Step to reproduce:
Configure vpn with multiple tunnels but with incorrect (not matching) local/remote subnets.
Show sa
Config LeftSite 1.4, config RighSite 1.2.7
1.4
[email protected]:~$ show vpn ipsec sa Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal -------------- ------- -------- -------------- ---------------- ---------------- ----------- ---------- peer_192-0-2-2 down N/A N/A N/A N/A N/A N/A [email protected]:~$ [email protected]:~$ sudo ipsec restart Stopping strongSwan IPsec... Starting strongSwan 5.9.1 IPsec [starter]... [email protected]:~$ [email protected]:~$ [email protected]:~$ show vpn ipsec sa Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal ------------ ------- -------- -------------- ---------------- ---------------- ----------- ---------- [email protected]:~$
Expected output, as in 1.2.7
[email protected]:~$ show vpn ipsec sa Connection State Up Bytes In/Out Remote address Remote ID Proposal ------------------------ ------- ---- -------------- ---------------- ----------- ---------- peer-192.0.2.1-tunnel-20 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-4 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-5 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-16 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-7 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-6 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-9 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-3 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-10 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-11 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-2 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-13 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-12 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-1 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-14 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-15 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-19 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-8 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-18 down N/A N/A N/A N/A N/A peer-192.0.2.1-tunnel-17 down N/A N/A N/A N/A N/A
Maybe another bug, needs to clarify.
Before ipsec restart 1.4, show sa's
[email protected]:~$ sudo swanctl -l -P list-sa event { peer_192-0-2-2 { uniqueid = 1 version = 1 state = ESTABLISHED local-host = 192.0.2.1 local-port = 500 local-id = 192.0.2.1 remote-host = 192.0.2.2 remote-port = 500 remote-id = 192.0.2.2 initiator = yes initiator-spi = 45f77d7342584e6b responder-spi = afdc10256fef76b5 encr-alg = AES_CBC encr-keysize = 256 integ-alg = HMAC_SHA1_96 prf-alg = PRF_HMAC_SHA1 dh-group = MODP_1024 established = 48 rekey-time = 13179 child-sas { } } } list-sas reply { } [email protected]:~$
SA's after restart
[email protected]:~$ sudo ipsec restart Stopping strongSwan IPsec... Starting strongSwan 5.9.1 IPsec [starter]... [email protected]:~$ [email protected]:~$ sudo swanctl -l -P list-sas reply { } [email protected]:~$ [email protected]:~$ sudo swanctl -L [email protected]:~$