<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Set rekey=yes ?<br><br>Don't set lefsubnet if and as lefg</div><div id="AppleMailSignature">Don't set leftsoureip without a real leftsubnet</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature"><br>Sent from my iPhone</div><div><br>On Oct 20, 2016, at 16:26, Banana Man <<a href="mailto:bananasgorilla16@gmail.com">bananasgorilla16@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div><div><div><div><div>Hi:<br></div>I have a number of tunnels running well on a CentOS 7 machine with libreswan 3.15-5.el7_1. I added a new tunnel which I am having some issues with; the only real difference is that the new one is using ikev2. The config is:<br><br>conn demo<br> type=tunnel<br> authby=secret<br><br> left=10.0.0.3<br> leftsubnet=<a href="http://10.0.0.3/255.255.255.255">10.0.0.3/255.255.255.255</a><br> leftnexthop=123.45.67.4<br> leftsourceip=10.0.0.3<br><br> right=123.45.67.4<br> rightsubnet=2123.45.67.198/<a href="http://255.255.255.255">255.255.255.255</a><br> rightnexthop=10.0.0.3<br> rightsourceip=123.45.67.198<br><br> ikev2=insist<br> ike=aes-sha1<br> ikelifetime=86400s<br> phase2alg=aes-256<br> salifetime=28800s<br> rekey=no<br> pfs=no<br> auto=start<br><br></div>The other side is, I think, a Cisco ASA. The tunnel has failed sporadically and I see the following output from ipsec status when this happens:<br><br>000 #18146: "demo":500 STATE_PARENT_R1 (received v2I1, sent v2R1); EVENT_v2_RESPONDER_TIMEOUT in 77s; idle; import:respond to stranger<br><br></div>I couldn't find a lot of information on this error. Can anyone point out anything I can do here? Is there a way to automatically recover from an event like this? It works fine (for a while) with a --replace & --up.<br><br></div>Thanks,<br></div>Bananas<br><div><div><div><br></div></div></div></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Swan mailing list</span><br><span><a href="mailto:Swan@lists.libreswan.org">Swan@lists.libreswan.org</a></span><br><span><a href="https://lists.libreswan.org/mailman/listinfo/swan">https://lists.libreswan.org/mailman/listinfo/swan</a></span><br></div></blockquote></body></html>