[strongSwan] Sparatic tunnel issues

Stephen McGuinness webmcgu at gmail.com
Wed Apr 25 21:19:00 CEST 2012


I'm having trouble figuring out what I have configured wrong in my
tunnel config. I am running a transport tunnel between two endpoints,
X and Y. I've noticed that sometimes the tunnels get confused, and I
wind up with two SA's for the same connection.

Machine X is sending data down the first SA, and machine Y is sending
data down the second SA. The tunnels run great for several days, weeks
even, and they have constant traffic going over them, but at some
point they get into this state. Restarting one of the endpoints cleans
both sides up, but I would like avoid this state.

Little more information:
StrongSwan version: 4.6.2
Operating system: RHEL 6.2
Config example:

Machine X
---------------
config setup
  charonstart=yes
  plutostart=no

conn x
  keyexchange=ikev2
  mobike=no
  ike=aes256.....
  left=x.x.x.x
  leftid=x.x.x.x
  right=y.y.y.y
  rightid=y.y.y.y
  esp=aes256.....
  auto=route
  dpdaction=clear
  dpddelay=1m
  reauth=no
  type=transport

Machine Y
---------------
config setup
  charonstart=yes
  plutostart=no

conn y
  keyexchange=ikev2
  mobike=no
  ike=aes256.....
  right=x.x.x.x
  rightid=x.x.x.x
  left=y.y.y.y
  leftid=y.y.y.y
  esp=aes256.....
  auto=route
  dpdaction=clear
  dpddelay=1m
  reauth=no
  type=transport

Any help, or ideas are very welcome.

Thanks in advance,

Steve




More information about the Users mailing list