4

I've created a tunnel between two sites using IPsec. I've made an error in the configuration, the address of the destination was false, so I deleted this tunnel. But after deleting, ipsec tries to establish the connection with the other site.

What I get from ipsec statusall:

Connections:
Security Associations (1 up, 0 connecting):
   TEST4[1]: CONNECTING, x.x.x.x[%any]...y.y.y.y[%any]
   TEST4[1]: IKE SPIs: eb1655dd8f51750d_i* 0000000000000000_r
   TEST4[1]: Tasks active: IKE_VENDOR IKE_INIT IKE_NATD IKE_CERT_PRE IKE_AUTHENTICATE IKE_CERT_POST IKE_CONFIG CHILD_CREATE IKE_AUTH_LIFETIME 

and from the log file I get:

peer not responding, trying again (52/0)
charon: 04[IKE] initiating IKE_SA TEST4[1] to y.y.y.y
charon: 04[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
charon: 04[NET] sending packet: from x.x.x.x[500] to y.y.y.y[500]
charon: 03[IKE] retransmit 1 of request with message ID 0
charon: 03[NET] sending packet: from x.x.x.x[500] to y.y.y.y[500]
charon: 01[IKE] retransmit 2 of request with message ID 0
charon: 01[NET] sending packet: from x.x.x.x[500] to y.y.y.y[500]
charon: 14[IKE] retransmit 3 of request with message ID 0
charon: 14[NET] sending packet: from x.x.x.x[500] to y.y.y.y[500]
charon: 05[IKE] retransmit 4 of request with message ID 0
charon: 05[NET] sending packet: from x.x.x.x[500] to y.y.y.y[500]
charon: 02[IKE] retransmit 5 of request with message ID 0
charon: 02[NET] sending packet: from x.x.x.x[500] to y.y.y.y[500]

How can I reconfigure ipsec to be aware of the new configuration when I delete the tunnel so that it doesn't keep on trying to establish the connection even though there is no tunnel?

2
  • What do you mean when you say "I deleted the tunnel"? What exactly did you do? Can you describe the steps in your question?
    – ecdsa
    Apr 3, 2014 at 13:25
  • I have created the necesary configuration to communicate between tow sites to communicate between them ( keys, certifaction ...) I have deleted every thing , but like ipsec statusall mentioned, there is one connection up. Even ipsec.secrets file is empty, he try to read from it.
    – Bingo
    Apr 3, 2014 at 13:34

1 Answer 1

2

Simply updating the strongSwan configuration files has no effect on the running keying daemon or established IPsec tunnels.

You have to either restart the daemon with ipsec restart (which terminates all existing IKE and IPsec Security Associations), or make it aware of the updated configuration with ipsec update. Since the latter has no effect on existing connections you'd have to terminate the one started earlier manually with ipsec down. In your case ipsec down TEST4.

man ipsec or the page about the ipsec command on the strongSwan wiki provide more information on the available control commands.

3
  • Thanks a lot. But can i reconfigure ipsec parameters, therfore he will be aware automatically that he should stop testing and eliminate the connection.
    – Bingo
    Apr 3, 2014 at 14:32
  • Can i do this in ipsec.conf file ?
    – Bingo
    Apr 3, 2014 at 14:43
  • As I explained, changes in config files such as ipsec.conf are not automatically picked up. You have to use ipsec update or restart to reload the configuration. With update existing connections are not modified so you have to terminate those manually with ipsec down (also to stop the daemon from retrying if the other peer is not reachable). By the way, if you set keyingtries to a fixed number the daemon will automatically stop retrying after a while (you apparently have configured keyingtries=%forever).
    – ecdsa
    Apr 3, 2014 at 14:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .