[strongSwan] tunnel stuck, won’t seem to timeout and can’t manually delete either

Tobias Brunner tobias at strongswan.org
Thu Feb 3 10:10:32 CET 2022

Hi David,

> I didn’t mention that we have Strongswan running in a high-availability setup, there is a msg referring to "segment 1" in the log. I don’t think that has anything to do with the issue with tunnel 68486, just wanted to mention it.

I wouldn't rule that out completely.  There is definitely something 
weird going on here:

> Jan 31 11:24:05.815 08[IKE] <ikev2-conn-qa|68486> queueing IKE_DPD task
> Jan 31 11:24:05.815 08[IKE] <ikev2-conn-qa|68486> activating new tasks
> Jan 31 11:24:05.815 08[IKE] <ikev2-conn-qa|68486>   activating IKE_DPD task
> Jan 31 11:24:09.815 14[IKE] <ikev2-conn-qa|68486> retransmit 1 of request with message ID 0

We see that the DPD is initiated and a first retransmit is sent four 
seconds after the initial message (we don't see that explicitly in the 
log, but lets assume there was a message sent).  But now the second 
retransmit is only sent after a very long delay (over twelve hours):

> Feb  1 00:01:36.311 10[IKE] <ikev2-conn-qa|68486> retransmit 2 of request with message ID 0

That doesn't really make sense.  What retransmission settings [1] have 
you configured?

Also, not sure what log settings you used, but there are definitely 
messages missing that could be helpful.  See [2] for basic debug log 
settings, however, in this case log messages on level 2 for the job 
subsystem might also be helpful (so maybe don't set that to 1 if you use 
the log snippet).


[1] https://wiki.strongswan.org/projects/strongswan/wiki/Retransmission

More information about the Users mailing list