[strongSwan] Packet loss in ipsec tunnel
waxitau at gmail.com
Mon Oct 12 18:50:29 CEST 2020
Thanks for replying, Tobias, the suggestion is very helpful.
The replay window size is the default value (32 packets) which effectively
is quite low - will increase it and see how it goes.
On Mon, Oct 12, 2020 at 4:44 PM Tobias Brunner <tobias at strongswan.org>
> > * When is replay-window stats increased ?
> Whenever a packet arrives with a sequence number that's lower than the
> lower end of the replay window (i.e. with seq < highest_received_seq -
> window). Could be an actually delayed packet but might also be because
> the window is simply too small for your line speed and traffic pattern,
> e.g. because packets arrive so fast and in quick succession that the
> window is moved constantly and too quickly so slightly delayed (or
> perhaps larger) packets have to be dropped.
> > * I've noticed that on devices not experiencing packet losses over the
> > ipsec tunnel all the stats = 0 (replay-window, replay & fail).
> Yes, those stats indicate errors, so it's good if everything is 0 there.
> > * I'm suspecting a replay window issue for received ipsec packets that
> > are dropped..
> Did you configure a replay window size
> (connections.<conn>.children.<child>.replay_window in swanctl.conf)?
> The default is 32, which is pretty low.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Users