[strongSwan] virtual IP assignement fails if previous tunnel not properly shutdown

Benoit Foucher benoit at bittrap.com
Thu Dec 2 11:02:33 CET 2010


I have a machine that connects to a strongSwan gateway to establish a VPN connection (both machines are Linux machines with strongSwan 4.4.1, using ikev2). It gets a virtual IP from the gateway (gw is using rightsourceip= 

From time to time, when I reboot the machine, the assignment of the IP fails on reboot. I suspect this is because the previous tunnel wasn't properly shutdown when the machine went down before the reboot. Is there a way to force the IP address assignment for the new tunnel in this case? The log below shows the previous tunnel being deleted and the new one being established and the virtual IP assignment error. Let me know if you need more information and thanks for your help.

15[IKE] authentication of 'gw.foo.com' (myself) with RSA signature successful
15[IKE] deleting duplicate IKE_SA for peer 'CN=game.foo.com' due to uniqueness policy
15[IKE] deleting IKE_SA instance[4] between[gw.foo.com]...[CN=game.foo.com]
15[IKE] sending DELETE for IKE_SA instance[4]
15[ENC] generating INFORMATIONAL request 0 [ D ]
15[NET] sending packet: from[4500] to[4500]
15[IKE] IKE_SA instance[6] established between[gw.foo.com]...[CN=game.foo.com]
15[IKE] scheduling reauthentication in 10515s
15[IKE] maximum IKE_SA lifetime 10695s
15[IKE] sending end entity cert "xxx"
15[IKE] peer requested virtual IP %any
15[CFG] 'CN=game.foo.com' already has an online lease, unable to assign address
15[CFG] acquiring address from pool 'instance' failed
15[IKE] no virtual IP found, sending INTERNAL_ADDRESS_FAILURE
15[IKE] configuration payload negotation failed, no CHILD_SA built


More information about the Users mailing list