<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Apple Color Emoji";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:12.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:3.0cm 2.0cm 3.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="DA" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Hi list<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">I have an issue with Linux Libreswan 4.1-1 (netkey) on 5.8.0-38-generic (ubuntu 20.04) with a tunnel with remote end Fortigate 1500:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">The tunnel (certificate based Ikev2 with xfrm/ipsec interface) is established fine and traffic flows as expected.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">After salifetime is reached – the connection goes down and will not get reestablished (no ipsec sa renegotiation or ike sa renegotiation). I suspect this state might give som input on the problem: <o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt">"fgcon1" #5: encountered fatal error in state STATE_V2_REKEY_CHILD_I1</span></b><span lang="EN-US" style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt"> </span></b><span lang="EN-US" style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">I’ve tried setting ikelifetime and salifetime to be the same on the peer – but with no success. <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">If you need more details or log – don’t hesitate but I did not want to “SPAM” the list. <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Log in the timeline: <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | newref struct msg_digest@0x5586b5d16738(0->1) (in read_message() at demux.c:106)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | newref alloc logger@0x5586b5d37168(0->1) (in read_message() at demux.c:106)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | *received 80 bytes from 217.198.216.194:4500 on ens4 12.12.12.2:4500 using UDP<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | b9 0b c0 c3 bc f2 db 02 8c ae 39 e8 5d 8e 2a 68<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | 2e 20 24 20 00 00 00 00 00 00 00 50 29 00 00 34<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | 54 de 6a 91 44 6e 35 4d cf 99 6f 73 2d d4 6c 7a<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | 14 fe b2 3c 53 df ef ff 94 2d b6 29 8a a4 ba eb<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | 18 a6 28 47 91 bf 3c 0f d2 34 61 bd 99 b6 b6 44<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | **parse ISAKMP Message:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | initiator SPI: b9 0b c0 c3 bc f2 db 02<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | responder SPI: 8c ae 39 e8 5d 8e 2a 68<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | next payload type: ISAKMP_NEXT_v2SK (0x2e)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | exchange type: ISAKMP_v2_CREATE_CHILD_SA (0x24)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | Message ID: 0 (00 00 00 00)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | length: 80 (00 00 00 50)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | processing version=2.0 packet with exchange type=ISAKMP_v2_CREATE_CHILD_SA (36)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | I am the IKE SA Original Initiator receiving an IKEv2 CREATE_CHILD_SA response <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | State DB: found IKEv2 state #4 in ESTABLISHED_IKE_SA (find_v2_ike_sa)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | State DB: found IKEv2 state #5 in V2_REKEY_CHILD_I1 (find_v2_sa_by_initiator_wip)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | #5 is idle<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | #5 idle<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | unpacking clear payload<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | Now let's proceed with payload (ISAKMP_NEXT_v2SK)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | ***parse IKEv2 Encryption Payload:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | next payload type: ISAKMP_NEXT_v2N (0x29)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | flags: none (0x0)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | length: 52 (00 34)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | processing payload: ISAKMP_NEXT_v2SK (len=48)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | #5 in state V2_REKEY_CHILD_I1: sent CREATE_CHILD_SA request to rekey IPsec SA<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | result: newref clone-key@0x5586b5d3f150 (32-bytes, SHA256_HMAC)(in init_symkey() at ike<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">_alg_prf_mac_nss_ops.c:99)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | auth: delref clone-key@0x5586b5d3f150<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | authenticator matched<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | stripping 8 octets as pad<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | #4 ikev2 ISAKMP_v2_CREATE_CHILD_SA decrypt success<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | Now let's proceed with payload (ISAKMP_NEXT_v2N)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | **parse IKEv2 Notify Payload:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | next payload type: ISAKMP_NEXT_v2NONE (0x0)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | flags: none (0x0)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | length: 8 (00 08)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | SPI size: 0 (00)</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | Notify Message Type: v2N_NO_PROPOSAL_CHOSEN (0xe)</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | processing payload: ISAKMP_NEXT_v2N (len=0)</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | error notification v2N_NO_PROPOSAL_CHOSEN is not supported</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | selected state microcode roof</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: "fgcon1" #5: dropping unexpected CREATE_CHILD_SA message containing NO_PROPOSAL_CHOSEN notifi</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">cation; message payloads: SK; encrypted payloads: N; missing payloads: SA,Ni,TSi,TSr</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: | #5 complete_v2_state_transition() in state V2_REKEY_CHILD_I1 UNDEFINED->UNDEFINED with stat</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">us STF_FATAL; md.svm=NULL</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt">Feb 1 10:00:08 ubuntu2004 pluto[43388]: "fgcon1" #5: encountered fatal error in state STATE_V2_REKEY_CHILD_I1</span></b><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Ipsec config:</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">conn fgcon1</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> keyexchange=ike</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> ike="aes256-sha256-modp2048"</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> esp="aes256-sha256-modp2048"</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> leftcert=XXXX #Anonymised </span><span lang="EN-US" style="font-size:11.0pt;font-family:"Apple Color Emoji"">😊</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> leftsendcert=always</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> leftrsasigkey=%cert </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> leftid=%fromcert</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> left=%defaultroute</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> leftmodecfgclient=yes</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> leftnexthop=%defaultroute</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> type=tunnel</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> pfs=no</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> aggressive=yes</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> ikev2=yes</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> right=X.X.X.X # Anonymised </span><span lang="EN-US" style="font-size:11.0pt;font-family:"Apple Color Emoji"">😊</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> rightsubnet=192.168.110.30/32</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> leftsubnet=0.0.0.0/0</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> mark=5/0xffffffff # needs to be unique</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> ipsec-interface=1</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> rightid=%fromcert</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> rightrsasigkey=%cert</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> auto=start</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> salifetime = 30</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> ikelifetime = 30</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> encapsulation=yes</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> dpddelay=3</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> dpdtimeout=3</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> dpdaction=restart</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> metric=10</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> leftupdown=/usr/libexec/ipsec/_r2pupdown.rohit</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Updown Script: </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">#!/bin/bash</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">set -eox pipefail</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">LC_ALL=C</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">export LC_ALL</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">IP=$(which ip)</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">IP_RULE_PRIORITY=100</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">case "${PLUTO_CONN_ADDRFAMILY}" in</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">ipv4)</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> FAMILY=4</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> MAX_CIDR=32</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> SCOPE=50</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> ;;</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">ipv6)</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> FAMILY=6</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> MAX_CIDR=128</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> SCOPE=global</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> ;;</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">*)</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> echo "unknown address family \"${PLUTO_CONN_ADDRFAMILY}\"" >&2</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> exit 1</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> ;;</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">esac</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">printenv</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">case "${PLUTO_VERB}" in</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">up-client)</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> $IP -${FAMILY} addr add "${PLUTO_MY_CLIENT_NET}"/${MAX_CIDR} dev "${PLUTO_VIRT_INTERFACE}" scope ${SCOPE}</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> $IP -${FAMILY} route replace "${PLUTO_PEER}"/${MAX_CIDR} via "${PLUTO_NEXT_HOP}" dev "${PLUTO_INTERFACE}" table ${SCOPE}</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> $IP -${FAMILY} rule add prio ${IP_RULE_PRIORITY} to "${PLUTO_PEER_CLIENT}" fwmark "${PLUTO_XFRMI_FWMARK}" lookup ${SCOPE}</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> $IP -${FAMILY} route replace "${PLUTO_PEER_CLIENT}" metric "${PLUTO_METRIC}" dev "${PLUTO_VIRT_INTERFACE}" src "${PLUTO_MY_CLIENT_NET}"</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> ;;</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">down-client)</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> $IP -${FAMILY} rule del fwmark "${PLUTO_XFRMI_FWMARK%/*}" || true</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> $IP -${FAMILY} addr flush dev "${PLUTO_VIRT_INTERFACE}" || true</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span><span style="font-size:11.0pt">$IP -${FAMILY} link del "${PLUTO_VIRT_INTERFACE}" || true<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> ;;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">esac<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<table class="MsoNormalTable" border="0" cellpadding="0">
<tbody>
<tr style="height:11.5pt">
<td width="125" rowspan="2" style="width:93.75pt;padding:.75pt .75pt .75pt .75pt;height:11.5pt">
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Verdana",sans-serif">Med venlig hilsen / Best regards</span><span style="font-size:11.0pt"><br>
<br>
</span><b><span style="font-size:8.5pt;font-family:"Verdana",sans-serif">Bo Osmann Erichsen</span></b><span style="font-size:11.0pt"><br>
</span><i><span style="font-size:8.5pt;font-family:"Verdana",sans-serif">Seniorarkitekt</span></i><span style="font-size:11.0pt"><br>
<o:p></o:p></span></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="300" style="width:225.0pt">
<tbody>
<tr>
<td width="50" style="width:37.5pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Verdana",sans-serif">Mobil<br>
Tlf.:<br>
E-mail:</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</td>
<td style="padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Verdana",sans-serif"><a href="tel:+45%202627%201342"><span style="color:black;text-decoration:none">+45 2627 1342</span></a><br>
<a href="tel:+45%207216%201999"><span style="color:black;text-decoration:none">+45 7216 1999</span></a><br>
<a href="mailto:boe@mentor-it.dk"><span style="color:black;text-decoration:none">boe@mentor-it.dk</span></a></span><span style="font-size:11.0pt"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="font-size:11.0pt"><img border="0" width="200" height="80" style="width:2.0833in;height:.8333in" id="_x0000_i1027" src="https://i-eu.xink.io/Images/Get/I6169/i81.jpg"><br>
</span><span style="font-size:7.0pt;font-family:"Verdana",sans-serif;color:black">Esbjerg | Kolding | Aarhus | København</span><span style="font-size:7.0pt;font-family:"Verdana",sans-serif"><br>
<br>
<a href="https://www.mentor-it.dk"><span style="color:black;text-decoration:none">www.mentor-it.dk</span></a> -
<a href="https://shop.mentor-it.dk"><span style="color:black;text-decoration:none">Webshop</span></a> -
<a href="https://get.teamviewer.com/mentor-it"><span style="color:black;text-decoration:none">Fjernsupport</span></a></span><span style="font-size:11.0pt"><br>
<br>
</span><a href="https://www.facebook.com/mentorit.dk"><span style="font-size:7.0pt;font-family:"Verdana",sans-serif;color:blue;text-decoration:none"><img border="0" width="22" height="22" style="width:.2291in;height:.2291in" id="_x0000_i1026" src="https://i-eu.xink.io/Images/Get/I6169/f.png"></span></a><span style="font-size:7.0pt;font-family:"Verdana",sans-serif"> </span><a href="https://www.linkedin.com/company/mentor-it"><span style="font-size:7.0pt;font-family:"Verdana",sans-serif;color:blue;text-decoration:none"><img border="0" width="22" height="22" style="width:.2291in;height:.2291in" id="_x0000_i1025" src="https://i-eu.xink.io/Images/Get/I6169/i4.png"></span></a><span style="font-size:11.0pt"><br>
<br>
<br>
<o:p></o:p></span></p>
</td>
<td style="height:11.5pt;border:none" width="0" height="15"></td>
</tr>
<tr style="height:11.5pt">
<td style="height:11.5pt;border:none" width="0" height="15"></td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>