<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We force Ikev2 client to use their local internet for browsing instead of remote server<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
i have configured Strongswan 5.9 on Centos8. here is below routing.</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<p style="margin:0.0px 0.0px 0.0px 0.0px;font:9.0px Menlo;color:#ffffff;background-color:rgba(0, 0, 0, 0.81)">
<span style="font-variant-ligatures:no-common-ligatures">default via 172.31.32.1 dev eth0 proto dhcp metric 100<span class="Apple-converted-space"> </span></span></p>
<p style="margin:0.0px 0.0px 0.0px 0.0px;font:9.0px Menlo;color:#ffffff;background-color:rgba(0, 0, 0, 0.81)">
<span style="font-variant-ligatures:no-common-ligatures">172.31.32.0/20 dev eth0 proto kernel scope link src 172.31.42.77 metric 100<span class="Apple-converted-space"> </span></span></p>
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Users <users-bounces@lists.strongswan.org> on behalf of users-request@lists.strongswan.org <users-request@lists.strongswan.org><br>
<b>Sent:</b> Tuesday, March 9, 2021 8:07 PM<br>
<b>To:</b> users@lists.strongswan.org <users@lists.strongswan.org><br>
<b>Subject:</b> Users Digest, Vol 134, Issue 7</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">Send Users mailing list submissions to<br>
users@lists.strongswan.org<br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.strongswan.org/mailman/listinfo/users">https://lists.strongswan.org/mailman/listinfo/users</a><br>
or, via email, send a message with subject or body 'help' to<br>
users-request@lists.strongswan.org<br>
<br>
You can reach the person managing the list at<br>
users-owner@lists.strongswan.org<br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: IKEv1 Phase 1 rekey deletes Phase 2 SA (Sean B)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Tue, 9 Mar 2021 12:06:47 -0500<br>
From: Sean B <sb3957312@gmail.com><br>
To: users@lists.strongswan.org<br>
Subject: Re: [strongSwan] IKEv1 Phase 1 rekey deletes Phase 2 SA<br>
Message-ID:<br>
<CA+c0=jfcwW4BW=vY0O87bLpWJzSeQez5HbLySkZi7_6U-6D4Nw@mail.gmail.com><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Adding charon_debug.log:<br>
Tue, 2021-03-09, %H:32:09 00[DMN] Starting IKE charon daemon (strongSwan<br>
5.8.4, Linux 5.5.0-kali2-amd64, x86_64)<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'aesni': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'aes': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'rc2': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'sha2': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'sha1': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'md5': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'mgf1': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'random': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'nonce': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'x509': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'revocation': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'constraints': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'pubkey': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'pkcs1': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'pkcs7': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'pkcs8': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'pkcs12': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'pgp': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'dnskey': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'sshkey': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'pem': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'openssl': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'fips-prf': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'gmp': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'agent': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'xcbc': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'hmac': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'gcm': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'drbg': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'attr': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'kernel-netlink': loaded<br>
successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'resolve': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'socket-default': loaded<br>
successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'connmark': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'stroke': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'updown': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'eap-mschapv2': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'xauth-generic': loaded<br>
successfully<br>
Tue, 2021-03-09, %H:32:09 00[LIB] plugin 'counters': loaded successfully<br>
Tue, 2021-03-09, %H:32:09 00[KNL] known interfaces and IP addresses:<br>
Tue, 2021-03-09, %H:32:09 00[KNL] lo<br>
Tue, 2021-03-09, %H:32:09 00[KNL] 127.0.0.1<br>
Tue, 2021-03-09, %H:32:09 00[KNL] ::1<br>
Tue, 2021-03-09, %H:32:09 00[KNL] eth0<br>
Tue, 2021-03-09, %H:32:09 00[KNL] 10.100.1.66<br>
Tue, 2021-03-09, %H:32:09 00[KNL] fe80::7ddb:e857:c734:34bf<br>
Tue, 2021-03-09, %H:32:09 00[KNL] fe80::435e:56e6:3941:5794<br>
Tue, 2021-03-09, %H:32:09 00[KNL] fe80::e8af:3339:4054:be35<br>
Tue, 2021-03-09, %H:32:09 00[KNL] eth1<br>
Tue, 2021-03-09, %H:32:09 00[KNL] 192.19.22.10<br>
Tue, 2021-03-09, %H:32:09 00[KNL] fe80::4d93:72c5:862e:b87f<br>
Tue, 2021-03-09, %H:32:09 00[KNL] ciscogl<br>
Tue, 2021-03-09, %H:32:09 00[KNL] 172.19.22.10<br>
Tue, 2021-03-09, %H:32:09 00[KNL] fe80::ac43:a10d:f6a4:d424<br>
Tue, 2021-03-09, %H:32:09 00[KNL] docker0<br>
Tue, 2021-03-09, %H:32:09 00[KNL] 172.17.0.1<br>
Tue, 2021-03-09, %H:32:09 00[LIB] feature PUBKEY:BLISS in plugin 'pem' has<br>
unmet dependency: PUBKEY:BLISS<br>
Tue, 2021-03-09, %H:32:09 00[LIB] feature PUBKEY:DSA in plugin 'pem' has<br>
unmet dependency: PUBKEY:DSA<br>
Tue, 2021-03-09, %H:32:09 00[LIB] feature PRIVKEY:DSA in plugin 'pem' has<br>
unmet dependency: PRIVKEY:DSA<br>
Tue, 2021-03-09, %H:32:09 00[LIB] feature PRIVKEY:BLISS in plugin 'pem' has<br>
unmet dependency: PRIVKEY:BLISS<br>
Tue, 2021-03-09, %H:32:09 00[LIB] feature CERT_DECODE:OCSP_REQUEST in<br>
plugin 'pem' has unmet dependency: CERT_DECODE:OCSP_REQUEST<br>
Tue, 2021-03-09, %H:32:09 00[CFG] loading ca certificates from<br>
'/etc/ipsec.d/cacerts'<br>
Tue, 2021-03-09, %H:32:09 00[CFG] loaded ca certificate "C=CA, CN=Root<br>
CA, ST=ON, L=Ottawa, O=Lightship Security, OU=CC1903" from<br>
'/etc/ipsec.d/cacerts/ca.cert.pem'<br>
Tue, 2021-03-09, %H:32:09 00[CFG] loading aa certificates from<br>
'/etc/ipsec.d/aacerts'<br>
Tue, 2021-03-09, %H:32:09 00[CFG] loading ocsp signer certificates from<br>
'/etc/ipsec.d/ocspcerts'<br>
Tue, 2021-03-09, %H:32:09 00[CFG] loading attribute certificates from<br>
'/etc/ipsec.d/acerts'<br>
Tue, 2021-03-09, %H:32:09 00[CFG] loading crls from '/etc/ipsec.d/crls'<br>
Tue, 2021-03-09, %H:32:09 00[CFG] loading secrets from '/etc/ipsec.secrets'<br>
Tue, 2021-03-09, %H:32:09 00[CFG] expanding file expression<br>
'/var/lib/strongswan/ipsec.secrets.inc' failed<br>
Tue, 2021-03-09, %H:32:09 00[CFG] loaded IKE secret for %any<br>
Tue, 2021-03-09, %H:32:09 00[LIB] loaded plugins: charon aesni aes rc2 sha2<br>
sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7<br>
pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm<br>
drbg attr kernel-netlink resolve socket-default connmark stroke updown<br>
eap-mschapv2 xauth-generic counters<br>
Tue, 2021-03-09, %H:32:09 00[LIB] unable to load 5 plugin features (5 due<br>
to unmet dependencies)<br>
Tue, 2021-03-09, %H:32:09 00[LIB] dropped capabilities, running as uid 0,<br>
gid 0<br>
Tue, 2021-03-09, %H:32:09 00[JOB] spawning 16 worker threads<br>
Tue, 2021-03-09, %H:32:09 01[LIB] created thread 01 [25657]<br>
Tue, 2021-03-09, %H:32:09 02[LIB] created thread 02 [25658]<br>
Tue, 2021-03-09, %H:32:09 03[LIB] created thread 03 [25656]<br>
Tue, 2021-03-09, %H:32:09 04[LIB] created thread 04 [25659]<br>
Tue, 2021-03-09, %H:32:09 05[LIB] created thread 05 [25660]<br>
Tue, 2021-03-09, %H:32:09 06[LIB] created thread 06 [25655]<br>
Tue, 2021-03-09, %H:32:09 07[LIB] created thread 07 [25661]<br>
Tue, 2021-03-09, %H:32:09 08[LIB] created thread 08 [25662]<br>
Tue, 2021-03-09, %H:32:09 09[LIB] created thread 09 [25654]<br>
Tue, 2021-03-09, %H:32:09 10[LIB] created thread 10 [25663]<br>
Tue, 2021-03-09, %H:32:09 11[LIB] created thread 11 [25664]<br>
Tue, 2021-03-09, %H:32:09 12[LIB] created thread 12 [25665]<br>
Tue, 2021-03-09, %H:32:09 13[LIB] created thread 13 [25666]<br>
Tue, 2021-03-09, %H:32:09 14[LIB] created thread 14 [25653]<br>
Tue, 2021-03-09, %H:32:09 15[LIB] created thread 15 [25667]<br>
Tue, 2021-03-09, %H:32:09 16[LIB] created thread 16 [25652]<br>
Tue, 2021-03-09, %H:32:09 05[CFG] received stroke: add connection 'VPNPeer'<br>
Tue, 2021-03-09, %H:32:09 05[CFG] conn VPNPeer<br>
Tue, 2021-03-09, %H:32:09 05[CFG] left=192.19.22.10<br>
Tue, 2021-03-09, %H:32:09 05[CFG] leftauth=psk<br>
Tue, 2021-03-09, %H:32:09 05[CFG] leftupdown=ipsec _updown iptables<br>
Tue, 2021-03-09, %H:32:09 05[CFG] right=192.19.22.1<br>
Tue, 2021-03-09, %H:32:09 05[CFG] rightauth=psk<br>
Tue, 2021-03-09, %H:32:09 05[CFG] ike=aes256-sha1-modp2048 !<br>
Tue, 2021-03-09, %H:32:09 05[CFG] esp=aes128-sha1-modp2048 !<br>
Tue, 2021-03-09, %H:32:09 05[CFG] dpddelay=30<br>
Tue, 2021-03-09, %H:32:09 05[CFG] dpdtimeout=150<br>
Tue, 2021-03-09, %H:32:09 05[CFG] sha256_96=no<br>
Tue, 2021-03-09, %H:32:09 05[CFG] mediation=no<br>
Tue, 2021-03-09, %H:32:09 05[CFG] keyexchange=ikev1<br>
Tue, 2021-03-09, %H:32:09 05[KNL] 192.19.22.1 is not a local address or the<br>
interface is down<br>
Tue, 2021-03-09, %H:32:09 05[CFG] added configuration 'VPNPeer'<br>
Tue, 2021-03-09, %H:32:17 07[NET] <1> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (244 bytes)<br>
Tue, 2021-03-09, %H:32:17 07[ENC] <1> parsed ID_PROT request 0 [ SA V V V V<br>
]<br>
Tue, 2021-03-09, %H:32:17 07[CFG] <1> looking for an IKEv1 config for<br>
192.19.22.10...192.19.22.1<br>
Tue, 2021-03-09, %H:32:17 07[CFG] <1> candidate:<br>
192.19.22.10...192.19.22.1, prio 3100<br>
Tue, 2021-03-09, %H:32:17 07[CFG] <1> found matching ike config:<br>
192.19.22.10...192.19.22.1 with prio 3100<br>
Tue, 2021-03-09, %H:32:17 07[IKE] <1> received NAT-T (RFC 3947) vendor ID<br>
Tue, 2021-03-09, %H:32:17 07[IKE] <1> received<br>
draft-ietf-ipsec-nat-t-ike-07 vendor ID<br>
Tue, 2021-03-09, %H:32:17 07[IKE] <1> received<br>
draft-ietf-ipsec-nat-t-ike-03 vendor ID<br>
Tue, 2021-03-09, %H:32:17 07[IKE] <1> received<br>
draft-ietf-ipsec-nat-t-ike-02\n vendor ID<br>
Tue, 2021-03-09, %H:32:17 07[IKE] <1> 192.19.22.1 is initiating a Main Mode<br>
IKE_SA<br>
Tue, 2021-03-09, %H:32:17 07[IKE] <1> IKE_SA (unnamed)[1] state change:<br>
CREATED => CONNECTING<br>
Tue, 2021-03-09, %H:32:17 07[CFG] <1> selecting proposal:<br>
Tue, 2021-03-09, %H:32:17 07[CFG] <1> proposal matches<br>
Tue, 2021-03-09, %H:32:17 07[CFG] <1> received proposals:<br>
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048,<br>
IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048,<br>
IKE:AES_CBC_192/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<br>
Tue, 2021-03-09, %H:32:17 07[CFG] <1> configured proposals:<br>
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<br>
Tue, 2021-03-09, %H:32:17 07[CFG] <1> selected proposal:<br>
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<br>
Tue, 2021-03-09, %H:32:17 07[IKE] <1> sending XAuth vendor ID<br>
Tue, 2021-03-09, %H:32:17 07[IKE] <1> sending DPD vendor ID<br>
Tue, 2021-03-09, %H:32:17 07[IKE] <1> sending NAT-T (RFC 3947) vendor ID<br>
Tue, 2021-03-09, %H:32:17 07[ENC] <1> generating ID_PROT response 0 [ SA V<br>
V V ]<br>
Tue, 2021-03-09, %H:32:17 07[NET] <1> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (136 bytes)<br>
Tue, 2021-03-09, %H:32:17 08[NET] <1> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (412 bytes)<br>
Tue, 2021-03-09, %H:32:17 08[ENC] <1> parsed ID_PROT request 0 [ KE No V V<br>
V NAT-D NAT-D ]<br>
Tue, 2021-03-09, %H:32:17 08[IKE] <1> received DPD vendor ID<br>
Tue, 2021-03-09, %H:32:17 08[ENC] <1> received unknown vendor ID:<br>
10:f9:6f:0a:50:a5:1b:9c:da:5b:9b:ec:f8:f8:1e:3e<br>
Tue, 2021-03-09, %H:32:17 08[IKE] <1> received XAuth vendor ID<br>
Tue, 2021-03-09, %H:32:17 08[LIB] <1> size of DH secret exponent: 2047 bits<br>
Tue, 2021-03-09, %H:32:17 08[CFG] <1> candidate "VPNPeer", match:<br>
1/1/3100 (me/other/ike)<br>
Tue, 2021-03-09, %H:32:17 08[ENC] <1> generating ID_PROT response 0 [ KE No<br>
NAT-D NAT-D ]<br>
Tue, 2021-03-09, %H:32:17 08[NET] <1> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (372 bytes)<br>
Tue, 2021-03-09, %H:32:17 09[NET] <1> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (108 bytes)<br>
Tue, 2021-03-09, %H:32:17 09[ENC] <1> parsed ID_PROT request 0 [ ID HASH<br>
N(INITIAL_CONTACT) ]<br>
Tue, 2021-03-09, %H:32:17 09[CFG] <1> looking for pre-shared key peer<br>
configs matching 192.19.22.10...192.19.22.1[192.19.22.1]<br>
Tue, 2021-03-09, %H:32:17 09[CFG] <1> candidate "VPNPeer", match:<br>
1/20/3100 (me/other/ike)<br>
Tue, 2021-03-09, %H:32:17 09[CFG] <1> selected peer config "VPNPeer"<br>
Tue, 2021-03-09, %H:32:17 09[IKE] <VPNPeer|1> IKE_SA VPNPeer[1] established<br>
between 192.19.22.10[192.19.22.10]...192.19.22.1[192.19.22.1]<br>
Tue, 2021-03-09, %H:32:17 09[IKE] <VPNPeer|1> IKE_SA VPNPeer[1] state<br>
change: CONNECTING => ESTABLISHED<br>
Tue, 2021-03-09, %H:32:17 09[IKE] <VPNPeer|1> scheduling reauthentication<br>
in 86400s<br>
Tue, 2021-03-09, %H:32:17 09[IKE] <VPNPeer|1> maximum IKE_SA lifetime 86400s<br>
Tue, 2021-03-09, %H:32:17 09[ENC] <VPNPeer|1> generating ID_PROT response 0<br>
[ ID HASH ]<br>
Tue, 2021-03-09, %H:32:17 09[NET] <VPNPeer|1> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (76 bytes)<br>
Tue, 2021-03-09, %H:32:17 11[NET] <VPNPeer|1> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (444 bytes)<br>
Tue, 2021-03-09, %H:32:17 11[ENC] <VPNPeer|1> parsed QUICK_MODE request<br>
256501508 [ HASH SA No KE ID ID ]<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> looking for a child config<br>
for 192.19.22.10/32 === 192.19.22.1/32<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> proposing traffic selectors<br>
for us:<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> 192.19.22.10/32<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> proposing traffic selectors<br>
for other:<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> 192.19.22.1/32<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> candidate "VPNPeer" with<br>
prio 5+5<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> found matching child config<br>
"VPNPeer" with prio 10<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> selecting traffic selectors<br>
for other:<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> config: 192.19.22.1/32,<br>
received: 192.19.22.1/32 => match: 192.19.22.1/32<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> selecting traffic selectors<br>
for us:<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> config: 192.19.22.10/32,<br>
received: 192.19.22.10/32 => match: 192.19.22.10/32<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> selecting proposal:<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> proposal matches<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> received proposals:<br>
ESP:AES_CBC_128/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> configured proposals:<br>
ESP:AES_CBC_128/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ<br>
Tue, 2021-03-09, %H:32:17 11[CFG] <VPNPeer|1> selected proposal:<br>
ESP:AES_CBC_128/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ<br>
Tue, 2021-03-09, %H:32:17 11[IKE] <VPNPeer|1> received 1000000000<br>
lifebytes, configured 0<br>
Tue, 2021-03-09, %H:32:17 11[LIB] <VPNPeer|1> size of DH secret exponent:<br>
2047 bits<br>
Tue, 2021-03-09, %H:32:17 11[KNL] <VPNPeer|1> got SPI c8bf9eca<br>
Tue, 2021-03-09, %H:32:17 11[ENC] <VPNPeer|1> generating QUICK_MODE<br>
response 256501508 [ HASH SA No KE ID ID ]<br>
Tue, 2021-03-09, %H:32:17 11[NET] <VPNPeer|1> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (444 bytes)<br>
Tue, 2021-03-09, %H:32:17 12[NET] <VPNPeer|1> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (60 bytes)<br>
Tue, 2021-03-09, %H:32:17 12[ENC] <VPNPeer|1> parsed QUICK_MODE request<br>
256501508 [ HASH ]<br>
Tue, 2021-03-09, %H:32:17 12[CHD] <VPNPeer|1> CHILD_SA VPNPeer{1} state<br>
change: CREATED => INSTALLING<br>
Tue, 2021-03-09, %H:32:17 12[CHD] <VPNPeer|1> using AES_CBC for encryption<br>
Tue, 2021-03-09, %H:32:17 12[CHD] <VPNPeer|1> using HMAC_SHA1_96 for<br>
integrity<br>
Tue, 2021-03-09, %H:32:17 12[CHD] <VPNPeer|1> adding inbound ESP SA<br>
Tue, 2021-03-09, %H:32:17 12[CHD] <VPNPeer|1> SPI 0xc8bf9eca, src<br>
192.19.22.1 dst 192.19.22.10<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> adding SAD entry with SPI<br>
c8bf9eca and reqid {1}<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> using encryption algorithm<br>
AES_CBC with key size 128<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> using integrity algorithm<br>
HMAC_SHA1_96 with key size 160<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> using replay window of 32<br>
packets<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> HW offload: no<br>
Tue, 2021-03-09, %H:32:17 12[CHD] <VPNPeer|1> adding outbound ESP SA<br>
Tue, 2021-03-09, %H:32:17 12[CHD] <VPNPeer|1> SPI 0x2d5a8f29, src<br>
192.19.22.10 dst 192.19.22.1<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> adding SAD entry with SPI<br>
2d5a8f29 and reqid {1}<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> using encryption algorithm<br>
AES_CBC with key size 128<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> using integrity algorithm<br>
HMAC_SHA1_96 with key size 160<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> using replay window of 0<br>
packets<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> HW offload: no<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> adding policy 192.19.22.1/32<br>
=== 192.19.22.10/32 in [priority 367231, refcount 1]<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> adding policy 192.19.22.1/32<br>
=== 192.19.22.10/32 fwd [priority 367231, refcount 1]<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> adding policy 192.19.22.10/32<br>
=== 192.19.22.1/32 out [priority 367231, refcount 1]<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> getting a local address in<br>
traffic selector 192.19.22.10/32<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> using host 192.19.22.10<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> getting iface name for index 3<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> using 192.19.22.1 as nexthop<br>
and eth1 as dev to reach 192.19.22.1/32<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> installing route:<br>
192.19.22.1/32 via 192.19.22.1 src 192.19.22.10 dev eth1<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> getting iface index for eth1<br>
Tue, 2021-03-09, %H:32:17 12[IKE] <VPNPeer|1> CHILD_SA VPNPeer{1}<br>
established with SPIs c8bf9eca_i 2d5a8f29_o and TS 192.19.22.10/32 ===<br>
192.19.22.1/32<br>
Tue, 2021-03-09, %H:32:17 12[CHD] <VPNPeer|1> CHILD_SA VPNPeer{1} state<br>
change: INSTALLING => INSTALLED<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> getting iface name for index 3<br>
Tue, 2021-03-09, %H:32:17 12[KNL] <VPNPeer|1> using 192.19.22.1 as nexthop<br>
and eth1 as dev to reach 192.19.22.1/32<br>
Tue, 2021-03-09, %H:32:28 15[KNL] <VPNPeer|1> querying SAD entry with SPI<br>
c8bf9eca<br>
Tue, 2021-03-09, %H:32:28 15[KNL] <VPNPeer|1> querying policy 192.19.22.1/32<br>
=== 192.19.22.10/32 in<br>
Tue, 2021-03-09, %H:32:28 15[KNL] <VPNPeer|1> querying policy 192.19.22.1/32<br>
=== 192.19.22.10/32 fwd<br>
Tue, 2021-03-09, %H:32:28 15[KNL] <VPNPeer|1> querying SAD entry with SPI<br>
2d5a8f29<br>
Tue, 2021-03-09, %H:32:28 15[KNL] <VPNPeer|1> querying policy<br>
192.19.22.10/32 === 192.19.22.1/32 out<br>
Tue, 2021-03-09, %H:37:17 05[NET] <VPNPeer|1> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (92 bytes)<br>
Tue, 2021-03-09, %H:37:17 05[ENC] <VPNPeer|1> parsed INFORMATIONAL_V1<br>
request 3632002282 [ HASH N(DPD) ]<br>
Tue, 2021-03-09, %H:37:17 05[IKE] <VPNPeer|1> queueing ISAKMP_DPD task<br>
Tue, 2021-03-09, %H:37:17 05[IKE] <VPNPeer|1> activating new tasks<br>
Tue, 2021-03-09, %H:37:17 05[IKE] <VPNPeer|1> activating ISAKMP_DPD task<br>
Tue, 2021-03-09, %H:37:17 05[ENC] <VPNPeer|1> generating INFORMATIONAL_V1<br>
request 840089277 [ HASH N(DPD_ACK) ]<br>
Tue, 2021-03-09, %H:37:17 05[NET] <VPNPeer|1> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (92 bytes)<br>
Tue, 2021-03-09, %H:37:17 05[IKE] <VPNPeer|1> activating new tasks<br>
Tue, 2021-03-09, %H:37:17 05[IKE] <VPNPeer|1> nothing to initiate<br>
Tue, 2021-03-09, %H:38:37 07[NET] <VPNPeer|1> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (92 bytes)<br>
Tue, 2021-03-09, %H:38:37 07[ENC] <VPNPeer|1> parsed INFORMATIONAL_V1<br>
request 2900110358 [ HASH D ]<br>
Tue, 2021-03-09, %H:38:37 07[IKE] <VPNPeer|1> received DELETE for IKE_SA<br>
VPNPeer[1]<br>
Tue, 2021-03-09, %H:38:37 07[IKE] <VPNPeer|1> deleting IKE_SA VPNPeer[1]<br>
between 192.19.22.10[192.19.22.10]...192.19.22.1[192.19.22.1]<br>
Tue, 2021-03-09, %H:38:37 07[IKE] <VPNPeer|1> IKE_SA VPNPeer[1] state<br>
change: ESTABLISHED => DELETING<br>
Tue, 2021-03-09, %H:38:37 07[IKE] <VPNPeer|1> IKE_SA VPNPeer[1] state<br>
change: DELETING => DELETING<br>
Tue, 2021-03-09, %H:38:37 08[NET] <2> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (244 bytes)<br>
Tue, 2021-03-09, %H:38:37 07[IKE] <VPNPeer|1> IKE_SA VPNPeer[1] state<br>
change: DELETING => DESTROYING<br>
Tue, 2021-03-09, %H:38:37 07[CHD] <VPNPeer|1> CHILD_SA VPNPeer{1} state<br>
change: INSTALLED => DESTROYING<br>
Tue, 2021-03-09, %H:38:37 07[KNL] <VPNPeer|1> deleting policy<br>
192.19.22.10/32 === 192.19.22.1/32 out<br>
Tue, 2021-03-09, %H:38:37 07[KNL] <VPNPeer|1> deleting policy 192.19.22.1/32<br>
=== 192.19.22.10/32 in<br>
Tue, 2021-03-09, %H:38:37 07[KNL] <VPNPeer|1> deleting policy 192.19.22.1/32<br>
=== 192.19.22.10/32 fwd<br>
Tue, 2021-03-09, %H:38:37 07[KNL] <VPNPeer|1> deleting SAD entry with SPI<br>
c8bf9eca<br>
Tue, 2021-03-09, %H:38:37 07[KNL] <VPNPeer|1> deleted SAD entry with SPI<br>
c8bf9eca<br>
Tue, 2021-03-09, %H:38:37 07[KNL] <VPNPeer|1> deleting SAD entry with SPI<br>
2d5a8f29<br>
Tue, 2021-03-09, %H:38:37 07[KNL] <VPNPeer|1> deleted SAD entry with SPI<br>
2d5a8f29<br>
Tue, 2021-03-09, %H:38:37 08[ENC] <2> parsed ID_PROT request 0 [ SA V V V V<br>
]<br>
Tue, 2021-03-09, %H:38:37 08[CFG] <2> looking for an IKEv1 config for<br>
192.19.22.10...192.19.22.1<br>
Tue, 2021-03-09, %H:38:37 08[CFG] <2> candidate:<br>
192.19.22.10...192.19.22.1, prio 3100<br>
Tue, 2021-03-09, %H:38:37 08[CFG] <2> found matching ike config:<br>
192.19.22.10...192.19.22.1 with prio 3100<br>
Tue, 2021-03-09, %H:38:37 08[IKE] <2> received NAT-T (RFC 3947) vendor ID<br>
Tue, 2021-03-09, %H:38:37 08[IKE] <2> received<br>
draft-ietf-ipsec-nat-t-ike-07 vendor ID<br>
Tue, 2021-03-09, %H:38:37 08[IKE] <2> received<br>
draft-ietf-ipsec-nat-t-ike-03 vendor ID<br>
Tue, 2021-03-09, %H:38:37 08[IKE] <2> received<br>
draft-ietf-ipsec-nat-t-ike-02\n vendor ID<br>
Tue, 2021-03-09, %H:38:37 08[IKE] <2> 192.19.22.1 is initiating a Main Mode<br>
IKE_SA<br>
Tue, 2021-03-09, %H:38:37 08[IKE] <2> IKE_SA (unnamed)[2] state change:<br>
CREATED => CONNECTING<br>
Tue, 2021-03-09, %H:38:37 08[CFG] <2> selecting proposal:<br>
Tue, 2021-03-09, %H:38:37 08[CFG] <2> proposal matches<br>
Tue, 2021-03-09, %H:38:37 08[CFG] <2> received proposals:<br>
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048,<br>
IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048,<br>
IKE:AES_CBC_192/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<br>
Tue, 2021-03-09, %H:38:37 08[CFG] <2> configured proposals:<br>
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<br>
Tue, 2021-03-09, %H:38:37 08[CFG] <2> selected proposal:<br>
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<br>
Tue, 2021-03-09, %H:38:37 08[IKE] <2> sending XAuth vendor ID<br>
Tue, 2021-03-09, %H:38:37 08[IKE] <2> sending DPD vendor ID<br>
Tue, 2021-03-09, %H:38:37 08[IKE] <2> sending NAT-T (RFC 3947) vendor ID<br>
Tue, 2021-03-09, %H:38:37 08[ENC] <2> generating ID_PROT response 0 [ SA V<br>
V V ]<br>
Tue, 2021-03-09, %H:38:37 08[NET] <2> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (136 bytes)<br>
Tue, 2021-03-09, %H:38:37 09[NET] <2> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (412 bytes)<br>
Tue, 2021-03-09, %H:38:37 09[ENC] <2> parsed ID_PROT request 0 [ KE No V V<br>
V NAT-D NAT-D ]<br>
Tue, 2021-03-09, %H:38:37 09[IKE] <2> received DPD vendor ID<br>
Tue, 2021-03-09, %H:38:37 09[ENC] <2> received unknown vendor ID:<br>
10:f9:6f:0a:02:d3:cc:91:9c:61:7d:60:6f:41:1f:c8<br>
Tue, 2021-03-09, %H:38:37 09[IKE] <2> received XAuth vendor ID<br>
Tue, 2021-03-09, %H:38:37 09[LIB] <2> size of DH secret exponent: 2047 bits<br>
Tue, 2021-03-09, %H:38:37 09[CFG] <2> candidate "VPNPeer", match:<br>
1/1/3100 (me/other/ike)<br>
Tue, 2021-03-09, %H:38:37 09[ENC] <2> generating ID_PROT response 0 [ KE No<br>
NAT-D NAT-D ]<br>
Tue, 2021-03-09, %H:38:37 09[NET] <2> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (372 bytes)<br>
Tue, 2021-03-09, %H:38:37 11[NET] <2> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (76 bytes)<br>
Tue, 2021-03-09, %H:38:37 11[ENC] <2> parsed ID_PROT request 0 [ ID HASH ]<br>
Tue, 2021-03-09, %H:38:37 11[CFG] <2> looking for pre-shared key peer<br>
configs matching 192.19.22.10...192.19.22.1[192.19.22.1]<br>
Tue, 2021-03-09, %H:38:37 11[CFG] <2> candidate "VPNPeer", match:<br>
1/20/3100 (me/other/ike)<br>
Tue, 2021-03-09, %H:38:37 11[CFG] <2> selected peer config "VPNPeer"<br>
Tue, 2021-03-09, %H:38:37 11[IKE] <VPNPeer|2> IKE_SA VPNPeer[2] established<br>
between 192.19.22.10[192.19.22.10]...192.19.22.1[192.19.22.1]<br>
Tue, 2021-03-09, %H:38:37 11[IKE] <VPNPeer|2> IKE_SA VPNPeer[2] state<br>
change: CONNECTING => ESTABLISHED<br>
Tue, 2021-03-09, %H:38:37 11[IKE] <VPNPeer|2> scheduling reauthentication<br>
in 86400s<br>
Tue, 2021-03-09, %H:38:37 11[IKE] <VPNPeer|2> maximum IKE_SA lifetime 86400s<br>
Tue, 2021-03-09, %H:38:37 11[ENC] <VPNPeer|2> generating ID_PROT response 0<br>
[ ID HASH ]<br>
Tue, 2021-03-09, %H:38:37 11[NET] <VPNPeer|2> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (76 bytes)<br>
Tue, 2021-03-09, %H:39:15 15[CFG] received stroke: terminate 'VPNPeer'<br>
Tue, 2021-03-09, %H:39:15 05[IKE] <VPNPeer|2> queueing ISAKMP_DELETE task<br>
Tue, 2021-03-09, %H:39:15 05[IKE] <VPNPeer|2> activating new tasks<br>
Tue, 2021-03-09, %H:39:15 05[IKE] <VPNPeer|2> activating ISAKMP_DELETE<br>
task<br>
Tue, 2021-03-09, %H:39:15 05[IKE] <VPNPeer|2> deleting IKE_SA VPNPeer[2]<br>
between 192.19.22.10[192.19.22.10]...192.19.22.1[192.19.22.1]<br>
Tue, 2021-03-09, %H:39:15 05[IKE] <VPNPeer|2> sending DELETE for IKE_SA<br>
VPNPeer[2]<br>
Tue, 2021-03-09, %H:39:15 05[IKE] <VPNPeer|2> IKE_SA VPNPeer[2] state<br>
change: ESTABLISHED => DELETING<br>
Tue, 2021-03-09, %H:39:15 05[ENC] <VPNPeer|2> generating INFORMATIONAL_V1<br>
request 1114736905 [ HASH D ]<br>
Tue, 2021-03-09, %H:39:15 05[NET] <VPNPeer|2> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (92 bytes)<br>
Tue, 2021-03-09, %H:39:15 05[IKE] <VPNPeer|2> IKE_SA VPNPeer[2] state<br>
change: DELETING => DESTROYING<br>
Tue, 2021-03-09, %H:39:15 07[NET] <3> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (244 bytes)<br>
Tue, 2021-03-09, %H:39:15 07[ENC] <3> parsed ID_PROT request 0 [ SA V V V V<br>
]<br>
Tue, 2021-03-09, %H:39:15 07[CFG] <3> looking for an IKEv1 config for<br>
192.19.22.10...192.19.22.1<br>
Tue, 2021-03-09, %H:39:15 07[CFG] <3> candidate:<br>
192.19.22.10...192.19.22.1, prio 3100<br>
Tue, 2021-03-09, %H:39:15 07[CFG] <3> found matching ike config:<br>
192.19.22.10...192.19.22.1 with prio 3100<br>
Tue, 2021-03-09, %H:39:15 07[IKE] <3> received NAT-T (RFC 3947) vendor ID<br>
Tue, 2021-03-09, %H:39:15 07[IKE] <3> received<br>
draft-ietf-ipsec-nat-t-ike-07 vendor ID<br>
Tue, 2021-03-09, %H:39:15 07[IKE] <3> received<br>
draft-ietf-ipsec-nat-t-ike-03 vendor ID<br>
Tue, 2021-03-09, %H:39:15 07[IKE] <3> received<br>
draft-ietf-ipsec-nat-t-ike-02\n vendor ID<br>
Tue, 2021-03-09, %H:39:15 07[IKE] <3> 192.19.22.1 is initiating a Main Mode<br>
IKE_SA<br>
Tue, 2021-03-09, %H:39:15 07[IKE] <3> IKE_SA (unnamed)[3] state change:<br>
CREATED => CONNECTING<br>
Tue, 2021-03-09, %H:39:15 07[CFG] <3> selecting proposal:<br>
Tue, 2021-03-09, %H:39:15 07[CFG] <3> proposal matches<br>
Tue, 2021-03-09, %H:39:15 07[CFG] <3> received proposals:<br>
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048,<br>
IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048,<br>
IKE:AES_CBC_192/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<br>
Tue, 2021-03-09, %H:39:15 07[CFG] <3> configured proposals:<br>
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<br>
Tue, 2021-03-09, %H:39:15 07[CFG] <3> selected proposal:<br>
IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<br>
Tue, 2021-03-09, %H:39:15 07[IKE] <3> sending XAuth vendor ID<br>
Tue, 2021-03-09, %H:39:15 07[IKE] <3> sending DPD vendor ID<br>
Tue, 2021-03-09, %H:39:15 07[IKE] <3> sending NAT-T (RFC 3947) vendor ID<br>
Tue, 2021-03-09, %H:39:15 07[ENC] <3> generating ID_PROT response 0 [ SA V<br>
V V ]<br>
Tue, 2021-03-09, %H:39:15 07[NET] <3> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (136 bytes)<br>
Tue, 2021-03-09, %H:39:15 08[NET] <3> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (412 bytes)<br>
Tue, 2021-03-09, %H:39:15 08[ENC] <3> parsed ID_PROT request 0 [ KE No V V<br>
V NAT-D NAT-D ]<br>
Tue, 2021-03-09, %H:39:15 08[IKE] <3> received DPD vendor ID<br>
Tue, 2021-03-09, %H:39:15 08[ENC] <3> received unknown vendor ID:<br>
10:f9:6f:0a:d5:5e:d6:1c:e6:59:75:2b:e7:46:d2:a4<br>
Tue, 2021-03-09, %H:39:15 08[IKE] <3> received XAuth vendor ID<br>
Tue, 2021-03-09, %H:39:15 08[LIB] <3> size of DH secret exponent: 2047 bits<br>
Tue, 2021-03-09, %H:39:15 08[CFG] <3> candidate "VPNPeer", match:<br>
1/1/3100 (me/other/ike)<br>
Tue, 2021-03-09, %H:39:15 08[ENC] <3> generating ID_PROT response 0 [ KE No<br>
NAT-D NAT-D ]<br>
Tue, 2021-03-09, %H:39:15 08[NET] <3> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (372 bytes)<br>
Tue, 2021-03-09, %H:39:15 09[NET] <3> received packet: from<br>
192.19.22.1[500] to 192.19.22.10[500] (76 bytes)<br>
Tue, 2021-03-09, %H:39:15 09[ENC] <3> parsed ID_PROT request 0 [ ID HASH ]<br>
Tue, 2021-03-09, %H:39:15 09[CFG] <3> looking for pre-shared key peer<br>
configs matching 192.19.22.10...192.19.22.1[192.19.22.1]<br>
Tue, 2021-03-09, %H:39:15 09[CFG] <3> candidate "VPNPeer", match:<br>
1/20/3100 (me/other/ike)<br>
Tue, 2021-03-09, %H:39:15 09[CFG] <3> selected peer config "VPNPeer"<br>
Tue, 2021-03-09, %H:39:15 09[IKE] <VPNPeer|3> IKE_SA VPNPeer[3] established<br>
between 192.19.22.10[192.19.22.10]...192.19.22.1[192.19.22.1]<br>
Tue, 2021-03-09, %H:39:15 09[IKE] <VPNPeer|3> IKE_SA VPNPeer[3] state<br>
change: CONNECTING => ESTABLISHED<br>
Tue, 2021-03-09, %H:39:15 09[IKE] <VPNPeer|3> scheduling reauthentication<br>
in 86400s<br>
Tue, 2021-03-09, %H:39:15 09[IKE] <VPNPeer|3> maximum IKE_SA lifetime 86400s<br>
Tue, 2021-03-09, %H:39:15 09[ENC] <VPNPeer|3> generating ID_PROT response 0<br>
[ ID HASH ]<br>
Tue, 2021-03-09, %H:39:15 09[NET] <VPNPeer|3> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (76 bytes)<br>
Tue, 2021-03-09, %H:39:17 00[DMN] signal of type SIGINT received. Shutting<br>
down<br>
Tue, 2021-03-09, %H:39:17 00[IKE] <VPNPeer|3> queueing ISAKMP_DELETE task<br>
Tue, 2021-03-09, %H:39:17 00[IKE] <VPNPeer|3> activating new tasks<br>
Tue, 2021-03-09, %H:39:17 00[IKE] <VPNPeer|3> activating ISAKMP_DELETE<br>
task<br>
Tue, 2021-03-09, %H:39:17 00[IKE] <VPNPeer|3> deleting IKE_SA VPNPeer[3]<br>
between 192.19.22.10[192.19.22.10]...192.19.22.1[192.19.22.1]<br>
Tue, 2021-03-09, %H:39:17 00[IKE] <VPNPeer|3> sending DELETE for IKE_SA<br>
VPNPeer[3]<br>
Tue, 2021-03-09, %H:39:17 00[IKE] <VPNPeer|3> IKE_SA VPNPeer[3] state<br>
change: ESTABLISHED => DELETING<br>
Tue, 2021-03-09, %H:39:17 00[ENC] <VPNPeer|3> generating INFORMATIONAL_V1<br>
request 590983238 [ HASH D ]<br>
Tue, 2021-03-09, %H:39:17 00[NET] <VPNPeer|3> sending packet: from<br>
192.19.22.10[500] to 192.19.22.1[500] (92 bytes)<br>
Tue, 2021-03-09, %H:39:17 00[IKE] <VPNPeer|3> IKE_SA VPNPeer[3] state<br>
change: DELETING => DESTROYING<br>
<br>
<br>
><br>
> Message: 1<br>
> Date: Tue, 9 Mar 2021 11:50:44 -0500<br>
> From: Sean B <sb3957312@gmail.com><br>
> To: users@lists.strongswan.org<br>
> Subject: [strongSwan] IKEv1 Phase 1 rekey deletes Phase 2 SAs<br>
> Message-ID:<br>
> <CA+c0=<br>
> jf_1QpkV9HTx_QLNyDoHSsFq2eWkN7SDwMEfVSciTEVrg@mail.gmail.com><br>
> Content-Type: text/plain; charset="utf-8"<br>
><br>
> Hi Strongswan-users,<br>
><br>
> I have a set up that requires IKEv1 and I'm running into a problem when the<br>
> IKEv1 Phase 1 (IKE SA) rekeys. Phase 1 appears to rekey correctly, but<br>
> deletes the Phase 2 SAs.<br>
> Based on the following website, IPsec SAs are supposed to be adopted by the<br>
> new IKE SA and not recreated:<br>
> <a href="https://wiki.strongswan.org/projects/strongswan/wiki/ExpiryRekey">https://wiki.strongswan.org/projects/strongswan/wiki/ExpiryRekey</a><br>
> *"IKEv1* SAs are also rekeyed/reauthenticated using a make-before-break<br>
> scheme, however, only the IKE SA is affected. IPsec SAs are adopted by the<br>
> new IKE SA and not recreated."<br>
><br>
> In this setup the Strongswan (192.19.22.10) is configured as the Responder<br>
> and a Cisco IOS (192.19.22.1) device as the Initiator.<br>
> The initial connection is established, and the traffic is sent ESP<br>
> encapsulated. The initiator attempts to rekey the IKE SA, and appears to<br>
> succeed.<br>
> Both the Initiator and the Responder are shown with the new IKE SA SPIs,<br>
> but during the IKE SA rekey Strongswan deletes the SAD entries for the<br>
> IPsec SAs.<br>
><br>
> Can someone please assist with troubleshooting this issue?<br>
> I am unable to determine if this is due to a configuration with the<br>
> connections in ipsec.conf, a setting in charon.conf, or if this is an issue<br>
> with how Cisco IOS attempts to rekey IKE SAs.<br>
> Cisco appears to be sending a DELETE message as per<br>
> <a href="https://tools.ietf.org/html/draft-jenkins-ipsec-rekeying-06#section-3.2">
https://tools.ietf.org/html/draft-jenkins-ipsec-rekeying-06#section-3.2</a>.<br>
><br>
> I've included the 'ipsec statusall' outputs, ipsec.conf, and<br>
> charon_debug.log<br>
> (I've added charon_debug.log as an attachment, would it have been better to<br>
> copy and paste into the body of the email?)<br>
> #####<br>
> # ipsec.conf - strongSwan IPsec configuration file<br>
><br>
> # basic configuration<br>
> config setup<br>
> # strictcrlpolicy=yes<br>
> # uniqueids = no<br>
><br>
> # Add connections here.<br>
> conn VPNPeer<br>
> leftfirewall=yes<br>
> keyexchange=ikev1<br>
><br>
> # Phase 1 settings<br>
> ikelifetime=24h<br>
> margintime=0<br>
> rekeyfuzz=0%<br>
> lifetime=8h<br>
> ike=aes256-sha1-modp2048 !<br>
><br>
> # Phase 2<br>
> esp=aes128-sha1-modp2048 !<br>
><br>
> left=192.19.22.10<br>
> right=192.19.22.1<br>
><br>
> authby=psk<br>
><br>
> type=tunnel<br>
><br>
> auto=add<br>
><br>
> # Rekeying<br>
> #rekey=no<br>
><br>
> include /var/lib/strongswan/ipsec.conf.inc<br>
><br>
><br>
> #####<br>
> Here are the results from 'ipsec statusall':<br>
> Initial connection:<br>
> #ipsec statusall<br>
><br>
> Status of IKE charon daemon (weakSwan 5.8.4, Linux 5.5.0-kali2-amd64,<br>
> x86_64):<br>
> uptime: 20 seconds, since Mar 09 13:32:08 2021<br>
> malloc: sbrk 1622016, mmap 0, used 610688, free 1011328<br>
> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0,<br>
> scheduled: 3<br>
> loaded plugins: charon aesni aes rc2 sha2 sha1 md5 mgf1 random nonce x509<br>
> revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey<br>
> pem openssl fips-prf gmp agent xcbc hmac gcm drbg attr kernel-netlink<br>
> resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic<br>
> counters<br>
><br>
> Listening IP addresses:<br>
> 192.19.22.10<br>
> 172.19.22.10<br>
> 172.17.0.1<br>
> Connections:<br>
> VPNPeer: 192.19.22.10...192.19.22.1 IKEv1<br>
> VPNPeer: local: [192.19.22.10] uses pre-shared key authentication<br>
> VPNPeer: remote: [192.19.22.1] uses pre-shared key authentication<br>
> VPNPeer: child: dynamic === dynamic TUNNEL<br>
><br>
> Security Associations (1 up, 0 connecting):<br>
> VPNPeer[1]: ESTABLISHED 11 seconds ago,<br>
> 192.19.22.10[192.19.22.10]...192.19.22.1[192.19.22.1]<br>
> VPNPeer[1]: IKEv1 SPIs: e53ec81750a41b9c_i 84f72669eb1b150b_r*,<br>
> pre-shared key reauthentication in 23 hours<br>
> VPNPeer[1]: IKE proposal:<br>
> AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<br>
> VPNPeer{1}: INSTALLED, TUNNEL, reqid 1, ESP SPIs: c8bf9eca_i<br>
> 2d5a8f29_o<br>
> VPNPeer{1}: AES_CBC_128/HMAC_SHA1_96/MODP_2048, 400 bytes_i (4 pkts,<br>
> 9s ago), 400 bytes_o (4 pkts, 9s ago), rekeying in 7 hours<br>
> VPNPeer{1}: 192.19.22.10/32 === 192.19.22.1/32<br>
><br>
><br>
><br>
> After IKE Phase 1 rekey:<br>
> #ipsec statusall<br>
><br>
> Status of IKE charon daemon (weakSwan 5.8.4, Linux 5.5.0-kali2-amd64,<br>
> x86_64):<br>
> uptime: 6 minutes, since Mar 09 13:32:08 2021<br>
> malloc: sbrk 1622016, mmap 0, used 640656, free 981360<br>
> worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0,<br>
> scheduled: 5<br>
> loaded plugins: charon aesni aes rc2 sha2 sha1 md5 mgf1 random nonce x509<br>
> revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey<br>
> pem openssl fips-prf gmp agent xcbc hmac gcm drbg attr kernel-netlink<br>
> resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic<br>
> counters<br>
><br>
> Listening IP addresses:<br>
> 192.19.22.10<br>
> 172.19.22.10<br>
> 172.17.0.1<br>
> Connections:<br>
> VPNPeer: 192.19.22.10...192.19.22.1 IKEv1<br>
> VPNPeer: local: [192.19.22.10] uses pre-shared key authentication<br>
> VPNPeer: remote: [192.19.22.1] uses pre-shared key authentication<br>
> VPNPeer: child: dynamic === dynamic TUNNEL<br>
><br>
> Security Associations (1 up, 0 connecting):<br>
> VPNPeer[2]: ESTABLISHED 9 seconds ago,<br>
> 192.19.22.10[192.19.22.10]...192.19.22.1[192.19.22.1]<br>
> VPNPeer[2]: IKEv1 SPIs: e53ec81702d2cc91_i 47da289647a60462_r*,<br>
> pre-shared key reauthentication in 23 hours<br>
> VPNPeer[2]: IKE proposal:<br>
> AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048<br>
><br>
> #####<br>
> # charon_debug.log - attached.<br>
> -------------- next part --------------<br>
> An HTML attachment was scrubbed...<br>
> URL: <<br>
> <a href="http://lists.strongswan.org/pipermail/users/attachments/20210309/4c35ad50/attachment.html">
http://lists.strongswan.org/pipermail/users/attachments/20210309/4c35ad50/attachment.html</a><br>
> ><br>
> -------------- next part --------------<br>
> A non-text attachment was scrubbed...<br>
> Name: charon_debug.log<br>
> Type: application/octet-stream<br>
> Size: 28985 bytes<br>
> Desc: not available<br>
> URL: <<br>
> <a href="http://lists.strongswan.org/pipermail/users/attachments/20210309/4c35ad50/attachment.obj">
http://lists.strongswan.org/pipermail/users/attachments/20210309/4c35ad50/attachment.obj</a><br>
> ><br>
><br>
><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.strongswan.org/pipermail/users/attachments/20210309/0ace289c/attachment.html">http://lists.strongswan.org/pipermail/users/attachments/20210309/0ace289c/attachment.html</a>><br>
<br>
End of Users Digest, Vol 134, Issue 7<br>
*************************************<br>
</div>
</span></font></div>
</div>
</body>
</html>