<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
Hi to the ML,<br>
<br>
I want to setup multiple subnet between an openswan and a freeswan gw<br>
First, both VPN are UP, but after a certain time the second VPN is down.<br>
<br>
<br>
Here is my configuration:<br>
<br>
conn tunna:
subnetA(192.168.a.0)--------[freeswan]----0.0.0.0----[openswan]------subnetC(192.168.c.0)<br>
conn tunnb:
subnetB(192.168.b.0)--------[freeswan]----0.0.0.0----[openswan]------subnetC(192.168.b.0)<br>
<br>
So I use:<br>
conn tunn: [freeswan]----0.0.0.0----[openswan]<br>
whith the 'also' ipsec command.<br>
<br>
<br>
<br>
ipsec.conf<br>
----------<br>
<br>
[openswan]<br>
config setup<br>
nhelpers=0<br>
<br>
conn tunna<br>
leftsubnet=192.168.c.0/24<br>
rightsubnet=192.168.a.0/24<br>
also=tunn<br>
<br>
conn tunnb<br>
leftsubnet=192.168.c.0/24<br>
rightsubnet=192.168.b.0/24<br>
also=tunn<br>
<br>
conn tunn<br>
left=$IpLeft<br>
leftnexthop=$IPleftNextHop<br>
right=$IpRight<br>
rightnexthop=$IpRightNextHop<br>
auto=start<br>
authby=rsasig<br>
<a class="moz-txt-link-abbreviated" href="mailto:leftid=@c.tunn.com">leftid=@c.tunn.com</a><br>
<a class="moz-txt-link-abbreviated" href="mailto:rightid=@ab.tunn.com">rightid=@ab.tunn.com</a><br>
ike=aes256-md5-modp1536<br>
esp=aes256-md5<br>
keyexchange=ike<br>
ikelifetime=1h<br>
keylife=1h<br>
keyingtries=3<br>
auth=esp<br>
leftrsasigkey=0s1.....==<br>
rightrsasigkey=0s2....==<br>
<br>
include /etc/ipsec.d/examples/no_oe.conf<br>
<br>
[freeswan]<br>
conn tunna<br>
leftsubnet=192.168.a.0/24<br>
rightsubnet=192.168.c.0/24<br>
also=tunn<br>
<br>
conn tunnb<br>
leftsubnet=192.168.b.0/24<br>
rightsubnet=192.168.c.0/24<br>
also=tunn<br>
<br>
conn tunn<br>
left=$IpLeft<br>
leftnexthop=$IPleftNextHop<br>
right=$IpRight<br>
rightnexthop=$IpRightNextHop<br>
auto=start<br>
authby=rsasig<br>
ike=aes256-md5-modp1536<br>
esp=aes256-md5<br>
keyexchange=ike<br>
keyingtries=3<br>
ikelifetime=1h<br>
keylife=1h<br>
auth=esp<br>
<a class="moz-txt-link-abbreviated" href="mailto:leftid=@ab.tunn.com">leftid=@ab.tunn.com</a><br>
<a class="moz-txt-link-abbreviated" href="mailto:rightid=@c.tunn..com">rightid=@c.tunn..com</a><br>
leftrsasigkey=0s2<br>
rightrsasigkey=0s1<br>
<br>
<br>
first, all tunnel are up, but after a certain laps of time:<br>
-both tunnel are up on freeswan side<br>
-only one tunne is up on openswan side<br>
<br>
Mar 24 07:01:31 fw2 pluto[20611]: "tunnb" #11: STATE_QUICK_R2: IPsec SA
established {ESP=>0xda27d683 <0xcccaaf13 xfrm=AES_256-HMAC_MD5
IPCOMP=>0x0000cb30 <0x0000d068 NATD=none DPD=none}<br>
Mar 24 07:07:45 fw2 pluto[20611]: "tunnb" #13: initiating Main Mode to
replace #9<br>
Mar 24 07:07:45 fw2 pluto[20611]: "tunnb" #13: received Vendor ID
payload [draft-ietf-ipsec-nat-t-ike-03] method set to=108<br>
Mar 24 07:07:45 fw2 pluto[20611]: "tunnb" #13: enabling possible
NAT-traversal with method RFC 3947 (NAT-Traversal)<br>
Mar 24 07:07:45 fw2 pluto[20611]: "tunnb" #13: transition from state
STATE_MAIN_I1 to state STATE_MAIN_I2<br>
Mar 24 07:07:45 fw2 pluto[20611]: "tunnb" #13: STATE_MAIN_I2: sent MI2,
expecting MR2<br>
Mar 24 07:07:45 fw2 pluto[20611]: "tunnb" #13: I did not send a
certificate because I do not have one.<br>
Mar 24 07:07:45 fw2 pluto[20611]: "tunnb" #13: NAT-Traversal: Result
using draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected<br>
Mar 24 07:07:45 fw2 pluto[20611]: "tunnb" #13: transition from state
STATE_MAIN_I2 to state STATE_MAIN_I3<br>
Mar 24 07:07:45 fw2 pluto[20611]: "tunnb" #13: STATE_MAIN_I3: sent MI3,
expecting MR3<br>
Mar 24 07:07:45 fw2 pluto[20611]: "tunnb" #13: Main mode peer ID is
ID_FQDN: '@ab.tunn.com'<br>
Mar 24 07:07:45 fw2 pluto[20611]: "tunnb" #13: transition from state
STATE_MAIN_I3 to state STATE_MAIN_I4<br>
Mar 24 07:07:45 fw2 pluto[20611]: "tunnb" #13: STATE_MAIN_I4: ISAKMP SA
established {auth=OAKLEY_RSA_SIG cipher=aes_256 prf=oakley_md5
group=modp1536}<br>
<b>Mar 24 07:18:04 fw2 pluto[20611]: "tunnb" #13: ignoring Delete SA
payload: PROTO_IPSEC_ESP SA(0xda27d67d) not found (maybe expired)<br>
Mar 24 07:18:04 fw2 pluto[20611]: "tunnb" #13: received and ignored
informational message<br>
Mar 24 07:18:29 fw2 pluto[20611]: "tunnb" #13: ignoring Delete SA
payload: PROTO_IPSEC_ESP SA(0xda27d67e) not found (maybe expired)<br>
Mar 24 07:18:29 fw2 pluto[20611]: "tunnb" #13: received and ignored
informational message<br>
Mar 24 07:19:27 fw2 pluto[20611]: "tunnb" #13: ignoring Delete SA
payload: PROTO_IPSEC_ESP SA(0xda27d67f) not found (maybe expired)<br>
Mar 24 07:19:27 fw2 pluto[20611]: "tunnb" #13: received and ignored
informational message</b><br>
Mar 24 07:52:02 fw2 pluto[20611]: "tunnb" #15: responding to Quick Mode
{msgid:2df8ae0c}<br>
Mar 24 07:52:02 fw2 pluto[20611]: "tunnb" #15: transition from state
STATE_QUICK_R0 to state STATE_QUICK_R1<br>
Mar 24 07:52:02 fw2 pluto[20611]: "tunnb" #15: STATE_QUICK_R1: sent
QR1, inbound IPsec SA installed, expecting QI2<br>
Mar 24 07:52:02 fw2 pluto[20611]: "tunnb" #15: transition from state
STATE_QUICK_R1 to state STATE_QUICK_R2<br>
Mar 24 07:52:02 fw2 pluto[20611]: "tunnb" #15: STATE_QUICK_R2: <b>IPsec
SA established </b>{ESP=>0xda27d68c <0xf2297cdd
xfrm=AES_256-HMAC_MD5 IPCOMP=>0x0000cb31 <0x0000354f NATD=none
DPD=none}<br>
Mar 24 07:52:49 fw2 pluto[20611]: "tunnb" #17: initiating Main Mode to
replace #13<br>
Mar 24 07:52:49 fw2 pluto[20611]: "tunnb" #17: received Vendor ID
payload [draft-ietf-ipsec-nat-t-ike-03] method set to=108<br>
Mar 24 07:52:49 fw2 pluto[20611]: "tunnb" #17: enabling possible
NAT-traversal with method RFC 3947 (NAT-Traversal)<br>
Mar 24 07:52:49 fw2 pluto[20611]: "tunnb" #17: transition from state
STATE_MAIN_I1 to state STATE_MAIN_I2<br>
Mar 24 07:52:49 fw2 pluto[20611]: "tunnb" #17: STATE_MAIN_I2: sent MI2,
expecting MR2<br>
Mar 24 07:52:49 fw2 pluto[20611]: "tunnb" #17: I did not send a
certificate because I do not have one.<br>
Mar 24 07:52:49 fw2 pluto[20611]: "tunnb" #17: NAT-Traversal: Result
using draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected<br>
Mar 24 07:52:49 fw2 pluto[20611]: "tunnb" #17: transition from state
STATE_MAIN_I2 to state STATE_MAIN_I3<br>
Mar 24 07:52:49 fw2 pluto[20611]: "tunnb" #17: STATE_MAIN_I3: sent MI3,
expecting MR3<br>
Mar 24 07:52:49 fw2 pluto[20611]: "tunnb" #17: Main mode peer ID is
ID_FQDN: '@ab.tunn.com'<br>
Mar 24 07:52:49 fw2 pluto[20611]: "tunnb" #17: transition from state
STATE_MAIN_I3 to state STATE_MAIN_I4<br>
Mar 24 07:52:49 fw2 pluto[20611]: "tunnb" #17: STATE_MAIN_I4: <b>ISAKMP
SA established </b>{auth=OAKLEY_RSA_SIG cipher=aes_256 prf=oakley_md5
group=modp1536}<br>
<b>Mar 24 08:01:19 fw2 pluto[20611]: "tunnb" #17: ignoring Delete SA
payload: PROTO_IPSEC_ESP SA(0xda27d682) not found (maybe expired)<br>
Mar 24 08:01:19 fw2 pluto[20611]: "tunnb" #17: received and ignored
informational message<br>
Mar 24 08:01:32 fw2 pluto[20611]: "tunnb" #17: ignoring Delete SA
payload: PROTO_IPSEC_ESP SA(0xda27d683) not found (maybe expired)<br>
Mar 24 08:01:32 fw2 pluto[20611]: "tunnb" #17: received and ignored
informational message<br>
Mar 24 08:06:38 fw2 pluto[20611]: "tunnb" #17: ignoring Delete SA
payload: PROTO_IPSEC_ESP SA(0xda27d687) not found (maybe expired)<br>
Mar 24 08:06:38 fw2 pluto[20611]: "tunnb" #17: received and ignored
informational message</b><br>
<br>
I got multiple:<br>
ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0xda27d682) not found
(maybe expired)<br>
<br>
if I do:<br>
ipsec auto --up tunnb<br>
<br>
then tunnb is up again...<br>
<br>
What could I do instead of a crontabl 'ipsec auto --up tunnb' ?<br>
Or what is wrong?<br>
<br>
Cheers.<br>
<br>
laurent.<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
</body>
</html>