[strongSwan] question on ikev2 rekey
ksyblast at gmail.com
Mon Nov 12 12:44:01 CET 2018
Any help would be appreciated on the issue.
Strongswan version 5.3.5.
We have a trouble connected with traffic loss on IKEv2 rekeying, with
multiple nets in leftsubnet and rightsubnet configured.
My investigation of the issue shows that the reason is the following:
1) when CHILD_SA on our side expires, strongswan sends a CREATE_CHILD_SA
request, containing all networks listed in left- and rightsubnet in Traffic
Selector fields of the proposal.
2) Our peer (I am not sure what software or hardware they use) responds
only with the *first* left- and right- network pair as a match. As a
result, when rekeying is needed for subnets different than the first ones
in a set, SAs are not created for them because they are not matched by the
3) However, when rekeying is done by the peer, they send only those subnets
in traffic selectors, for which CHILD_SAs are expired.
As a result, when our side is initiating rekeying, we are experiencing some
traffic loss for some subnet pairs until these SAs are not rekeyed by the
So my question is: is it a default behavior for strongswan to list all
subnets in Traffic Selector fields even if their CHILD SAs are not expired
yet? Is it possible to change this behavior to include only those subnets,
which need rekeying, into proposals? Is it an expected behavior for our
peer? What would you suggest?
The configuration of the peer as follows:
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Users