<div>Hi, I´m using Openswan in a Debian 5 box(distribution package).</div><div><br></div><div>My problem is that when I do an ipsec auto --status, for a tunnel with 3 days of life, I get literally thousands of messages like this:</div>
<div><br></div><div>"000 #5957: "to-33"[3] 189.X.X.145:62374 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 1465s</div><div>000 #5957: "to-33"[3] 189.X.X.145 esp.9dfd919f@189.X.X.145 esp.67479afd@201.Y.Y.Y tun.0@189.X.X.145 tun.0@201.Y.Y.Y"</div>
<div><br></div><div>beeing EVENT_SA_REPLACE value different for every line.</div><div>It gives me no problem, but I plan to add about 100 tunnels and having this behavor worries me.</div><div><br></div><div>As far as I know, I should have a single SA per tunnel, shoudn´t I?</div>
<div><br></div><div>my ipsec.conf has:</div><div><br></div><div><div>---</div><div>conn to-33</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>aggrmode=yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auth=esp</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>ike=3des-sha1-modp1024!</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>esp=3des-sha1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>pfs=no</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>keyingtries=1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>authby=secret</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>right=%any</div>
<div> ikelifetime=28800s</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rightid=@<a href="http://domain1.dyndns.org">domain1.dyndns.org</a></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rightsubnet=<a href="http://192.168.3.0/24">192.168.3.0/24</a></div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>leftsubnet=<a href="http://192.168.254.0/24">192.168.254.0/24</a></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auto=add</div></div>
<div>----</div><div><br></div><div>And the other side is a Sonicwall with 28800s for ike and phase2 too.</div><div><br></div><div>And in auth.log I see this(repeated dozens of times) every 10 or 20 seconds:</div><div><br>
</div><div><div>"Jan 12 18:14:46 vpntepo pluto[4152]: | processing connection to-33[3] 189.X.X.145"</div></div><div><div><br></div><div>And this also from time to time:</div><div><br></div><div>"Jan 12 18:15:16 vpntepo pluto[4152]: "to-33"[3] 189.X.X.145 #6094: ISAKMP SA expired (superseded by #7236)"</div>
</div><div><br></div><div>This is the output of my "ipsec verify"</div><div><br></div><div><div> ipsec verify</div><div>Checking your system to see if IPsec got installed and started correctly:</div><div>Version check and ipsec on-path <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]</div>
<div>Linux Openswan U2.4.12/K2.6.26-2-686 (netkey)</div><div>Checking for IPsec support in kernel <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]</div><div>NETKEY detected, testing for disabled ICMP send_redirects <span class="Apple-tab-span" style="white-space:pre"> </span>[FAILED]</div>
<div><br></div><div> Please disable /proc/sys/net/ipv4/conf/*/send_redirects</div><div> or NETKEY will cause the sending of bogus ICMP redirects!</div><div><br></div><div>NETKEY detected, testing for disabled ICMP accept_redirects <span class="Apple-tab-span" style="white-space:pre"> </span>[FAILED]</div>
<div><br></div><div> Please disable /proc/sys/net/ipv4/conf/*/accept_redirects</div><div> or NETKEY will accept bogus ICMP redirects!</div><div><br></div><div>Checking for RSA private key (/etc/ipsec.secrets) <span class="Apple-tab-span" style="white-space:pre"> </span>[DISABLED]</div>
<div> ipsec showhostkey: no default key in "/etc/ipsec.secrets"</div><div>Checking that pluto is running <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]</div><div>
Two or more interfaces found, checking IP forwarding <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]</div><div>Checking NAT and MASQUERADEing <span class="Apple-tab-span" style="white-space:pre"> </span>[N/A]</div>
<div>Checking for 'ip' command <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]</div><div>Checking for 'iptables' command <span class="Apple-tab-span" style="white-space:pre"> </span>[OK]</div>
<div>Opportunistic Encryption Support <span class="Apple-tab-span" style="white-space:pre"> </span>[DISABLED]</div></div><div><br></div><div><br></div><div>Is this a bug or configuration issue? </div>
<div>Any idea about how to solve it?</div><div><br></div><div><br></div><br>-- <br>Omar<br>