<div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi Paul,</div><div><br></div><div>I tried setting the dpd parameters as suggested shown below.</div><div><br></div><div>conn radcert<br> ikev2=yes<br> left=10.196.175.174<br> leftsubnet=<a href="http://10.196.175.174/32">10.196.175.174/32</a><br> leftprotoport=17/1812<br> right=10.196.176.11<br> rightsubnet=<a href="http://10.196.176.11/32">10.196.176.11/32</a><br> rightprotoport=17/1812<br> auto=ondemand<br> ike=aes256-sha256;dh14<br> phase2=esp<br> phase2alg=aes256-sha1;modp2048<br> pfs=yes<br> authby=secret<br> type=tunnel<br> esn=no<br> rekey=yes<br> salifetime=300s<br> ikelifetime=3600s<br> dpddelay=30s<br> dpdtimeout=60s<br> dpdaction=hold<br><br></div><div>As an FYI, there is no ESP traffic flowing much in the tunnel.</div><div><br></div><div>Still the tunnel gets torn down from Libreswan.</div><div><br></div><div>2020-11-24T22:07:16.071632+00:00 [localhost] sshd[3367]: pam_authp(sshd:setcred): pam_sm_setcred: started<br>2020-11-24T22:07:43.863183+00:00 [localhost] pluto[3151]: "radcert" #2: Neither IKEv1 nor IKEv2 allowed: ENCRYPT+TUNNEL<br>2020-11-24T22:12:10.863542+00:00 [localhost] pluto[3151]: "radcert" #2: deleting state (STATE_V2_IPSEC_I) and sending notification<br>2020-11-24T22:12:10.863575+00:00 [localhost] pluto[3151]: "radcert" #2: ESP traffic information: in=73B out=96B<br>2020-11-24T22:12:10.868489+00:00 [localhost] pluto[3151]: expire unused parent SA #1 "radcert"<br>2020-11-24T22:12:10.868521+00:00 [localhost] pluto[3151]: "radcert" #1: ISAKMP SA expired (LATEST!)<br>2020-11-24T22:12:10.868525+00:00 [localhost] pluto[3151]: "radcert" #1: deleting state (STATE_PARENT_I3) and sending notification<br>2020-11-24T22:12:10.872568+00:00 [localhost] pluto[3151]: packet from <a href="http://10.196.175.174:500">10.196.175.174:500</a>: ISAKMP_v2_INFORMATIONAL message response has no matching IKE SA<br>2020-11-24T22:12:10.872582+00:00 [localhost] pluto[3151]: packet from <a href="http://10.196.175.174:500">10.196.175.174:500</a>: ISAKMP_v2_INFORMATIONAL message response has no matching IKE SA<br>2020-11-24T22:13:41.983279+00:00 [localhost] sshd[3483]: PAM unable to resolve symbol: pam_sm_authenticate<br><br></div><div>Any idea?</div><div><br></div><div>Thanks,</div><div>Balaji<br></div></div></div></div><br><div class="gmail_quote"><div class="gmail_attr" dir="ltr">On Tue, Nov 24, 2020 at 4:28 PM Paul Wouters <<a href="mailto:paul@nohats.ca">paul@nohats.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid">On Tue, 24 Nov 2020, Balaji Thoguluva wrote:<br>
<br>
> I am using the below configuration with an intent to do IPsec rekey initiated from Libreswan.<br>
> <br>
> conn radcert<br>
<br>
> dpddelay=0s<br>
> dpdtimeout=0s<br>
> dpdaction=hold<br>
<br>
don't set these to 0! That means whenever the code checks it deems your<br>
connection is down.<br>
<br>
timeout is time time elapsed for no responses before the tunnel is<br>
deemed down. RFCs say it should never be less than 60s, but it is<br>
possible to set this shorter.<br>
<br>
delay is the time between probes, if the connection is idle. This should<br>
also not be too short.<br>
<br>
Remember, if your link is busy and congested, if a dpd packet gets<br>
dropped it counts as failure towards the timeout period. If you<br>
timeout on a working connection due to congestion, you will have<br>
a hard time getting the connection up - it will also drop packets<br>
for the setup of the new tunnel.<br>
<br>
Try dpddelay=30s and dpdtimeout=60s<br>
<br>
Paul<br>
</blockquote></div>