<font face="arial" size="2"><p>May try using commands such as:</p>
<p>ipsec auto --add newconnection</p>
<p>or</p>
<p>ipsec auto --replace previousconnection</p>
<p> </p>
<p>That may keep you from having to restart all the connections.</p>
<p> </p>
<p>Sorry it doesn't help with your original problem, but it may be a workaround.</p>
<p> </p>
<p>Willie</p>
<p> </p>
<p>-----Original Message-----<br />From: "Roman Serbski" <mefystofel@gmail.com><br />Sent: Thursday, September 1, 2011 11:00am<br />To: users@openswan.org<br />Subject: [Openswan Users] Losing VPN after ipsec restart<br /><br /></p>
<div id="SafeStyles1314900037">
<p>Hi list,<br /><br />Appreciate your advise with the following issue.<br /><br />We have ~90 remote offices establishing IPSec tunnel with the server<br />in HQ (let's call it VPN master).<br /><br />The VPN master is powered by Ubuntu 8.04.2 with Openswan<br />U2.4.9/K2.6.24-23-server installed from packages.<br /><br />Here is the typical entry for the remote site in ipsec.conf:<br /><br />conn L2TP-PSK-noNAT-remote-site-01<br /> authby=secret<br /> pfs=no<br /> auto=start<br /> keyingtries=3<br /> rekey=no<br /> type=tunnel<br /> left=public.ip.of.remote.side<br /> leftsubnet=192.168.100.0/24<br /> leftsourceip=192.168.100.1<br /> right=public.ip.of.vpn.master<br /> rightsubnet=10.0.0.0/8<br /> rightsourceip=private.ip.of.vpn.master<br /><br />Remote sites are powered by Ubuntu 9.10 with Openswan<br />U2.6.22/K2.6.31-22-generic with the following ipsec.conf:<br /><br />conn L2TP-PSK-noNAT-remote-site-01<br /> authby=secret<br /> pfs=no<br /> auto=start<br /> type=tunnel<br /> left=public.ip.of.remote.side<br /> leftsubnet=192.168.100.0/24<br /> leftsourceip=192.168.100.1<br /> right=public.ip.of.vpn.master<br /> rightsubnet=10.0.0.0/8<br /> rightsourceip=private.ip.of.vpn.master<br /><br />Everything works fine with IPSec tunnel establishing alright, however<br />recently we started experiencing some issues.<br /><br />When we modify ipsec.conf (to add a new entry) and restart ipsec on<br />VPN master, some offices are recovered instantly, for some offices it<br />takes an hour, but some are never recovered.<br /><br />If I login to the remote site with IPSec tunnel down and restart ipsec<br />then the tunnel is established immediately.<br /><br />I was trying to find a pattern but in vein. Some offices with high<br />latency and packet loss are recovered immediately and offices with a<br />relatively good connection might never recover and vice verse. We also<br />monitor all sites by pinging them so I believe there is always some<br />traffic traversing the tunnel.<br /><br />It's probably worth mentioning that we didn't experience this issue<br />before (with ~30 remote offices)... I guess with 90 sites we reached<br />some timeout limits.<br /><br />Any hints would be greatly appreciated.<br /><br />Thank you for your time.<br />_______________________________________________<br />Users@openswan.org<br />http://lists.openswan.org/mailman/listinfo/users<br />Micropayments: https://flattr.com/thing/38387/IPsec-for-Linux-made-easy<br />Building and Integrating Virtual Private Networks with Openswan: <br />http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</p>
</div></font>