<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="NL-BE" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hi Paul,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Thanks for your reply.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">The version we are using is:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"># ipsec pluto --version<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Libreswan 3.master-201549.git XFRM(netkey) KLIPS NSS DNSSEC FIPS_CHECK LABELED_IPSEC LIBCAP_NG XAUTH_PAM NETWORKMANAGER CURL(non-NSS) LDAP(non-NSS)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Marc<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="mso-fareast-language:NL-BE">From:</span></b><span lang="EN-US" style="mso-fareast-language:NL-BE"> Paul Wouters [mailto:paul@nohats.ca]
<br>
<b>Sent:</b> mercredi 6 avril 2016 14:31<br>
<b>To:</b> Marc Ledent <marc.ledent@homesend.com><br>
<b>Cc:</b> swan@lists.libreswan.org<br>
<b>Subject:</b> Re: [Swan] IPSEC SA replace also replaces ISAKMP SA<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Do you still see this with 3.17? That version has a fix for shared IKE connections such as aliases that you are using.<span style="font-size:12.0pt;mso-fareast-language:NL-BE"><o:p></o:p></span></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal">If you do, can you send me a Pluto log offlist?<o:p></o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div id="AppleMailSignature">
<p class="MsoNormal">Paul<br>
<br>
Sent from my iPhone<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
On Apr 5, 2016, at 06:34, Marc Ledent <<a href="mailto:marc.ledent@homesend.com">marc.ledent@homesend.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="color:#1F497D">Hi all,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Sorry to bother you with this, but this issue is quite blocking for us. Is somebody can help us on this?</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Regards,</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Marc</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="mso-fareast-language:NL-BE">From:</span></b><span lang="EN-US" style="mso-fareast-language:NL-BE"> Marc Ledent
<br>
<b>Sent:</b> jeudi 31 mars 2016 15:13<br>
<b>To:</b> '<a href="mailto:swan@lists.libreswan.org">swan@lists.libreswan.org</a>' <<a href="mailto:swan@lists.libreswan.org">swan@lists.libreswan.org</a>><br>
<b>Subject:</b> IPSEC SA replace also replaces ISAKMP SA</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="FR-BE">Hi all,</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="FR-BE"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">We have a strange behaviour on one of our tunnels.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">On this tunnel, when the IPSEC SA is coming to expiration, it is replaced WITH the ISAKMP SA, but WITHOUT deleting this latter, which leads to an increasing number of “to be replaced” ISAKMP SA.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">I made some searches on the internet but without results…</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">The config:</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": 0.0.0.0/0===XXXX<XXXXXXXX>...YYYYYYYY<YYYYYYYYY>===0.0.0.0/0; erouted; eroute owner: #595</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": oriented; my_ip=unset; their_ip=unset; myup=/etc/ipsec.d/conn_name-vpn.sh</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": xauth info: us:none, them:none, my_xauthuser=[any]; their_xauthuser=[any]</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": modecfg info: us:none, them:none, modecfg policy:push, dns1:unset, dns2:unset, domain:unset, banner:unset;</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": labeled_ipsec:no;</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": policy_label:unset;</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": ike_life: 28800s; ipsec_life: 3600s; replay_window: 32; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": retransmit-interval: 500ms; retransmit-timeout: 60s;</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": sha2_truncbug:no; initial_contact:no; cisco_unity:no; fake_strongswan:no; send_vendorid:no;</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": policy: PSK+ENCRYPT+TUNNEL+UP+IKEV1_ALLOW+IKEV2_ALLOW+IKEV2_PROPOSE+SAREF_TRACK+IKE_FRAG_ALLOW;</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": conn_prio: 0,0; interface: ens225; metric: 0; mtu: unset; sa_prio:auto; nflog-group: unset; mark: 10/0xffffffff;</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="FR-BE">000 "conn_name/1x1": newest ISAKMP SA: #594; newest IPsec SA: #595;</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": aliases: conn_name</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": IKE algorithms wanted: AES_CBC(7)_128-SHA1(2)_000-MODP2048(14), AES_CBC(7)_128-SHA1(2)_000-MODP1536(5), AES_CBC(7)_128-SHA1(2)_000-MODP1024(2)</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": IKE algorithms found: AES_CBC(7)_128-SHA1(2)_160-MODP2048(14), AES_CBC(7)_128-SHA1(2)_160-MODP1536(5), AES_CBC(7)_128-SHA1(2)_160-MODP1024(2)</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": IKEv2 algorithm newest: AES_CBC_128-AUTH_HMAC_SHA1_96-PRF_HMAC_SHA1-MODP2048</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": ESP algorithms wanted: AES(12)_128-SHA1(2)_000; pfsgroup=MODP2048(14)</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 "conn_name/1x1": ESP algorithms loaded: AES(12)_128-SHA1(2)_000</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"># active SAs</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 #595: "conn_name/1x1":500 STATE_PARENT_I3 (PARENT SA established); EVENT_SA_REPLACE in 1890s; newest IPSEC; eroute owner; isakmp#594; idle; import:respond to stranger</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 #595: "conn_name/1x1" <a href="mailto:esp.ca572b92@80.84.22.51">
esp.ca572b92@80.84.22.51</a> <a href="mailto:esp.f6b62d0@64.94.187.67">esp.f6b62d0@64.94.187.67</a>
<a href="mailto:tun.0@80.84.22.51">tun.0@80.84.22.51</a> <a href="mailto:tun.0@64.94.187.67">
tun.0@64.94.187.67</a> ref=0 refhim=4294901761 Traffic: ESPin=3MB ESPout=5MB! ESPmax=0B</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 #594: "conn_name/1x1":500 STATE_PARENT_I3 (PARENT SA established); EVENT_SA_REPLACE in 27026s; newest ISAKMP; isakmp#0; idle; import:respond to stranger</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 #594: "conn_name/1x1" ref=0 refhim=0 Traffic:</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"># “dead” SAs</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 #392: "bics/1x1":500 STATE_PARENT_I3 (PARENT SA established); EVENT_SA_REPLACE in 798s; isakmp#0; idle; import:respond to stranger</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 #392: "bics/1x1" ref=0 refhim=0 Traffic:</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 #414: "bics/1x1":500 STATE_PARENT_I3 (PARENT SA established); EVENT_SA_REPLACE in 3672s; isakmp#0; idle; import:respond to stranger</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 #414: "bics/1x1" ref=0 refhim=0 Traffic:</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 #551: "bics/1x1":500 STATE_PARENT_I3 (PARENT SA established); EVENT_SA_REPLACE in 21212s; isakmp#0; idle; import:respond to stranger</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">000 #551: "bics/1x1" ref=0 refhim=0 Traffic:</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">Any ideas?</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">Regards,</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US">Marc</span><o:p></o:p></p>
</div>
</blockquote>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:NL-BE">_______________________________________________<br>
Swan mailing list<br>
<a href="mailto:Swan@lists.libreswan.org">Swan@lists.libreswan.org</a><br>
<a href="https://lists.libreswan.org/mailman/listinfo/swan">https://lists.libreswan.org/mailman/listinfo/swan</a><o:p></o:p></span></p>
</div>
</blockquote>
</div>
</body>
</html>