<html><head></head><body><div class="yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div dir="ltr" data-setdir="false"><div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;" data-setdir="false">Hi, </div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;"><u><br></u></div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;"><u>Setup</u></div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;">I have one IKE Responder and two IKE initiators (with different identities) which are able to establish IKE SA with the responder successfully.</div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;"><u>Version</u></div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;"><div>strongSwan 5.7.2dr2 swanctl</div></div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;"><br></div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;"><u>Issue</u></div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;">I want to establish additional CHILD_SA for each of these IKE-SA initiators from <u>Responder</u></div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;">However, both initiators IKE entries are assigned same connection name "net-net". In my ipsec.conf settings, connection name is given "net-net". </div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;">My problem is that when I initiate CHILD_SA using swanctl --initiate command, then I cannot identify separate IKE-SAs as both are assigned same name by Charon daemon.</div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;"><br></div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;">Please find output of command and ipsec.conf in the attached file.</div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;"><br></div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;"><u>Queries</u></div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;">1. How to configure Responder to have each entry as separate connection name? I know I can define separate conn name configuration in .conf file but if I have 100K of connections then it will lead to big .conf file, which is difficult to manage.</div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;">1. Can I dynamically load <u>only</u> child configuration using "load_conn" command and then initiate CHILD_SA for that particular child with the child name. </div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;">I also tried to use GoVICI interface to load configurations (with same connection name) using load_conn command but it created new entry rather than updating existing one. </div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;"><br></div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;">Warm Regards,</div><div dir="ltr" style="font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 16px;">Pankaj</div></div><br></div></div></body></html>