[strongSwan] IPSec -Charon versus Pluto

Farid Farid farid21657 at yahoo.com
Fri Oct 18 18:07:52 CEST 2013

Thanks Martin for the good detail. Yes that was the problem. It works with IKvE2.

Best Regards,

On Thursday, October 17, 2013 11:49 PM, Martin Willi <martin at strongswan.org> wrote:
Hi Farid,

> I have observed if I  select  charonstat=yes and plutostart=no   ipsec
> is not listening in all interfaces 

With strongSwan 4.x, two IKE daemons have been in use. Pluto handled
IKEv1 connections, while charon was responsible to handle IKEv2

Both protocols receive messages on port 500/4500, but only one process
can bind to it. As a work-around, charon used a RAW socket to receive
packets, but did not bind to the UDP port. This allowed both daemons to
receive packets for their protocol.

> and it never receives any connection from outside.

charon ignores IKEv1 packets, but it should receive packets for IKEv2.
If you have IKEv1 connections, you'll need to start pluto. 

With 5.x releases, things have changed; charon now handles both IKEv1
and IKEv2 over a standard UDP socket, pluto is not required anymore.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20131018/d4fbc8e5/attachment.html>

More information about the Users mailing list