<html><head></head><body><div>Hello:</div><div><br></div><div>I am using the following on a Teltonika RUT-950:</div><div><a href="mailto:root@CORS262">root@CORS262</a>:~# ipsec --version</div><div>Linux strongSwan U5.6.2/K3.18.44</div><div>Institute for Internet Technologies and Applications</div><div>University of Applied Sciences Rapperswil, Switzerland</div><div>See 'ipsec --copyright' for copyright information.</div><div><br></div><div>I am using strongswan road warriors connecting to two different Cisco IOS routers. </div><div><br></div><div>Here is my problem:</div><div><a href="mailto:root@CORS262">root@CORS262</a>:~# ipsec status</div><div>Security Associations (3 up, 0 connecting):</div><div> SOICC[25]: ESTABLISHED 82 minutes ago, 100.95.41.178[CORS262]...103.205.244.106[CCrouter]</div><div> SOICC{28}: INSTALLED, TUNNEL, reqid 5, ESP in UDP SPIs: cea042a6_i d6fa31b8_o</div><div> SOICC{28}: 2.2.3.6/32 === 1.1.1.10/32</div><div> SOICC[24]: ESTABLISHED 82 minutes ago, 100.95.41.178[CORS262]...103.205.244.106[CCrouter]</div><div> SOICC{27}: INSTALLED, TUNNEL, reqid 5, ESP in UDP SPIs: c7bdad52_i a0838d85_o</div><div> SOICC{27}: 2.2.3.6/32 === 1.1.1.10/32</div><div> SOICCMP[22]: ESTABLISHED 3 hours ago, 100.95.41.178[CORS262]...164.100.196.79[CC2router]</div><div> SOICCMP{29}: INSTALLED, TUNNEL, reqid 6, ESP in UDP SPIs: c1493199_i 021b5af1_o</div><div> SOICCMP{29}: 3.3.3.6/32 === 1.1.1.12/32</div><div><br></div><div>As you can see, the tunnel SOICC is duplicated. When this happens the traffic through the GRE tunnels inside the IPSec tunnels stop.</div><div>DPD is not pulling the tunnel down for some reason.</div><div><br></div><div>Here is the config:</div><div><a href="mailto:root@CORS262">root@CORS262</a>:~# cat /etc/ipsec.conf</div><div># generated by /etc/init.d/ipsec</div><div>conn %default</div><div> margintime=9m</div><div> rekeyfuzz=100%</div><div><br></div><div>conn SOICC</div><div> leftid=keyid:CORS262</div><div> leftauth=psk</div><div> rightauth=psk</div><div> leftsubnet=2.2.3.6/32</div><div> right=103.205.244.106</div><div> rightid=keyid:CCrouter</div><div> keyexchange=ikev2</div><div> authby=secret</div><div> leftfirewall=yes</div><div> rightfirewall=no</div><div> auto=start</div><div> type=tunnel</div><div> aggressive=no</div><div> dpdaction=restart</div><div> dpddelay=30</div><div> dpdtimeout=30</div><div> forceencaps=no</div><div> keyingtries=%forever</div><div> ike=aes256-sha256-modp2048</div><div> ikelifetime=5h</div><div> esp=aes256-sha256-modp2048</div><div> keylife=4h</div><div> rightsubnet=1.1.1.10/32</div><div><br></div><div>conn SOICCMP</div><div> leftid=keyid:CORS262</div><div> leftauth=psk</div><div> rightauth=psk</div><div> leftsubnet=3.3.3.6/32</div><div> right=164.100.196.79</div><div> rightid=keyid:CC2router</div><div> keyexchange=ikev2</div><div> authby=secret</div><div> leftfirewall=yes</div><div> rightfirewall=no</div><div> auto=start</div><div> type=tunnel</div><div> aggressive=no</div><div> dpdaction=restart</div><div> dpddelay=30</div><div> dpdtimeout=30</div><div> forceencaps=no</div><div> keyingtries=%forever</div><div> ike=aes256-sha256-modp2048</div><div> ikelifetime=5h</div><div> esp=aes256-sha256-modp2048</div><div> keylife=4h</div><div> rightsubnet=1.1.1.12/32</div><div><br></div><div>I seldom see duplicate tunnels from the SOICCMP profile, only the SOICC.</div><div>I turn off strongswan and setup and erect the GRE tunnels before restarting strongswan when teh RUT-950 boots via</div><div>the /etc/rc.local file:</div><div><a href="mailto:root@CORS262">root@CORS262</a>:~# cat /etc/rc.local</div><div># Put your custom commands here that should be executed once</div><div># the system init finished. By default this file does nothing.</div><div>/etc/init.d/ipsec stop</div><div>echo 1 > /proc/sys/net/ipv4/conf/default/accept_local</div><div>echo 1 > /proc/sys/net/ipv4/conf/all/accept_local</div><div>ip addr del dev SOI 192.168.194.21/30</div><div>ip link set dev SOI down</div><div>ip tun del SOI</div><div>ip addr del dev tap0 2.2.3.6/32</div><div>ip tuntap del tap0 mode tap</div><div>sleep 1</div><div>ip addr del dev SOIMP 172.16.164.21/30</div><div>ip link set dev SOIMP down</div><div>ip tun del SOIMP</div><div>ip addr del dev tap1 3.3.3.6/32</div><div>ip tuntap del tap1 mode tap</div><div>sleep 1</div><div>ip tuntap add name tap0 mode tap</div><div>ip addr flush dev tap0</div><div>ip addr add 2.2.3.6/32 brd + dev tap0</div><div>ip link set dev tap0 up</div><div>sleep 1</div><div>ip tuntap add name tap1 mode tap</div><div>ip addr flush dev tap1</div><div>ip addr add 3.3.3.6/32 brd + dev tap1</div><div>ip link set dev tap1 up</div><div>sleep 1</div><div>ip tunnel add SOI mode gre remote 1.1.1.10 local 2.2.3.6 ttl 255</div><div>ip link set SOI mtu 1400</div><div>ip link set SOI up</div><div>ip addr add 192.168.194.21/30 peer 192.168.194.22/30 brd + dev SOI</div><div>sleep 1</div><div>ip tunnel add SOIMP mode gre remote 1.1.1.12 local 3.3.3.6 ttl 255</div><div>ip link set SOIMP mtu 1400</div><div>ip link set SOIMP up</div><div>ip addr add 172.16.164.21/30 peer 172.16.164.22/30 brd + dev SOIMP</div><div>sleep 1</div><div>ip route add 192.168.0.0/16 dev SOI</div><div>ip route add 172.16.0.0/16 dev SOIMP</div><div>#sh /root/isalive0.12.sh 192.168.48.1 172.16.48.1 &</div><div>sh /root/isalive0.16.sh 192.168.48.1 172.16.48.1 &</div><div>/usr/bin/logger -t rc.local "End of the RC.LOCAL file"</div><div>sh /root/startipsec.sh &</div><div>exit 0</div><div><br></div><div>The /root/isalive0.16.sh script is a file that will reboot the router if pings to both internal IPs fail for 5 minutes.</div><div><br></div><div>I have GRE keepalives enabled on the Cisco side.</div><div><br></div><div>Does anyone have any tips on how I can:</div><div>1. Perhaps get DPD to tear down and restart he tunnel,</div><div>2. Prevent strongswan from creating a duplicate tunnel.</div><div><br></div><div>Cheers,</div><div>John</div><div><br></div><div><span><pre>-- <br></pre><pre>John Edward Serink
Product Applications Engineer,
Advanced Positioning
Trimble Navigation Singapore PTE Ltd.
3 Harbourfront Place,
#13-02 Harbourfrout Tower Two,
Co. Reg. No. 199204958W
Singapore 099254
Tel 65-6871-5878
Fax 65-6871-5879
DID 65-6871-5873
HP 65-9129-4250
Skype: johnserink
</pre></span></div></body></html>