[strongSwan] REKEYING, IKEv1, forever
karthik kumar
kumarkarthikn at gmail.com
Fri Mar 23 12:53:08 CET 2018
Hi,
I am setting up route based VPN, the service starts up and VPN tunnel is
created
I have add=route and it should have setup the trap and automatically up'd
the tunnel, (i am running a ping) not sure why it didn't do
*initiating Main Mode IKE_SA Tunnel1[1] to xxxx*
*generating ID_PROT request 0 [ SA V V V V V ]*
*sending packet: from yyyy[500] to xxxx[500] (240 bytes)*
*received packet: from xxxx[500] to yyyy[500] (120 bytes)*
*parsed ID_PROT response 0 [ SA V V ]*
*received NAT-T (RFC 3947) vendor ID*
*received FRAGMENTATION vendor ID*
*generating ID_PROT request 0 [ KE No NAT-D NAT-D ]*
*sending packet: from yyyy[500] to xxxx[500] (308 bytes)*
*received packet: from xxxx[500] to yyyy[500] (368 bytes)*
*parsed ID_PROT response 0 [ KE No V V V V NAT-D NAT-D ]*
*received Cisco Unity vendor ID*
*received XAuth vendor ID*
*received unknown vendor ID:
ec:1a:31:1f:a7:a0:7c:e7:04:8f:96:31:e0:51:78:f2*
*received unknown vendor ID:
1f:07:f7:0e:aa:65:14:d3:b0:fa:96:54:2a:50:01:00*
*generating ID_PROT request 0 [ ID HASH ]*
*sending packet: from yyyy[500] to xxxx[500] (76 bytes)*
*received packet: from xxxx[500] to yyyy[500] (92 bytes)*
*parsed ID_PROT response 0 [ ID HASH V ]*
*received DPD vendor ID*
*IKE_SA Tunnel1[1] established between yyyy[yyyy]...xxxx[xxxx]*
*generating QUICK_MODE request 2763822149 [ HASH SA No KE ID ID ]*
*sending packet: from yyyy[500] to xxxx[500] (380 bytes)*
*received packet: from xxxx[500] to yyyy[500] (92 bytes)*
*parsed INFORMATIONAL_V1 request 1304498435 [ HASH N((24576)) ]*
*received (24576) notify*
*received packet: from xxxx[500] to yyyy[500] (396 bytes)*
*parsed QUICK_MODE response 2763822149 [ HASH SA No KE ID ID N((24576)) ]*
*received 28800s lifetime, configured 0s*
*CHILD_SA Tunnel1{2} established with SPIs c9d21ed5_i a0429fc7_o and TS
10.131.0.0/24 <http://10.131.0.0/24> === 10.49.0.0/16 <http://10.49.0.0/16>*
*connection 'Tunnel1' established successfully*
Tunnel1 is in *REKEYING *state forever. Can someone help in understanding
why this is happening ?
*# swanctl --list-sas*
*Tunnel1: #2, ESTABLISHED, IKEv1, 9303a91759fd0ade:f595d3cea90f3978*
* local 'yyyy' @ yyyy*
* remote 'xxxx' @ xxxx*
* AES_CBC-256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536*
* established 2262s ago*
* Tunnel1: #2, reqid 1, INSTALLED, TUNNEL,
ESP:AES_CBC-256/HMAC_SHA1_96/MODP_1536*
* installed 2262s ago*
* in cc71fb62, 0 bytes, 0 packets*
* out 7b6dd570, 185556 bytes, 2209 packets*
* local 10.131.0.0/24 <http://10.131.0.0/24>*
* remote 10.49.0.0/16 <http://10.49.0.0/16>*
*Tunnel1: #1, REKEYING, IKEv1, cb22de82b36ddf5a:882d6338ccc0a906*
* local 'yyyy' @ yyyy*
* remote 'xxxx' @ xxxx*
* AES_CBC-256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536*
*# strongswan statusall*
*Status of IKE charon daemon (strongSwan 5.3.2, Linux 4.9.82-...., x86_64):*
* uptime: 3 minutes, since Mar 23 11:46:46 2018*
* malloc: sbrk 405504, mmap 0, used 354208, free 51296*
* worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0,
scheduled: 0*
* loaded plugins: charon aes des rc2 sha1 sha2 md4 md5 random nonce x509
revocation constraints acert pubkey pkcs1 pkcs8 pgp dnskey sshkey pem
fips-prf gmp xcbc cmac hmac ctr ccm curl attr kernel-netlink resolve
socket-default farp stroke vici updown eap-identity eap-md5 eap-gtc
eap-mschapv2 eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam
xauth-noauth dhcp*
*Listening IP addresses:*
*....*
*Connections:*
* Tunnel1: yyyy...xxxx IKEv1*
* Tunnel1: local: [yyyy] uses pre-shared key authentication*
* Tunnel1: remote: [xxxx] uses pre-shared key authentication*
* Tunnel1: child: 10.131.0.0/24 <http://10.131.0.0/24> ===
10.49.0.0/16 <http://10.49.0.0/16> TUNNEL*
*Routed Connections:*
* Tunnel1{1}: ROUTED, TUNNEL, reqid 1*
* Tunnel1{1}: 10.131.0.0/24 <http://10.131.0.0/24> === 10.49.0.0/16
<http://10.49.0.0/16>*
*Security Associations (0 up, 0 connecting):*
* none*
Here is my configs
*config setup*
* uniqueids=no*
*conn Tunnel1*
* fragmentation=yes*
* ikelifetime=60m*
* keyingtries=%forever*
* keyexchange=ikev1*
* authby=secret*
* leftauth=psk*
* rightauth=psk*
* aggressive=no*
* dpddelay=60*
* dpdtimeout=300*
* esp=aes256-sha1-modp1536*
* lifetime=3600*
* ike=aes256-sha1-modp1536*
* ikelifetime=86400*
* auto=route*
* left=yyyy*
* right=xxxx*
* leftsubnet=10.131.0.0/24 <http://10.131.0.0/24> *
* rightsubnet=10.49.0.0/16 <http://10.49.0.0/16>*
* mark=100*
* leftupdown="/etc/init.d/updown.sh -ln Tunnel1 -ll 169.254.4.1/30
<http://169.254.4.1/30> -lr 169.254.4.2/30 <http://169.254.4.2/30> -m 100
-r 10.49.0.0/16 <http://10.49.0.0/16>"*
*# ip tunnel show Tunnel1*
*Tunnel1: ip/ip remote xxxx local yyyy ttl inherit nopmtudisc key 100*
*iptables*
*-A INPUT -s xxxx/32 -d yyyy/32 -p esp -j MARK --set-xmark 0x64/0xffffffff*
*-A INPUT -s xxxx/32 -d yyyy/32 -p esp -j MARK --set-xmark 0x64/0xffffffff*
*-A FORWARD -o Tunnel1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS
--clamp-mss-to-pmtu*
*-A FORWARD -o Tunnel1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS
--clamp-mss-to-pmtu*
*route*
*10.49.0.0/16 <http://10.49.0.0/16> dev Tunnel1 scope link metric 100*
I tried with rekey=no and reauth=no . I think the otherside is cisco asa
router.
any ideas why could be causing the *rekeying* state forever. This is
phase2 IPSec SA rekeying right ? I was thinking that add=route sets up trap
and creates the SAs and up the tunnel. *ip xfrm policy* shows policies
created.
Thanks in advance
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20180323/9a69d8f6/attachment.html>
More information about the Users
mailing list