[Swan] Routes dropping

Nick Howitt nick at howitts.co.uk
Fri Jun 23 16:53:04 UTC 2017


Hi Paul,

I've had another look at the logs I sent directly to you yesterday, and 
it looks like the change of the remote IP successfully renegotiated the 
conn initiated by the other end (Draytek). It is just our end which 
keeps initiating the conn with the old IP address. You can see the 
correct conn rekeying every 50min or so, but libreswan also initiates to 
the old IP address every 1min 4s. It does not happen all the time as the 
remote IP address changed again last night without any issues.

I've restarted ipsec with plutodebug=all.

Regards,

Nick

On 22/06/2017 21:24, Nick Howitt wrote:
>
>
> On 22/06/2017 21:07, Paul Wouters wrote:
>>
>> On Thu, 22 Jun 2017, Nick Howitt wrote:
>>
>>> Originally the "roadwarrior" set up was that one end would never 
>>> initiate or rekey. This was done with auto=add and rekey=no, and 
>>> possibly also setting DPD to clear (and
>>> implicitly wait for the other end to re-initiate). Somehow a way 
>>> must be found again to stop the listening end initiating even if it 
>>> means adding a further parameter. I
>>> think that the changes have introduced a significant interop problem 
>>> and makes my conn unreliable. I hardly use it but it has been 
>>> rekeying for days and I only noticed
>>> it because of the size of the log file. In my case you can even 
>>> argue it is rekeying to the wrong IP as right is defined as %any so 
>>> should not rekey to a specific IP
>>> address. I am pretty certain changing the behaviour is wrong as it 
>>> can potentially break working setups (like mine). To change the 
>>> behaviour, really another parameter
>>> should be introduced which defaults to allow the original behaviour.
>>
>> A conn with auto=add and rekey=no, not manually changed used the ipsec
>> command, should never initiate. If you can gather more detailed logs
>> of that event, that would be useful. Is this a 3.21rcX version?
> No, it is a vanilla libreswan-3.20-1.el7.x86_64.rpm from your repo. 
> Ipsec was restarted last week with a "service ipsec restart" (I know I 
> should use systemctl but it is more typing) as well for this issue and 
> I don't use manual ipsec commands. I can gather more info if you tell 
> me what you want. I have the standard logs, but I guess you want more.
>
> Nick
>
>
> _______________________________________________
> Swan mailing list
> Swan at lists.libreswan.org
> https://lists.libreswan.org/mailman/listinfo/swan



More information about the Swan mailing list