<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7036.0">
<TITLE>Duplicate ESP SAs being created</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">Hi,</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">I have a situation where I am seeing duplicate ESP SAs getting created between to Openswan devices. Both devices are using Openswan 2.4.6 with NETKEY on a 2.6.19 kernel. In my configuration there is only one connection statement between peers 172.3.3.5 and 172.4.4.10.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">The issue occurs if the tunnel connection is set auto=start on both sides. Once the ipsec process is started on both sides the peers come up and negotiate an ISAKMP SA, then they negotiate an ESP SA, then a few seconds later they negotiate another ESP SA. Based on the byte counters for the SA it appears that the second set of negotiated SAs are used. Is this expected behavior?</FONT></P>
<P><FONT SIZE=2 FACE="Arial">If I set one end of the tunnel connection to "auto=add" and leave the other to "auto=start" then I only get one pair of SA as expected.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">< LOG MESSAGES ></FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: packet from 172.4.4.10:500: ignoring unknown Vendor ID payload [4f454e7c454d716b5f4d6c67]</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: packet from 172.4.4.10:500: received Vendor ID payload [Dead Peer Detection]</FONT>
<BR><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #2: responding to Main Mode</FONT>
<BR><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #2: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #2: STATE_MAIN_R1: sent MR1, expecting MI2</FONT>
<BR><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #2: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #2: STATE_MAIN_R2: sent MR2, expecting MI3</FONT>
<BR><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #2: Main mode peer ID is ID_IPV4_ADDR: '172.4.4.10'</FONT>
<BR><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #2: I did not send a certificate because I do not have one.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #2: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #2: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1536}</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #3: responding to Quick Mode {msgid:63ba348f}</FONT>
<BR><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #3: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #3: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #3: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:30 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #3: STATE_QUICK_R2: IPsec SA established {ESP=>0x53463f47 <0x5cc8fba5 xfrm=AES_256-HMAC_SHA1 NATD=none DPD=none}</FONT></P>
<P><FONT SIZE=2 FACE="Arial">*** First SA negotiation complete ***</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #1: ignoring unknown Vendor ID payload [4f454e7c454d716b5f4d6c67]</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #1: received Vendor ID payload [Dead Peer Detection]</FONT>
<BR><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #1: STATE_MAIN_I2: sent MI2, expecting MR2</FONT>
<BR><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #1: I did not send a certificate because I do not have one.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #1: STATE_MAIN_I3: sent MI3, expecting MR3</FONT>
<BR><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #1: Main mode peer ID is ID_IPV4_ADDR: '172.4.4.10'</FONT>
<BR><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1536}</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #4: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP {using isakmp#1}</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #4: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Feb 1 17:30:41 uml-5 pluto[6632]: "peer-172.4.4.10-tunnel-1" #4: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x98c80ea0 <0xa23ead62 xfrm=AES_256-HMAC_SHA1 NATD=none DPD=none}</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Now if I look at the output from "setkey -D" I see a total of 4 SA (2 inbound, 2 outbound), but there should only be 2 SAs.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">[root@uml-10 tunnels]# setkey -D</FONT>
<BR><FONT SIZE=2 FACE="Arial">172.4.4.10 172.3.3.5</FONT>
<BR><FONT SIZE=2 FACE="Arial"> esp mode=tunnel spi=2722016610(0xa23ead62) reqid=16385(0x00004001)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> E: aes-cbc ebc71563 40e71778 c5d925f8 04b09ea5 f10057f2 a3ea809e c365d1fa f09a4d66</FONT>
<BR><FONT SIZE=2 FACE="Arial"> A: hmac-sha1 c9640009 ce2d6ede d2c24c6e 56152f43 08f65ffc</FONT>
<BR><FONT SIZE=2 FACE="Arial"> seq=0x00000000 replay=32 flags=0x00000000 state=mature</FONT>
<BR><FONT SIZE=2 FACE="Arial"> created: Feb 1 17:30:41 2007 current: Feb 1 17:36:50 2007</FONT>
<BR><FONT SIZE=2 FACE="Arial"> diff: 369(s) hard: 0(s) soft: 0(s)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> last: Feb 1 17:32:10 2007 hard: 0(s) soft: 0(s)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> current: 912(bytes) hard: 0(bytes) soft: 0(bytes)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> allocated: 6 hard: 0 soft: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial"> sadb_seq=3 pid=10719 refcnt=0</FONT>
<BR><FONT SIZE=2 FACE="Arial">172.3.3.5 172.4.4.10</FONT>
<BR><FONT SIZE=2 FACE="Arial"> esp mode=tunnel spi=2563247776(0x98c80ea0) reqid=16385(0x00004001)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> E: aes-cbc eced091e a4656ff4 cc605fc2 7d3f2abd 7f99c3cd 797b5f55 cd7b72e7 6187ef70</FONT>
<BR><FONT SIZE=2 FACE="Arial"> A: hmac-sha1 8322b286 1dc0fc52 51602679 aadf2fe8 9231cd36</FONT>
<BR><FONT SIZE=2 FACE="Arial"> seq=0x00000000 replay=32 flags=0x00000000 state=mature</FONT>
<BR><FONT SIZE=2 FACE="Arial"> created: Feb 1 17:30:41 2007 current: Feb 1 17:36:50 2007</FONT>
<BR><FONT SIZE=2 FACE="Arial"> diff: 369(s) hard: 0(s) soft: 0(s)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> last: Feb 1 17:32:10 2007 hard: 0(s) soft: 0(s)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> current: 504(bytes) hard: 0(bytes) soft: 0(bytes)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> allocated: 6 hard: 0 soft: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial"> sadb_seq=2 pid=10719 refcnt=0</FONT>
<BR><FONT SIZE=2 FACE="Arial">172.4.4.10 172.3.3.5</FONT>
<BR><FONT SIZE=2 FACE="Arial"> esp mode=tunnel spi=1556675493(0x5cc8fba5) reqid=16385(0x00004001)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> E: aes-cbc c6a4d1c9 869f7389 09314d91 00bb8161 d065616e 55bf92ea 5063eabd 9d5babde</FONT>
<BR><FONT SIZE=2 FACE="Arial"> A: hmac-sha1 459a972c dd36d5f8 21c7c229 67a20c71 3b64d037</FONT>
<BR><FONT SIZE=2 FACE="Arial"> seq=0x00000000 replay=32 flags=0x00000000 state=mature</FONT>
<BR><FONT SIZE=2 FACE="Arial"> created: Feb 1 17:30:30 2007 current: Feb 1 17:36:50 2007</FONT>
<BR><FONT SIZE=2 FACE="Arial"> diff: 380(s) hard: 0(s) soft: 0(s)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> last: hard: 0(s) soft: 0(s)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> current: 0(bytes) hard: 0(bytes) soft: 0(bytes)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> allocated: 0 hard: 0 soft: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial"> sadb_seq=1 pid=10719 refcnt=0</FONT>
<BR><FONT SIZE=2 FACE="Arial">172.3.3.5 172.4.4.10</FONT>
<BR><FONT SIZE=2 FACE="Arial"> esp mode=tunnel spi=1397112647(0x53463f47) reqid=16385(0x00004001)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> E: aes-cbc c52ece00 785e8770 2c2b05b4 9baa9417 89c5b067 f4967596 7f425674 590c2c50</FONT>
<BR><FONT SIZE=2 FACE="Arial"> A: hmac-sha1 f71fe5a6 f1c3791d a1f2b4d6 8d906d03 b104c83b</FONT>
<BR><FONT SIZE=2 FACE="Arial"> seq=0x00000000 replay=32 flags=0x00000000 state=mature</FONT>
<BR><FONT SIZE=2 FACE="Arial"> created: Feb 1 17:30:30 2007 current: Feb 1 17:36:50 2007</FONT>
<BR><FONT SIZE=2 FACE="Arial"> diff: 380(s) hard: 0(s) soft: 0(s)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> last: hard: 0(s) soft: 0(s)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> current: 0(bytes) hard: 0(bytes) soft: 0(bytes)</FONT>
<BR><FONT SIZE=2 FACE="Arial"> allocated: 0 hard: 0 soft: 0</FONT>
<BR><FONT SIZE=2 FACE="Arial"> sadb_seq=0 pid=10719 refcnt=0</FONT>
<BR><FONT SIZE=2 FACE="Arial">[root@uml-10 tunnels]#</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">< connection definition on peer 172.3.3.5 ></FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">conn peer-172.4.4.10-tunnel-1</FONT>
<BR><FONT SIZE=2 FACE="Arial"> left=172.3.3.5</FONT>
<BR><FONT SIZE=2 FACE="Arial"> leftsubnet=192.168.40.0/24</FONT>
<BR><FONT SIZE=2 FACE="Arial"> right=172.4.4.10</FONT>
<BR><FONT SIZE=2 FACE="Arial"> rightsubnet=192.168.100.0/24</FONT>
<BR><FONT SIZE=2 FACE="Arial"> authby=secret</FONT>
<BR><FONT SIZE=2 FACE="Arial"> ike="3des-sha1"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> ikelifetime=3600s</FONT>
<BR><FONT SIZE=2 FACE="Arial"> esp="aes256-sha1"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> type=tunnel</FONT>
<BR><FONT SIZE=2 FACE="Arial"> keylife=1800s</FONT>
<BR><FONT SIZE=2 FACE="Arial"> rekeyfuzz=0%</FONT>
<BR><FONT SIZE=2 FACE="Arial"> rekeymargin=10s</FONT>
<BR><FONT SIZE=2 FACE="Arial"> auto=start</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">< connection definition on peer 172.4.4.10 ></FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">conn peer-172.3.3.5-tunnel-1</FONT>
<BR><FONT SIZE=2 FACE="Arial"> left=172.4.4.10</FONT>
<BR><FONT SIZE=2 FACE="Arial"> leftsubnet=192.168.100.0/24</FONT>
<BR><FONT SIZE=2 FACE="Arial"> right=172.3.3.5</FONT>
<BR><FONT SIZE=2 FACE="Arial"> rightsubnet=192.168.40.0/24</FONT>
<BR><FONT SIZE=2 FACE="Arial"> authby=secret</FONT>
<BR><FONT SIZE=2 FACE="Arial"> ike="3des-sha1"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> ikelifetime=3600s</FONT>
<BR><FONT SIZE=2 FACE="Arial"> esp="aes256-sha1"</FONT>
<BR><FONT SIZE=2 FACE="Arial"> type=tunnel</FONT>
<BR><FONT SIZE=2 FACE="Arial"> keylife=1800s</FONT>
<BR><FONT SIZE=2 FACE="Arial"> auto=start</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">Let me know if there is additional information that I should provide.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">-mike</FONT>
</P>
</BODY>
</HTML>