<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div class=""> I use auto=ignore since I have other processes that manage the tunnel connection and ensure it sets up correctly (client initiating with server rather than leaving that up to chance).. I believe something went wrong during post-reboot initiation,
which is contained in the first two log snippets. Multiples IPsec SAs are installed and I can’t explain why.</div>
<div class=""><br class="">
</div>
<div class="">The last two log snippets capture ipsec auto —delete conn37 followed by ipsec auto —replace conn37 and ipsec auto —route conn37. It appears like something went amiss when the client receives the —delete conn37 notification, as the quick mode initiation
in #64 gets deleted, and thus the client machine appears to forget about conn1. I believe the root problem is the initial initiation of multiple SAs, though I could be wrong.</div>
<div class=""><br class="">
<div class="">
<div class="">Post-reboot initiation from server...</div>
<div class=""><br class="">
</div>
<div class="">Sep 7 03:23:16 cq-use1f-1 pluto[2446]: "conn37": prepare-client output: net.ipv4.conf.conn37.disable_policy = 1</div>
<div class="">Sep 7 03:23:16 cq-use1f-1 pluto[2446]: "conn37": prepare-client output: net.ipv4.conf.conn37.rp_filter = 0</div>
<div class="">Sep 7 03:23:16 cq-use1f-1 pluto[2446]: "conn37": prepare-client output: net.ipv4.conf.conn37.forwarding = 1</div>
<div class="">Sep 7 03:23:17 cq-use1f-1 pluto[2446]: packet from 199.32.40.51:500: initial Main Mode message received on 51.179.82.210:500 but no connection has been authorized with policy RSASIG+IKEV1_ALLOW</div>
<div class="">Sep 7 03:23:17 cq-use1f-1 pluto[2446]: "conn37" #1: responding to Main Mode</div>
<div class="">Sep 7 03:23:17 cq-use1f-1 pluto[2446]: "conn37" #1: STATE_MAIN_R1: sent MR1, expecting MI2</div>
<div class="">Sep 7 03:23:17 cq-use1f-1 pluto[2446]: packet from 100.9.123.24:500: initial Main Mode message received on 51.179.82.210:500 but no connection has been authorized with policy RSASIG+IKEV1_ALLOW</div>
<div class="">Sep 7 03:23:17 cq-use1f-1 pluto[2446]: "conn37" #1: STATE_MAIN_R2: sent MR2, expecting MI3</div>
<div class="">Sep 7 03:23:17 cq-use1f-1 pluto[2446]: "conn37" #1: Peer ID is ID_FQDN: '@left-70.240.163.43'</div>
<div class="">Sep 7 03:23:17 cq-use1f-1 pluto[2446]: "conn37" #1: certificate verified OK: CN=ABC123,OU=Engineering,O="Craig Inc.",L=Seattle,ST=Washington,C=US</div>
<div class="">Sep 7 03:23:17 cq-use1f-1 pluto[2446]: "conn37" #1: I am sending my cert</div>
<div class="">Sep 7 03:23:17 cq-use1f-1 pluto[2446]: "conn37" #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=RSA_SIG cipher=aes_256 integ=sha2_256 group=MODP2048}</div>
<div class="">Sep 7 03:23:18 cq-use1f-1 pluto[2446]: "conn37" #1: retransmitting in response to duplicate packet; already STATE_MAIN_R3</div>
<div class="">Sep 7 03:23:18 cq-use1f-1 pluto[2446]: "conn37" #1: the peer proposed: 0.0.0.0/0:0/0 -> 0.0.0.0/0:0/0</div>
<div class="">Sep 7 03:23:18 cq-use1f-1 pluto[2446]: "conn37" #2: responding to Quick Mode proposal {msgid:6e65d8fb}</div>
<div class="">Sep 7 03:23:18 cq-use1f-1 pluto[2446]: "conn37" #2: us: 0.0.0.0/0===51.179.82.210<51.179.82.210>[C=US, ST=Washington, L=Seattle, O=Craig Inc., OU=Engineering, CN=cq-use1f-1]</div>
<div class="">Sep 7 03:23:18 cq-use1f-1 pluto[2446]: "conn37" #2: them: 70.240.163.43<70.240.163.43>[@left-70.240.163.43]===0.0.0.0/0</div>
<div class="">Sep 7 03:23:18 cq-use1f-1 pluto[2446]: "conn37" #2: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2 tunnel mode {ESP/NAT=>0x5e5bf357 <0xa767280b xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATOA=none NATD=70.240.163.43:4500 DPD=passive}</div>
<div class="">Sep 7 03:23:18 cq-use1f-1 pluto[2446]: "conn37" #2: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP/NAT=>0x5e5bf357 <0xa767280b xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATOA=none NATD=70.240.163.43:4500 DPD=passive}</div>
<div class=""><br class="">
</div>
<div class="">… information unrelated to conn37 removed ...</div>
<div class=""><br class="">
</div>
<div class="">Sep 7 03:23:20 cq-use1f-1 pluto[2446]: assign_holdpass() delete_bare_shunt() failed</div>
<div class="">Sep 7 03:23:20 cq-use1f-1 pluto[2446]: initiate_ondemand_body() failed to install negotiation_shunt,</div>
<div class="">Sep 7 03:23:20 cq-use1f-1 pluto[2446]: initiate on demand from 172.16.0.2:8 to 172.16.0.3:0 proto=1 because: acquire</div>
<div class="">Sep 7 03:23:20 cq-use1f-1 pluto[2446]: "conn37" #5: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO {using isakmp#1 msgid:da2d1713 proposal=AES_CBC_256-HMAC_SHA2_256_128 pfsgroup=MODP2048}</div>
<div class="">Sep 7 03:23:20 cq-use1f-1 pluto[2446]: assign_holdpass() delete_bare_shunt() failed</div>
<div class="">Sep 7 03:23:20 cq-use1f-1 pluto[2446]: initiate_ondemand_body() failed to install negotiation_shunt,</div>
<div class="">Sep 7 03:23:20 cq-use1f-1 pluto[2446]: initiate on demand from 172.16.2.2:8 to 172.16.2.3:0 proto=1 because: acquire</div>
<div class="">Sep 7 03:23:20 cq-use1f-1 pluto[2446]: "conn37" #5: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO {using isakmp#1 msgid:da2d1713 proposal=AES_CBC_256-HMAC_SHA2_256_128 pfsgroup=MODP2048}</div>
<div class="">Sep 7 03:23:20 cq-use1f-1 pluto[2446]: "conn37" #6: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO {using isakmp#1 msgid:4f41317c proposal=AES_CBC_256-HMAC_SHA2_256_128 pfsgroup=MODP2048}</div>
<div class="">Sep 7 03:23:20 cq-use1f-1 pluto[2446]: "conn37" #5: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP/NAT=>0xc981ba01 <0xefe112e2 xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATOA=none NATD=70.240.163.43:4500 DPD=passive}</div>
<div class="">Sep 7 03:23:20 cq-use1f-1 pluto[2446]: "conn37" #6: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP/NAT=>0x863a2b6b <0xcbfb1484 xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATOA=none NATD=70.240.163.43:4500 DPD=passive}</div>
<div class=""><br class="">
</div>
<div class="">Post-reboot initiation from client...</div>
<div class=""><br class="">
</div>
<div class="">Sep 7 03:23:14 fmn-767 pluto[2190]: "conn1" #47: STATE_MAIN_I1: retransmission; will wait 0.5 seconds for response</div>
<div class="">Sep 7 03:23:14 fmn-767 pluto[2190]: "conn1" #47: STATE_MAIN_I1: retransmission; will wait 1 seconds for response</div>
<div class="">Sep 7 03:23:15 fmn-767 pluto[2190]: "conn1" #47: STATE_MAIN_I1: retransmission; will wait 2 seconds for response</div>
<div class="">Sep 7 03:23:17 fmn-767 pluto[2190]: "conn1" #47: STATE_MAIN_I1: retransmission; will wait 4 seconds for response</div>
<div class="">Sep 7 03:23:17 fmn-767 pluto[2190]: "conn1" #47: STATE_MAIN_I2: sent MI2, expecting MR2</div>
<div class="">Sep 7 03:23:17 fmn-767 pluto[2190]: "conn1" #47: I am sending my cert</div>
<div class="">Sep 7 03:23:17 fmn-767 pluto[2190]: "conn1" #47: I am sending a certificate request</div>
<div class="">Sep 7 03:23:17 fmn-767 pluto[2190]: "conn1" #47: STATE_MAIN_I3: sent MI3, expecting MR3</div>
<div class="">Sep 7 03:23:18 fmn-767 pluto[2190]: "conn1" #47: STATE_MAIN_I3: retransmission; will wait 0.5 seconds for response</div>
<div class="">Sep 7 03:23:18 fmn-767 pluto[2190]: "conn1" #47: Peer ID is ID_DER_ASN1_DN: 'C=US, ST=Washington, L=Seattle, O=Craig Inc., OU=Engineering, CN=cq-use1f-1'</div>
<div class="">Sep 7 03:23:18 fmn-767 pluto[2190]: "conn1" #47: certificate verified OK: CN=cq-use1f-1,OU=Engineering,O="Craig Inc.",L=Seattle,ST=Washington,C=US</div>
<div class="">Sep 7 03:23:18 fmn-767 pluto[2190]: "conn1" #47: STATE_MAIN_I4: ISAKMP SA established {auth=RSA_SIG cipher=aes_256 integ=sha2_256 group=MODP2048}</div>
<div class="">Sep 7 03:23:18 fmn-767 pluto[2190]: "conn1" #48: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO {using isakmp#47 msgid:6e65d8fb proposal=AES_CBC_256-HMAC_SHA2_256_128 pfsgroup=MODP2048}</div>
<div class="">Sep 7 03:23:18 fmn-767 pluto[2190]: "conn1" #48: up-client output: vti interface "conn1" already exists with conflicting setting</div>
<div class="">Sep 7 03:23:18 fmn-767 pluto[2190]: "conn1" #48: up-client output: existing: conn1: ip/ip remote any local 70.240.163.43 ttl inherit key 16777216</div>
<div class="">Sep 7 03:23:18 fmn-767 pluto[2190]: "conn1" #48: up-client output: wanted : conn1: ip/ip remote any local 70.240.163.43 ttl inherit key 16777216</div>
<div class="">Sep 7 03:23:18 fmn-767 pluto[2190]: "conn1" #48: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP/NAT=>0xa767280b <0x5e5bf357 xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATOA=none NATD=51.179.82.210:4500 DPD=active}</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #47: the peer proposed: 0.0.0.0/0:0/0 -> 0.0.0.0/0:0/0</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #49: responding to Quick Mode proposal {msgid:da2d1713}</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #49: us: 0.0.0.0/0===70.240.163.43<70.240.163.43>[@left-70.240.163.43]</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #49: them: 51.179.82.210<51.179.82.210>[C=US, ST=Washington, L=Seattle, O=Craig Inc., OU=Engineering, CN=cq-use1f-1]===0.0.0.0/0</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #49: keeping refhim=0 during rekey</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #49: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2 tunnel mode {ESP/NAT=>0xefe112e2 <0xc981ba01 xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATOA=none NATD=51.179.82.210:4500 DPD=active}</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #47: the peer proposed: 0.0.0.0/0:0/0 -> 0.0.0.0/0:0/0</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #50: responding to Quick Mode proposal {msgid:4f41317c}</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #50: us: 0.0.0.0/0===70.240.163.43<70.240.163.43>[@left-70.240.163.43]</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #50: them: 51.179.82.210<51.179.82.210>[C=US, ST=Washington, L=Seattle, O=Craig Inc., OU=Engineering, CN=cq-use1f-1]===0.0.0.0/0</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #50: keeping refhim=0 during rekey</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #50: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2 tunnel mode {ESP/NAT=>0xcbfb1484 <0x863a2b6b xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATOA=none NATD=51.179.82.210:4500 DPD=active}</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #49: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP/NAT=>0xefe112e2 <0xc981ba01 xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATOA=none NATD=51.179.82.210:4500 DPD=active}</div>
<div class="">Sep 7 03:23:20 fmn-767 pluto[2190]: "conn1" #50: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP/NAT=>0xcbfb1484 <0x863a2b6b xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATOA=none NATD=51.179.82.210:4500 DPD=active}</div>
<div class=""><br class="">
</div>
<div class="">Server invokes ipsec auto —delete conn37 and later ipsec auto —replace conn37 and ipsec auto —route conn37...</div>
<div class=""><br class="">
</div>
<div class="">Sep 7 08:09:39 cq-use1f-1 pluto[2446]: "conn37": deleting non-instance connection</div>
<div class="">Sep 7 08:09:39 cq-use1f-1 pluto[2446]: "conn37" #6: deleting state (STATE_QUICK_I2) and sending notification</div>
<div class="">Sep 7 08:09:39 cq-use1f-1 pluto[2446]: "conn37" #6: ESP traffic information: in=280B out=2MB</div>
<div class="">Sep 7 08:09:39 cq-use1f-1 pluto[2446]: "conn37" #5: deleting state (STATE_QUICK_I2) and sending notification</div>
<div class="">Sep 7 08:09:39 cq-use1f-1 pluto[2446]: "conn37" #5: ESP traffic information: in=3MB out=0B</div>
<div class="">Sep 7 08:09:39 cq-use1f-1 pluto[2446]: "conn37" #2: deleting state (STATE_QUICK_R2) and sending notification</div>
<div class="">Sep 7 08:09:39 cq-use1f-1 pluto[2446]: "conn37" #2: ESP traffic information: in=28B out=28B</div>
<div class="">Sep 7 08:09:39 cq-use1f-1 pluto[2446]: "conn37" #49: deleting state (STATE_MAIN_R3) and sending notification</div>
<div class="">Sep 7 08:09:39 cq-use1f-1 pluto[2446]: "conn37" #41: deleting state (STATE_MAIN_R3) and sending notification</div>
<div class="">Sep 7 08:09:39 cq-use1f-1 pluto[2446]: "conn37": ERROR: netlink XFRM_MSG_DELPOLICY response for flow eroute_connection delete included errno 2: No such file or directory</div>
<div class=""><br class="">
</div>
<div class="">...</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">Sep 7 08:09:48 cq-use1f-1 pluto[8504]: added connection description “conn37"</div>
<div class="">Sep 7 08:09:49 cq-use1f-1 pluto[8504]: "conn37": prepare-client output: net.ipv4.conf. conn37.disable_policy = 1</div>
<div class="">Sep 7 08:09:49 cq-use1f-1 pluto[8504]: "conn37": prepare-client output: net.ipv4.conf. conn37.rp_filter = 0</div>
<div class="">Sep 7 08:09:49 cq-use1f-1 pluto[8504]: "conn37": prepare-client output: net.ipv4.conf. conn37.forwarding = 1</div>
</div>
<div class=""><br class="">
</div>
<div class="">Client receives --delete notification from server...</div>
<div class=""><br class="">
</div>
<div class="">Sep 7 08:09:39 fmn-767 pluto[2190]: "conn1" #63: received Delete SA payload: replace IPSEC State #50 now</div>
<div class="">Sep 7 08:09:39 fmn-767 pluto[2190]: "conn1" #63: received and ignored empty informational notification payload</div>
<div class="">Sep 7 08:09:39 fmn-767 pluto[2190]: "conn1" #64: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO to replace #50 {using isakmp#63 msgid:7973fff2 proposal=AES_CBC_256-HMAC_SHA2_256_128
pfsgroup=MODP2048}</div>
<div class="">Sep 7 08:09:39 fmn-767 pluto[2190]: "conn1" #50: deleting state (STATE_QUICK_R2) and sending notification</div>
<div class="">Sep 7 08:09:39 fmn-767 pluto[2190]: "conn1" #50: ESP traffic information: in=2MB out=280B</div>
<div class="">Sep 7 08:09:39 fmn-767 pluto[2190]: "conn1" #63: received Delete SA(0xefe112e2) payload: deleting IPSEC State #49</div>
<div class="">Sep 7 08:09:39 fmn-767 pluto[2190]: "conn1" #49: deleting other state #49 (STATE_QUICK_R2) and sending notification</div>
<div class="">Sep 7 08:09:39 fmn-767 pluto[2190]: "conn1" #49: ESP traffic information: in=0B out=3MB</div>
<div class="">Sep 7 08:09:39 fmn-767 pluto[2190]: "conn1" #64: deleting state (STATE_QUICK_I1)</div>
<div class="">Sep 7 08:09:39 fmn-767 pluto[2190]: "conn1" #48: deleting state (STATE_QUICK_I2) and sending notification</div>
<div class="">Sep 7 08:09:39 fmn-767 pluto[2190]: "conn1" #48: ESP traffic information: in=28B out=28B</div>
<div class="">Sep 7 08:09:39 fmn-767 pluto[2190]: "conn1" #63: deleting state (STATE_MAIN_I4) and sending notification</div>
</div>
<div class=""><br class="">
</div>
<div class="">…no further conn1 messages in client logs.</div>
<div class="">
<div class=""><br class="">
</div>
<div class="">Here is the conn1.conf file. The conn37.conf file is contained in my original message.</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">conn conn1</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>left=70.240.163.43</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>leftid="@left-70.240.163.43"</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>leftsubnet=0.0.0.0/0</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>leftcert=client</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>left=70.240.163.43</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>leftcert=client</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>right=51.179.82.210</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>rightid="%fromcert"</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>rightsubnet=0.0.0.0/0</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>right=51.179.82.210</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>authby=rsasig</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>vti-routing=no</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>vti-shared=yes</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>encapsulation=yes</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>keyingtries=0</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>dpddelay=30</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>dpdtimeout=120</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>dpdaction=restart</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>mark=0x1000000/0xff000000</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>vti-interface=conn1</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>phase2alg=aes256-sha2_256</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>auto=ignore</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>type=tunnel</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>compress=no</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>pfs=yes</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>ikepad=yes</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>authby=rsasig</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>phase2=esp</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>ikev2=permit</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>ppk=no</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>esn=no</div>
</div>
<div class=""><br class="">
</div>
<div class="">
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">
--</div>
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">
cm</div>
</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">On Sep 9, 2018, at 2:51 PM, Paul Wouters <<a href="mailto:paul@nohats.ca" class="">paul@nohats.ca</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">On Fri, 7 Sep 2018, Craig Marker wrote:<br class="">
<br class="">
<blockquote type="cite" class="">I’m debugging an issue where my server rebooted and the tunnel didn’t reestablish correctly, and<br class="">
I noticed strange entries in the server’s ip xfrm state table. Namely, a ton of duplicates for<br class="">
established connections. Is this something I should be worried about or something that has been<br class="">
seen before?<br class="">
</blockquote>
<br class="">
Usually that means the two endpoints keep renegotiating for some reason,<br class="">
and libreswan is keeping the old ones for a bit before cleaning them up.<br class="">
<br class="">
<blockquote type="cite" class="">I also noticed this strange entry that doesn’t correspond to any .conf file, except it has the<br class="">
src/dst mapping to the VTI Ip address for conn37. Though there is no configuration anywhere that<br class="">
connects conn37.conf and the VTI IP address endpoints (they are applied with ip addr after the<br class="">
connection has been established).<br class="">
src 172.16.0.4 dst 172.16.0.5<br class="">
proto esp spi 0x00000000 reqid 0 mode transport<br class="">
replay-window 0 <br class="">
mark 0x25000000/0xff000000<br class="">
anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000<br class="">
sel src 172.16.0.4/32 dst 172.16.0.5/32 proto icmp type 8 code 0 dev conn37<br class="">
</blockquote>
<br class="">
This is an ACQUIRE in larval state. It happens during on-demand tunnels.<br class="">
It means the kernel send the ACQUIRE to the IKE daemon, and now the IKE<br class="">
daemon is expected to replace this with a tunnel IPsec SA. I think this<br class="">
is just a side effect of the many re-establishing you are seeing.<br class="">
<br class="">
<blockquote type="cite" class="">Sep 7 08:10:10 cq-use1f-1 pluto[8504]: initiate on demand from 172.16.0.4:8 to 172.16.0.5:0<br class="">
proto=1 because: acquire<br class="">
</blockquote>
<br class="">
Yeah that is the ACQUIRE.<br class="">
<br class="">
<blockquote type="cite" class="">Here’s the associated conn37.conf, if that’s helpful.<br class="">
conn conn37<br class="">
left=70.240.163.43<br class="">
leftid=“@left-70.240.163.43"<br class="">
leftsubnet=0.0.0.0/0<br class="">
left=70.240.163.43<br class="">
right=51.179.82.210<br class="">
rightid="%fromcert"<br class="">
rightsubnet=0.0.0.0/0<br class="">
rightcert=server<br class="">
right=51.179.82.210<br class="">
rightupdown=/usr/libexec/ipsec/inspeed_updown<br class="">
rightcert=server<br class="">
authby=rsasig<br class="">
vti-routing=no<br class="">
encapsulation=yes<br class="">
keyingtries=0<br class="">
mark=0x25000000/0xff000000<br class="">
vti-interface=conn37<br class="">
phase2alg=aes256-sha2_256<br class="">
auto=ignore<br class="">
</blockquote>
<br class="">
If you want this to go up at boot, you should put in auto=start<br class="">
<br class="">
<blockquote type="cite" class="">type=tunnel<br class="">
compress=no<br class="">
pfs=yes<br class="">
ikepad=yes<br class="">
authby=rsasig<br class="">
phase2=esp<br class="">
ikev2=permit<br class="">
ppk=no<br class="">
esn=no<br class="">
</blockquote>
<br class="">
<br class="">
I guess the reason for why it keeps restarting the tunnel should be in<br class="">
the logs on one of the endpoints?<br class="">
<br class="">
Paul<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</body>
</html>