-
Notifications
You must be signed in to change notification settings - Fork 220
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
IKEv2 disconnects after one hour #405
Comments
On Wed, 20 Jan 2021, Lin Song wrote:
[ CC:ing swan-dev ]
I tested with iOS, macOS and Windows clients, and found that when the server has setting rekey=no, Libreswan disconnects
the IKEv2 VPN connection after about 60 minutes, which is the default ikelifetime. The client will then show "Not
connected". Is this behavior normal? It looks like rekey=no is the suggested setting [1], and setting rekey=yes might not
work as intended if the client is behind NAT [2]. The disconnect issue is fixed after I set ikelifetime and salifetime to
24h on the server.
With recent versions of libreswan you can have rekey=yes on the server.
This would resolve your issue. But I recommend setting the ikelifetime=
to at least 8h so let (most?) clients initiate the rekey before the
server expires the connection.
It is still a good idea to let the client do the rekeying. And with
setting the IKE and IPsec lifetimes to 24h, you basically end up not
rekeying before the client, and so the client will rekey for you.
With IKEv1, the IKE SA could not rekey and vanish while keeping the
IPsec SA up, so with default values of ikelifetime=1h and salifetime=8h,
the VPN tunnel would stay up for 8h. But I guess now with IKEv2,
which does not allow orphaned IPsec SA's, it means with rekey=no
that the tunnel goes down at ikelifetime= of 1h. That is indeed
not the best solution. I will look at changing the default value.
You can reproduce this issue using any of iOS, macOS and/or Windows VPN client and IKEv2. This might be a bug in
Libreswan. On the other hand, IKEv1 L2TP and XAuth connections both tested OK, the client would request to re-connect when
the IPsec SA expires.
See above for why with IKEv1, you would end up with an 8h lifetime,
and presumably your clients rekey before the 8h timer is up. With
IKEv2, this accidentally became 1h.
Paul
|
Thanks for the answers @letoams! I understand it better now. Consistent with what you said above, I did observed in my tests that IKEv1 tunnels can stay up until |
hwdsl2
added a commit
to hwdsl2/setup-ipsec-vpn
that referenced
this issue
Jan 22, 2021
- Set both "ikelifetime" and "salifetime" to 24 hours, which is recommended since we have "rekey=no" on the server. VPN clients will normally initiate rekey with a shorter interval. Ref: libreswan/libreswan#405 (comment) https://libreswan.org/man/ipsec.conf.5.html
hwdsl2
added a commit
to hwdsl2/docker-ipsec-vpn-server
that referenced
this issue
Jan 22, 2021
- Set both "ikelifetime" and "salifetime" to 24 hours, which is recommended since we have "rekey=no" on the server. VPN clients will normally initiate rekey with a shorter interval. Ref: libreswan/libreswan#405 (comment) https://libreswan.org/man/ipsec.conf.5.html
nebulabox
pushed a commit
to nebulabox/setup-ipsec-vpn
that referenced
this issue
Aug 11, 2021
- Set both "ikelifetime" and "salifetime" to 24 hours, which is recommended since we have "rekey=no" on the server. VPN clients will normally initiate rekey with a shorter interval. Ref: libreswan/libreswan#405 (comment) https://libreswan.org/man/ipsec.conf.5.html
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reference: hwdsl2/setup-ipsec-vpn#913 (comment)
Similar issue: #362
Libreswan version: 4.1
I tested with iOS, macOS and Windows clients, and found that when the server has setting
rekey=no
, Libreswan disconnects the IKEv2 VPN connection after about 60 minutes, which is the defaultikelifetime
. The client will then show "Not connected". Is this behavior normal? It looks likerekey=no
is the suggested setting [1], and settingrekey=yes
might not work as intended if the client is behind NAT [2]. The disconnect issue is fixed after I setikelifetime
andsalifetime
to 24h on the server.You can reproduce this issue using any of iOS, macOS and/or Windows VPN client and IKEv2. This might be a bug in Libreswan. On the other hand, IKEv1 L2TP and XAuth connections both tested OK, the client would request to re-connect when the IPsec SA expires.
Libreswan logs around the time of disconnect are below. The macOS client disconnected around
07:17:39
, the Windows client disconnected around07:18:18
, and the iOS client disconnected around07:22:25
.Here's the IKEv2 configuration:
[1] https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2
[2] https://wiki.strongswan.org/issues/3400
The text was updated successfully, but these errors were encountered: