<div dir="ltr"><div>Hi Paul,</div><div><br></div><div>We have enabled Pre-shared key based IPSec connection between our application which running on linux environment and Router. But when our system goes for a reboot, we have to configure the policy again to work. Please let us know the reason for the same. Pasting the snippet of the secure log.</div><div><br></div><div>
<pre>Feb 2 15:53:42.572564: | Added new connection 71528943210_psk with policy PSK+ENCRYPT+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO
Feb 2 15:53:42.572576: | from whack: got --esp=aes256-sha2_256
Feb 2 15:53:42.572591: | ESP/AH string values: AES_CBC_256-HMAC_SHA2_256_128
Feb 2 15:53:42.572596: | ike (phase1) algorithm values: AES_CBC_256-HMAC_SHA2_256-MODP4096
Feb 2 15:53:42.572604: | counting wild cards for 134.61.36.39 is 0
Feb 2 15:53:42.572608: | counting wild cards for 134.61.36.55 is 0
Feb 2 15:53:42.572620: added connection description "71528943210_psk"
Feb 2 15:53:42.572633: | 134.61.36.39<134.61.36.39>...134.61.36.55<134.61.36.55>
Feb 2 15:53:42.572639: | ike_life: 86400s; ipsec_life: 3600s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: PSK+ENCRYPT+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO
Feb 2 15:53:42.572737: | pluto_sd: executing action action: reloading(4), status 0
Feb 2 15:53:42.572769: listening for IKE messages<br>
Feb 2 15:53:42.572983: | Inspecting interface lo
Feb 2 15:53:42.572990: | found lo with address 127.0.0.1
Feb 2 15:53:42.573029: adding interface lo/lo <a href="http://127.0.0.1:500">127.0.0.1:500</a>
Feb 2 15:53:42.573101: | NAT-Traversal: Trying sockopt style NAT-T
Feb 2 15:53:42.573189: | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4
Feb 2 15:53:42.573194: adding interface lo/lo <a href="http://127.0.0.1:4500">127.0.0.1:4500</a>
Feb 2 15:53:42.573289: | found lo with address 0000:0000:0000:0000:0000:0000:0000:0001
Feb 2 15:53:42.573334: adding interface lo/lo ::1:500
Feb 2 15:53:42.573346: | setup callback for interface lo:500 fd 18
Feb 2 15:53:42.573352: | setup callback for interface lo:4500 fd 17
Feb 2 15:53:42.573358: | setup callback for interface lo:500 fd 16
Feb 2 15:53:42.573366: | certs and keys locked by 'free_preshared_secrets'
Feb 2 15:53:42.573370: | certs and keys unlocked by 'free_preshard_secrets'
Feb 2 15:53:42.577127: loading secrets from "/etc/ipsec.secrets"
Feb 2 15:53:42.582476: loading secrets from "/etc/ipsec.d/secrets/71528943210.secrets"
Feb 2 15:53:42.582496: | id type added to secret(0x55e5daf9fbc8) PKK_PSK: 134.61.36.39
Feb 2 15:53:42.582501: | id type added to secret(0x55e5daf9fbc8) PKK_PSK: 134.61.36.55
Feb 2 15:53:42.582508: | Processing PSK at line 1: passed
Feb 2 15:53:42.582512: | certs and keys locked by 'process_secret'
Feb 2 15:53:42.582515: | certs and keys unlocked by 'process_secret'
Feb 2 15:53:42.582531: | pluto_sd: executing action action: ready(5), status 0
Feb 2 15:53:42.583167: | processing: start connection "71528943210_psk" (in initiate_a_connection() at initiate.c:187)
Feb 2 15:53:42.583178: "71528943210_psk": We cannot identify ourselves with either end of this connection. 134.61.36.39 or 134.61.36.55 are not usable
Feb 2 15:53:42.583186: | processing: stop connection "71528943210_psk" (in initiate_a_connection() at initiate.c:219)
Feb 2 15:53:42.583500: | waitpid returned pid 6271 (exited with status 0)
Feb 2 15:53:42.583511: | serialno table: hash serialno #0 to head 0x55e5da343fe0
Feb 2 15:53:42.583515: | serialno table: hash serialno #0 to head 0x55e5da343fe0
Feb 2 15:53:42.583518: | reaped addconn helper child (status 0)
Feb 2 15:53:42.583524: | pid table: removing object 0x55e5daf9b788 (addconn pid 6271) entry 0x55e5daf9b790 (older 0x55e5da348580 newer 0x55e5da348580)
Feb 2 15:53:42.583528: | pid table: empty
Feb 2 15:53:42.583533: | waitpid returned ECHILD (no child processes left)
...<br>
Feb 2 15:53:50.279813: | IKEv2 received address RTM_NEWADDR type 6
Feb 2 15:53:50.279818: | netlink_get: XFRM_MSG_DELPOLICY message
Feb 2 15:53:50.279821: | xfrm netlink address change RTM_NEWADDR msg len 72
Feb 2 15:53:50.279826: | netlink_get: XFRM_MSG_DELPOLICY message
Feb 2 15:53:50.279830: | xfrm netlink address change RTM_NEWADDR msg len 72
Feb 2 15:54:02.550442: | timer_event_cb: processing event@0x55e5daf8a738
Feb 2 15:54:02.550465: | handling event EVENT_SHUNT_SCAN
Feb 2 15:54:02.550471: | expiring aged bare shunts from shunt table
Feb 2 15:54:02.550477: | event_schedule: new EVENT_SHUNT_SCAN-pe@0x55e5daf9f988
Feb 2 15:54:02.550484: | inserting event EVENT_SHUNT_SCAN, timeout in 20.000 seconds
Feb 2 15:54:02.550498: | free_event_entry: release EVENT_SHUNT_SCAN-pe@0x55e5daf8a738
<br></pre><pre>Thanks,<br></pre><pre>Gayathri<br></pre></div><div><br></div></div>