Bug #4254
closedDynamic interface removal/addition breaks IKEv2
0%
Description
Where you have a dynamic interface removed and re-added while running IKEv2 in strongswan, things break. Good easily replicable example is an OpenVPN server instance bound to the same WAN as IPsec. Restart OpenVPN, and strongswan will kick out:
15[IKE] old path is not available anymore, try to find another 15[IKE] sending address list update using MOBIKE
at which time it tries connecting to every IP sent via MOBIKE, and gets itself into a mess (VPN no longer works) until you X out the connection under Status>IPsec.
Updated by Chris Buechler almost 10 years ago
sent Ermal details on how to replicate in the test setup.
Updated by Ermal Luçi almost 10 years ago
- Status changed from Confirmed to Feedback
I put a workaround to not use the interfaces not present in config.
Though the real workaround here is to install static routes so strongswan can use them when searching for nexthop.
Let me know if for 2.2 this is enough.
Updated by Ermal Luçi almost 10 years ago
Static routes are put back in the configuration.
Updated by Chris Buechler almost 10 years ago
- Status changed from Feedback to Resolved
that fixes the initial described problem. Also re-verified multi-WAN bits after static routes returned, including disconnect/reconnect of dynamic WANs, and that's all good as well.