[strongSwan] Caller session management: retry forever

[Volodymyr Litovka]

Hi colleagues,

is there a way to retry connect on receiving NO_PROPOSAL_CHOSEN from the 
peer? At the moment, I have the following configuration on the calling 
side -

conn-defaults {
         version = 2
         proposals = aes256gcm16-prfsha384-ecp384
         local_addrs = 10.1.3.14
         encap = yes
         fragmentation = yes
         mobike = no
         send_certreq = yes
         send_cert = always
         dpd_delay = 15s
         rekey_time = 3h
         unique = keep
         keyingtries = 0
         local {
                 auth = pubkey
                 id = fqdn:s4.v.zt
         }
}

child-defaults {
         ah_proposals =
         esp_proposals = aes192gcm16-aes256gcm16-ecp256
         local_ts = 0.0.0.0/0
         remote_ts = 0.0.0.0/0
         rekey_time = 1h
         mode = tunnel
         ipcomp = no
         tfc_padding = 256
         if_id_in = %unique
         if_id_out = %unique
}

connections {
   mg1-v-zt: conn-defaults {
            remote_addrs = 10.1.0.10
            remote {
                    auth = pubkey
                    id = fqdn:mg1.v.zt
            }
            vips = 0.0.0.0
            children {
                    mg1-v-zt: child-defaults {
                            updown = /etc/swanctl/bin/xfrm-updown dynamic 25.0.0.25
                            start_action = start
                            dpd_action = restart
                            close_action = start
                    }
            }
   }
}

responder side contains no information about the caller, responding with 
the following:

Apr 15 17:35:23 mg1 charon-systemd[14389]: received packet: from 10.1.3.14[500] to 10.1.0.10[500] (296 bytes)
Apr 15 17:35:23 mg1 charon-systemd[14389]: parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
Apr 15 17:35:23 mg1 charon-systemd[14389]: no IKE config found for 10.1.0.10...10.1.3.14, sending NO_PROPOSAL_CHOSEN
Apr 15 17:35:23 mg1 charon-systemd[14389]: generating IKE_SA_INIT response 0 [ N(NO_PROP) ]
Apr 15 17:35:23 mg1 charon-systemd[14389]: sending packet: from 10.1.0.10[500] to 10.1.3.14[500] (36 bytes)

after which caller stop:

Apr 15 17:35:23 s4 charon-systemd[3306]: received packet: from 10.1.0.10[500] to 10.1.3.14[500] (36 bytes)
Apr 15 17:35:23 s4 charon-systemd[3306]: parsed IKE_SA_INIT response 0 [ N(NO_PROP) ]
Apr 15 17:35:23 s4 charon-systemd[3306]: received NO_PROPOSAL_CHOSEN notify error
... nothing more until restart strongswan ...

So the question - how to make calling side try forever regardless of 
what remote  side responds or do not respond at all?

Thank you.


-- 
Volodymyr Litovka
   "Vision without Execution is Hallucination." -- Thomas Edison

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20210415/6f68e432/attachment.html>