0

I got established connection between Amazon VPC and my site using strongswan.

I followed documentation from Amazon. Tunnel can be established and is running but is going down randomly if I can say.

Here is my ipsec.conf:

conn %default
        mobike=no
        compress=no
        authby=psk
        keyexchange=ikev2
        ike=aes128-sha1-modp1024!
        ikelifetime=28800s
        esp=aes128-sha1-modp1024!
        lifetime=3600s
        keyingtries=3
        rekeymargin=3m
        installpolicy=yes
        type=tunnel
        left=######(My IP)
        dpddelay=10
        dpdtimeout=3
        dpdaction=clear
        #lifetime = 300m
        #margintime = 10m
        #rekeyfuzz = 100%

conn vpc-tunnel-first
        leftsubnet=169.254.248.34,10.10.0.0/24,10.100.0.0/24
        right=177.72.241.58
        rightsubnet=169.254.248.33,10.20.0.0/24
        auto=start

There is nothing logged by charon when tunel goes down. Where should I look next?

  • you solve your problem? I have similar problem – inye Dec 12 '18 at 13:27
  • No, I did not solve this problem. – David Strejc Dec 14 '18 at 12:25
0

Raise the charon log level (enable debug mode).

Use tcpdump or tshark to check whether any packets are being sent.

Use ip xfrm state, ip xfrm policy, setkey -D (-P) -p to check the associations that strongSwan has loaded into the kernel, make sure they haven't disappeared.

  • Our tunnel is working - it is up and running - sometimes for one hour sometimes for twenty minutes. What did help little bit was setting dpddelay to 3. It seems that tunnel is little bit more stable. But I cannot rely on something which is failing randomly for unknown reason. I've setuped charon debug logging but there are too many information being presented. I will setup debug logging as this: charondebug="dmn 2, mgr 2, ike 2, chd 2, job 2, cfg 2, knl 2, net 2, enc 2, lib 2" Is this sufficient? – David Strejc Oct 2 '15 at 10:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.