<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top: 0px; margin-bottom: 0px;"></p>
<p>Hi all,</p>
<p>I am facing a problem of load-tester that "%d" of initiator_id didnot start from 1, but from 2.</p>
<p>--------<br>
initiator_id = tester%d@strongswan.org<br>
--------</p>
<p>Below are the configuration of load-tester and the status of the ipsec tunnels.<br>
>From the "ipsec statuall" you can find that initiator id started from "tester2@strongswan.org",<br>
and the private address also started from "10.254.32.2/32".</p>
<p>I suspect that any internal behavior has used "tester1@strongswan.org", <br>
or any configuration caused the initiator_id started from "2".</p>
<p>Can anyone give me some advice ?<br>
Any comment will be appreciated.<br>
If further info is needed, please let me know.</p>
<p>------------- configuration ------------<br>
root@tester1:/usr/local/etc# cat strongswan.conf<br>
# strongswan.conf - strongSwan configuration file<br>
#<br>
# Refer to the strongswan.conf(5) manpage for details<br>
#<br>
# Configuration changes should be made in the included files<br>
charon {<br>
reuse_ikesa=yes<br>
load_modular=yes</p>
<p> plugins {<br>
include strongswan.d/charon/*.conf<br>
load-tester {</p>
<p> enable = yes<br>
responder = 192.168.0.6<br>
proposal = aes128-sha1-modp1024<br>
initiator_id = tester%d@strongswan.org<br>
initiator_match = *@strongswan.org<br>
initiator_auth = eap-aka<br>
responder_auth = psk<br>
responder_id = strongswan.org<br>
initiator_tsr = 10.65.0.0/18<br>
esp = aes128-sha1<br>
addrs { ens4 = 10.64.0.1/18 }<br>
addrs_prefix = 16<br>
request_virtual_ip = yes<br>
ike_rekey = 25200<br>
child_rekey = 28800<br>
delete_after_established = no<br>
shutdown_when_complete = no<br>
}<br>
}<br>
<br>
--------------------------------------- </p>
<p>root@tester1:/usr/local/etc#ipsec statusall</p>
<p>Listening IP addresses:<br>
10.59.128.33<br>
10.64.127.253<br>
Connections:<br>
load-test: 192.168.0.6...0.0.0.0 IKEv1/2<br>
load-test: local: [strongswan.org] uses pre-shared key authentication<br>
load-test: remote: [*@strongswan.org] uses EAP_AKA authentication<br>
load-test: child: 10.65.0.0/18 === dynamic TUNNEL<br>
Security Associations (5 up, 0 connecting):<br>
load-test[5]: ESTABLISHED 6 seconds ago, 10.64.0.5[tester6@strongswan.org]...192.168.0.6[strongswan.org]<br>
load-test[5]: IKEv2 SPIs: 66a396f7c9e152c1_i* e1200a4eb1b5f253_r, rekeying in 6 hours<br>
load-test[5]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br>
load-test{6}: INSTALLED, TUNNEL, reqid 5, ESP SPIs: c5ef7bad_i 0015790e_o<br>
load-test{6}: AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 7 hours<br>
load-test{6}: 10.254.32.6/32 === 10.65.0.0/18<br>
load-test[4]: ESTABLISHED 10 seconds ago, 10.64.0.4[tester5@strongswan.org]...192.168.0.6[strongswan.org]<br>
load-test[4]: IKEv2 SPIs: 15455d79dbc1b476_i* cb3974e5683d2f37_r, rekeying in 6 hours<br>
load-test[4]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br>
load-test{4}: INSTALLED, TUNNEL, reqid 4, ESP SPIs: c31265b7_i 001353b9_o<br>
load-test{4}: AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 7 hours<br>
load-test{4}: 10.254.32.5/32 === 10.65.0.0/18<br>
load-test[3]: ESTABLISHED 13 seconds ago, 10.64.0.3[tester4@strongswan.org]...192.168.0.6[strongswan.org]<br>
load-test[3]: IKEv2 SPIs: bbfa251802593dc9_i* 84935f6a6411adf6_r, rekeying in 6 hours<br>
load-test[3]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br>
load-test{3}: INSTALLED, TUNNEL, reqid 3, ESP SPIs: c1625dab_i 00132117_o<br>
load-test{3}: AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 7 hours<br>
load-test{3}: 10.254.32.4/32 === 10.65.0.0/18<br>
load-test[2]: ESTABLISHED 16 seconds ago, 10.64.0.2[tester3@strongswan.org]...192.168.0.6[strongswan.org]<br>
load-test[2]: IKEv2 SPIs: ca01109e85be6828_i* 2ea11c57bd317fe2_r, rekeying in 6 hours<br>
load-test[2]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br>
load-test{2}: INSTALLED, TUNNEL, reqid 2, ESP SPIs: c003619c_i 001423af_o<br>
load-test{2}: AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 7 hours<br>
load-test{2}: 10.254.32.3/32 === 10.65.0.0/18<br>
load-test[1]: ESTABLISHED 19 seconds ago, 10.64.0.1[tester2@strongswan.org]...192.168.0.6[strongswan.org]<br>
load-test[1]: IKEv2 SPIs: 208894470b3f7123_i* 2b2b934095b76978_r, rekeying in 6 hours<br>
load-test[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br>
load-test{1}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: c5900c71_i 001457a4_o<br>
load-test{1}: AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 7 hours<br>
load-test{1}: 10.254.32.2/32 === 10.65.0.0/18<br>
<br>
root@tester1:/usr/local/etc#</p>
<p>--------------------------------------- </p>
<p>Regards,<br>
Pluto</p>
<p></p>
<p><br>
</p>
</div>
</body>
</html>