<div>I took time to upgrade today.</div><div><br></div><div><div>meta:~# ipsec --version</div><div>Linux Openswan U2.6.32/K2.6.24-sn (netkey)</div><div>See `ipsec --copyright' for copyright information.</div></div><div>
<br></div><div>ipsec auto --status snip:</div><div><br></div><div>000 "idc": <a href="http://192.168.90.0/24===89.202.x.x">192.168.90.0/24===89.202.x.x</a><89.202.x.x>[+S=C]...74.115.x.x<74.115.x.x>[+S=C]===<a href="http://172.30.0.0/16">172.30.0.0/16</a>; erouted HOLD; eroute owner: #0</div>
<div>000 "idc": myip=192.168.90.200; hisip=unset;</div><div>000 "idc": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0</div><div>000 "idc": policy: PSK+ENCRYPT+TUNNEL+UP+SAREFTRACK+lKOD+rKOD; prio: 24,16; interface: eth0; </div>
<div>000 "idc": newest ISAKMP SA: #1; newest IPsec SA: #0; </div><div>000 </div><div>000 #37: "idc":500 STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT in 14s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate</div>
<div>000 #36: "idc":500 STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT in 14s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate</div><div>000 #35: "idc":500 STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT in 14s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate</div>
<div>000 #34: "idc":500 STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT in 14s; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate</div><div>[snip]</div><div>000 #1: "idc":500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2503s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0); idle; import:admin initiate</div>
<div><br></div><div><br></div><div>syslog snip:</div><div><div>Feb 4 20:20:53 meta pluto[29438]: initiate on demand from <a href="http://192.168.90.11:45819">192.168.90.11:45819</a> to <a href="http://172.30.77.45:514">172.30.77.45:514</a> proto=6 state: fos_start because: acquire</div>
<div>Feb 4 20:20:53 meta pluto[29438]: "idc" #550: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+SAREFTRACK {using isakmp#1 msgid:02b0b8d6 proposal=AES(12)_128-SHA1(2)_160 pfsgroup=no-pfs}</div></div><div><br></div>
<div><br></div>Seems to be the same issue, in general. First IPSEC tunnel goes up, but it stays in hold state and the rest of the boxes (mostly syslog) cause it to try to bring up a zillion new tunnels.<div><br></div><div>
Any other pointers?</div><div><br></div><div>Scott</div><div><br><div class="gmail_quote">On Fri, Jan 28, 2011 at 2:19 PM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">On Fri, 28 Jan 2011, Scott T. Cameron wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Subject: [Openswan Users] Openswan 2.6.24 => Juniper SRX<br>
</blockquote><div class="im">
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Jan 28 19:53:24 pluto[16783]: initiate on demand from <a href="http://192.168.90.63:35718" target="_blank">192.168.90.63:35718</a> to<br>
</blockquote>
<br>
</div><div class="im"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
The config is fairly basic. The initiate on demands won't stop -- it goes in to the<br>
thousands of range.<br>
</blockquote>
<br></div>
v2.6.29 (September 27, 2010)<br>
<br>
* NETKEY: Fix for spurious %hold netlink-acquires [Paul/dhr]<br><font color="#888888">
<br>
Paul<br>
</font></blockquote></div><br></div>