<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi colleagues,</p>
<p>is there a way to retry connect on receiving NO_PROPOSAL_CHOSEN
from the peer? At the moment, I have the following configuration
on the calling side -</p>
<pre>conn-defaults {
version = 2
proposals = aes256gcm16-prfsha384-ecp384
local_addrs = 10.1.3.14
encap = yes
fragmentation = yes
mobike = no
send_certreq = yes
send_cert = always
dpd_delay = 15s
rekey_time = 3h
unique = keep
keyingtries = 0
local {
auth = pubkey
id = fqdn:s4.v.zt
}
}
child-defaults {
ah_proposals =
esp_proposals = aes192gcm16-aes256gcm16-ecp256
local_ts = 0.0.0.0/0
remote_ts = 0.0.0.0/0
rekey_time = 1h
mode = tunnel
ipcomp = no
tfc_padding = 256
if_id_in = %unique
if_id_out = %unique
}
connections {
mg1-v-zt: conn-defaults {
remote_addrs = 10.1.0.10
remote {
auth = pubkey
id = fqdn:mg1.v.zt
}
vips = 0.0.0.0
children {
mg1-v-zt: child-defaults {
updown = /etc/swanctl/bin/xfrm-updown dynamic 25.0.0.25
start_action = start
dpd_action = restart
close_action = start
}
}
}
}
</pre>
<p>responder side contains no information about the caller,
responding with the following:</p>
<pre>Apr 15 17:35:23 mg1 charon-systemd[14389]: received packet: from 10.1.3.14[500] to 10.1.0.10[500] (296 bytes)
Apr 15 17:35:23 mg1 charon-systemd[14389]: parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Apr 15 17:35:23 mg1 charon-systemd[14389]: no IKE config found for 10.1.0.10...10.1.3.14, sending NO_PROPOSAL_CHOSEN
Apr 15 17:35:23 mg1 charon-systemd[14389]: generating IKE_SA_INIT response 0 [ N(NO_PROP) ]
Apr 15 17:35:23 mg1 charon-systemd[14389]: sending packet: from 10.1.0.10[500] to 10.1.3.14[500] (36 bytes)
</pre>
<p>after which caller stop:</p>
<pre>Apr 15 17:35:23 s4 charon-systemd[3306]: received packet: from 10.1.0.10[500] to 10.1.3.14[500] (36 bytes)
Apr 15 17:35:23 s4 charon-systemd[3306]: parsed IKE_SA_INIT response 0 [ N(NO_PROP) ]
Apr 15 17:35:23 s4 charon-systemd[3306]: received NO_PROPOSAL_CHOSEN notify error
... nothing more until restart strongswan ...
</pre>
<p>So the question - how to make calling side try forever regardless
of what remote side responds or do not respond at all?</p>
<p>Thank you.</p>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
Volodymyr Litovka
"Vision without Execution is Hallucination." -- Thomas Edison</pre>
</body>
</html>