[strongSwan] received netlink error: Network is unreachable

[Noel Kuntze]

Hello Houman,

That happens when the main routing table (Or other tables in newer kernels) does not have any routes that allow the new route to be installed (next hop is not reachable over a local interface).
For the exact reason, you'd need to at least provide the IPv6 routing tables.

Kind regards

Noel

Am 18.07.19 um 00:47 schrieb Houman:
> Hello,
>
> I'm getting this error in the syslog.
>
> It still connects but I keep getting this error sometimes:
> *charon: 15[KNL] received netlink error: Network is unreachable (101)*
>
> Why is that?
>
> *Syslog:*
>
> Jul 17 21:31:08 de-fsn-2 charon: 09[CFG] reassigning offline lease to 'c8c09c88-8a67-4af6-8620-xxxxxx'
>
> Jul 17 21:31:08 de-fsn-2 charon: 09[IKE] assigning virtual IP 10.10.55.127 to peer 'c8c09c88-8a67-4af6-8620-xxxxxx'
>
> Jul 17 21:31:08 de-fsn-2 charon: 09[IKE] peer requested virtual IP %any6
>
> Jul 17 21:31:08 de-fsn-2 charon: 09[CFG] reassigning offline lease to 'c8c09c88-8a67-4af6-8620-xxxxxx'
>
> Jul 17 21:31:08 de-fsn-2 charon: 09[IKE] assigning virtual IP fdd2:54c4:4c90:1::307f to peer 'c8c09c88-8a67-4af6-8620-xxxxxx'
>
> Jul 17 21:31:08 de-fsn-2 charon: 09[KNL] received netlink error: Network is unreachable (101)
>
> Jul 17 21:31:08 de-fsn-2 charon: 09[KNL] unable to install source route for %any
>
> Jul 17 21:31:08 de-fsn-2 charon: 09[IKE] CHILD_SA Falkenstein-2{455771} established with SPIs c6b5caac_i 0c8a8cdf_o and TS 0.0.0.0/0 <http://0.0.0.0/0> ::/0 === 10.10.55.127/32 <http://10.10.55.127/32> fdd2:54c4:4c90:1::307f/128
>
> Jul 17 21:31:08 de-fsn-2 charon: 09[CFG] sending RADIUS Accounting-Request to server 'server-a'
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[NET] received packet: from 109.177.xx.xxx[4500] to 136.243.xxx.xxx[4500] (112 bytes)
>
> Jul 17 21:31:08 de-fsn-2 charon: 09[CFG] received RADIUS Accounting-Response from server 'server-a'
>
> Jul 17 21:31:08 de-fsn-2 charon: 09[ENC] generating IKE_AUTH response 6 [ AUTH CPRP(ADDR ADDR6 DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) ]
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[ENC] parsed IKE_AUTH request 6 [ AUTH ]
>
> Jul 17 21:31:08 de-fsn-2 charon: 09[NET] sending packet: from 136.243.xxx.xxx[4500] to 86.97.xx.xxx[4500] (368 bytes)
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] authentication of 'VPN' with EAP successful
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] authentication of 'de-fsn-2.xxxxx.net <http://de-fsn-2.xxxxx.net>' (myself) with EAP
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] IKE_SA Falkenstein-2[549905] established between 136.243.xxx.xxx[de-fsn-2.xxxxx.net <http://de-fsn-2.xxxxx.net>]...109.177.xx.xxx[VPN]
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] peer requested virtual IP %any
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[CFG] reassigning offline lease to 'b05ccf72-7bad-425e-95e0-xxxxx'
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] assigning virtual IP 10.10.50.102 to peer 'b05ccf72-7bad-425e-95e0-xxxxx'
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] peer requested virtual IP %any6
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[CFG] reassigning offline lease to 'b05ccf72-7bad-425e-95e0-xxxxx'
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] assigning virtual IP fdd2:54c4:4c90:1::2b66 to peer 'b05ccf72-7bad-425e-95e0-xxxxx'
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[KNL] received netlink error: Network is unreachable (101)
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[KNL] unable to install source route for %any
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[IKE] CHILD_SA Falkenstein-2{455772} established with SPIs c23f2271_i 07d2a903_o and TS 0.0.0.0/0 <http://0.0.0.0/0> ::/0 === 10.10.50.102/32 <http://10.10.50.102/32> fdd2:54c4:4c90:1::2b66/128
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[CFG] sending RADIUS Accounting-Request to server 'server-a'
>
> Jul 17 21:31:08 de-fsn-2 charon: 13[NET] received packet: from 94.206.xxx.xxx[4500] to 136.243.xxx.xxx[4500] (368 bytes)
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[CFG] received RADIUS Accounting-Response from server 'server-a'
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[ENC] generating IKE_AUTH response 6 [ AUTH CPRP(ADDR ADDR6 DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) ]
>
> Jul 17 21:31:08 de-fsn-2 charon: 13[ENC] unknown attribute type (25)
>
> Jul 17 21:31:08 de-fsn-2 charon: 13[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 DNS6 (25)) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr N(EAP_ONLY) ]
>
> Jul 17 21:31:08 de-fsn-2 charon: 15[NET] sending packet: from 136.243.xxx.xxx[4500] to 109.177.xx.xxx[4500] (368 bytes)
>
> Jul 17 21:31:08 de-fsn-2 charon: 13[CFG] looking for peer configs matching 136.243.xxx.xxx[de-fsn-2.xxxxx.net <http://de-fsn-2.xxxxx.net>]...94.206.xxx.xxx[VPN]
>
> Jul 17 21:31:08 de-fsn-2 charon: 13[CFG] selected peer config 'Falkenstein-2'
>
>
> Many Thanks,
>
> Houman
>

-- 
Noel Kuntze
IT security consultant

GPG Key ID: 0x0739AD6C
Fingerprint: 3524 93BE B5F7 8E63 1372 AF2D F54E E40B 0739 AD6C


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.strongswan.org/pipermail/users/attachments/20190718/fcb37b8f/attachment.sig>