreachable<o:p></o:p></p><p class=MsoNormal>3. RW1 ends its VPN connection in the Android UI<o:p></o:p></p><p class=MsoNormal>4. RW1 roams to a wifi where the gateway is reachable<o:p></o:p></p><p class=MsoNormal>5. RW1 connects to the gateway again -- this triggers "deleting duplicate IKE_SA for peer ..."<o:p></o:p></p><p class=MsoNormal>6. With swanctl --list-sas we can see that RW1 has two connection (one is ESTABLISHED, the other one is on its way for deletion)<o:p></o:p></p><p class=MsoNormal>7. A few minutes later we can see a DHCP release for RW1's address.<o:p></o:p></p><p class=MsoNormal>8. RW2 connects later and is assigned the same IP address RW1 is still using.<o:p></o:p></p><p class=MsoNormal>9. With swanctl --list-sas we can see that RW1 and RW2 have the same IP address.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We switched to using a pool in the swanctl configuration file and have not seen any problems so far.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Here are the some of the configuration we are using. I've also included some logs but I have redacted hostnames and IP addresses as this gateway has a public facing IP address.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>dhcp.conf:<o:p></o:p></p><p class=MsoNormal>dhcp {<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> # Always use the configured server address.<o:p></o:p></p><p class=MsoNormal> force_server_address = yes<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> # Derive user-defined MAC address from hash of IKE identity.<o:p></o:p></p><p class=MsoNormal> identity_lease = yes<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> # Interface name the plugin uses for address allocation.<o:p></o:p></p><p class=MsoNormal> interface = ens192<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> # Whether to load the plugin. Can also be an integer to increase the<o:p></o:p></p><p class=MsoNormal> # priority of this plugin.<o:p></o:p></p><p class=MsoNormal> load = yes<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> # DHCP server unicast or broadcast IP address.<o:p></o:p></p><p class=MsoNormal> server = 255.255.255.255<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>}<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>swanctl.conf:<o:p></o:p></p><p class=MsoNormal>connections {<o:p></o:p></p><p class=MsoNormal> # connection for Android mobile users<o:p></o:p></p><p class=MsoNormal> EnrollmentAndroidUsers {<o:p></o:p></p><p class=MsoNormal> local {<o:p></o:p></p><p class=MsoNormal> auth = pubkey<o:p></o:p></p><p class=MsoNormal> certs = enrollment.ecdsa.pem<o:p></o:p></p><p class=MsoNormal> id = gw1.somedomain.com<o:p></o:p></p><p class=MsoNormal> }<o:p></o:p></p><p class=MsoNormal> remote {<o:p></o:p></p><p class=MsoNormal> auth = pubkey<o:p></o:p></p><p class=MsoNormal> id = %any<o:p></o:p></p><p class=MsoNormal> revocation = strict<o:p></o:p></p><p class=MsoNormal> }<o:p></o:p></p><p class=MsoNormal> children {<o:p></o:p></p><p class=MsoNormal> net {<o:p></o:p></p><p class=MsoNormal> local_ts = 0.0.0.0/0<o:p></o:p></p><p class=MsoNormal> start_action = none<o:p></o:p></p><p class=MsoNormal> rekey_time = 0<o:p></o:p></p><p class=MsoNormal> esp_proposals = aes128gcm64-ecp384, aes128-sha256-ecp256, aes128-sha<o:p></o:p></p><p class=MsoNormal> ipcomp = no<o:p></o:p></p><p class=MsoNormal> }<o:p></o:p></p><p class=MsoNormal> }<o:p></o:p></p><p class=MsoNormal> encap = yes<o:p></o:p></p><p class=MsoNormal> local_addrs = <gw1 public ip><o:p></o:p></p><p class=MsoNormal> pools = dhcp<o:p></o:p></p><p class=MsoNormal> version = 2<o:p></o:p></p><p class=MsoNormal> dpd_delay = 0<o:p></o:p></p><p class=MsoNormal> rekey_time = 0<o:p></o:p></p><p class=MsoNormal> unique = replace<o:p></o:p></p><p class=MsoNormal> fragmentation = yes<o:p></o:p></p><p class=MsoNormal> proposals = aes256-sha384-ecp384, aes256-sha256-ecp256, aes256-sha384-modp2048, aes256-sha384-modp1024<o:p></o:p></p><p class=MsoNormal> send_cert = always<o:p></o:p></p><p class=MsoNormal> }<o:p></o:p></p><p class=MsoNormal>}<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>#### Roadwarrior rw1 reconnects after beeing offline<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> received packet: from <some public ip>[27258] to <gw1 public ip>[500] (306 bytes)<o:p></o:p></p><p class=MsoNormal>#### Skipping most authentication logs<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> authentication of 'CN=device.rw1.enroll.somedomain.com' with RSA_EMSA_PKCS1_SHA2_256 successful<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> peer supports MOBIKE<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> authentication of 'gw1.somedomain.com' (myself) with RSA_EMSA_PKCS1_SHA2_384 successful<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> deleting duplicate IKE_SA for peer 'CN=device.rw1.enroll.somedomain.com' due to uniqueness policy<o:p></o:p></p><p class=MsoNormal>#### unique=replace previous connection is queued for deletion<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <notice> deleting IKE_SA EnrollmentAndroidUsers[2] between <gw1 public ip>[gw1.somedomain.com]...<some public ip>[CN=device.rw1.enroll.somedomain.com]<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> sending DELETE for IKE_SA EnrollmentAndroidUsers[2]<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> generating INFORMATIONAL request 0 [ D ]<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> sending packet: from <gw1 public ip>[4500] to <some public ip>[3133] (88 bytes)<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <notice> IKE_SA EnrollmentAndroidUsers[65] established between <gw1 public ip>[gw1.somedomain.com]...<some public ip>[CN=device.rw1.enroll.somedomain.com]<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> sending end entity cert "ST=Quebec, L=Longueuil, O=Radio-IP, OU=Dev, CN=gw1.somedomain.com-enrollment.ecdsa"<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> peer requested virtual IP %any<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> sending DHCP DISCOVER to 255.255.255.255<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> received DHCP OFFER 192.168.1.3 from 192.168.1.1<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> sending DHCP REQUEST for 192.168.1.3 to 192.168.1.1<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> received DHCP ACK for 192.168.1.3<o:p></o:p></p><p class=MsoNormal>Sep 29 08:49:52 gw1 charon-systemd: <info> assigning virtual IP 192.168.1.3 to peer 'CN=device.rw1.enroll.somedomain.com'<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>#### minutes later, strongswan seems to give up trying to delete the first connection cleanly<o:p></o:p></p><p class=MsoNormal>Sep 29 08:52:37 gw1 charon-systemd: <info> giving up after 5 retransmits<o:p></o:p></p><p class=MsoNormal>Sep 29 08:52:37 gw1 charon-systemd: <info> proper IKE_SA delete failed, peer not responding<o:p></o:p></p><p class=MsoNormal>Sep 29 08:52:37 gw1 charon-systemd: <info> sending DHCP RELEASE for 192.168.1.3 to 192.168.1.1<o:p></o:p></p><p class=MsoNormal>#### 192.168.1.3 is released! Its still beeing used by the new connection of rw1<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>#### Later, a different user connects and is assigned 192.168.1.3<o:p></o:p></p><p class=MsoNormal>Sep 29 09:43:13 gw1 charon-systemd: <info> authentication of 'gw1.somedomain.com' (myself) with RSA_EMSA_PKCS1_SHA2_384 successful<o:p></o:p></p><p class=MsoNormal>Sep 29 09:43:13 gw1 charon-systemd: <notice> IKE_SA EnrollmentAndroidUsers[66] established between <gw1 public ip>[gw1.somedomain.com]...<some public ip>[CN=device.rw2.enroll.somedomain.com]<o:p></o:p></p><p class=MsoNormal>Sep 29 09:43:13 gw1 charon-systemd: <info> sending end entity cert "ST=Quebec, L=Longueuil, O=Radio-IP, OU=Dev, CN=gw1.somedomain.com-enrollment.ecdsa"<o:p></o:p></p><p class=MsoNormal>Sep 29 09:43:13 gw1 charon-systemd: <info> peer requested virtual IP %any<o:p></o:p></p><p class=MsoNormal>Sep 29 09:43:13 gw1 charon-systemd: <info> sending DHCP DISCOVER to 255.255.255.255<o:p></o:p></p><p class=MsoNormal>Sep 29 09:43:13 gw1 charon-systemd: <info> received DHCP OFFER 192.168.1.3 from 192.168.1.1<o:p></o:p></p><p class=MsoNormal>Sep 29 09:43:13 gw1 charon-systemd: <info> sending DHCP REQUEST for 192.168.1.3 to 192.168.1.1<o:p></o:p></p><p class=MsoNormal>Sep 29 09:43:13 gw1 charon-systemd: <info> received DHCP ACK for 192.168.1.3<o:p></o:p></p><p class=MsoNormal>Sep 29 09:43:13 gw1 charon-systemd: <info> assigning virtual IP 192.168.1.3 to peer 'CN=device.rw2.enroll.somedomain.com'<o:p></o:p></p><p class=MsoNormal>#### At this point in time we have two active "ESTABLISHED" connections using 192.168.1.3<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Laurent<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>