strongSwan has established connections but some of them don't work.
Tags: troubleshooting, strongswan, ipsec, aws
Published: 2019-01-04 13:41:06

---
title: strongSwan has established connections but some of them don't work.
published: true
description: 
tags: troubleshooting, strongswan, ipsec, aws
---

# Intro
When I tested some VPN connections of strongSwan to Amazon Managed VPN[^1], I got a weird situation that strongSwan established all the connections but I could not send packet from strongSwan server to some of Amazon Managed VPN servers.

[^1]: Amazon Managed VPN creates two VPN servers by default.

# Problem
Whenever I restarted an ipsec process with `$ ipsec restart`, all the connections established but some of them did not work.

## My environment
- `$ lsb_release -a`: Ubuntu 16.04.5 LTS
- `$ ipsec version`: Linux strongSwan U5.3.5/K4.4.0-1067-aws
- `$ cat /etc/ipsec.conf`:
    ~~~bash
    conn %default
        authby      = secret
        auto        = start
        dpdaction   = restart
        dpddelay    = 10s
        dpdtimeout  = 30s
        esp         = aes128-sha1-modp1024
        ike         = aes128-sha1-modp1024
        ikelifetime = 8h
        keyexchange = ikev1
        keyingtries = %forever
        keylife     = 1h
        left        = %any
        leftid      = <strongSwan-endpointIP>
        leftsubnet  = 0.0.0.0/0
        rekeymargin = 3m

    conn aws-vpn1-primary
        right       = <aws-vpn1-primaryIP>
        rightid     = <aws-vpn1-primaryIP>
        rightsubnet = 192.168.1.0/24
        
    conn aws-vpn1-secondary
        right       = <aws-vpn1-secondaryIP>
        rightid     = <aws-vpn1-secondaryIP>
        rightsubnet = 192.168.1.0/24
        
    # aws-vpn2...vpn4 are omitted.
    
    conn aws-vpn5-primary
        right       = <aws-vpn5-primaryIP>
        rightid     = <aws-vpn5-primaryIP>
        rightsubnet = 192.168.5.0/24
        
    conn aws-vpn5-secondary
        right       = <aws-vpn5-secondaryIP>
        rightid     = <aws-vpn5-secondaryIP>
        rightsubnet = 192.168.5.0/24
    ~~~

# Cause
strongSwan seems not to be able to handle so many tunnels with the setting `auto = start` which will automatically be established when the daemon is started.

# Resolution
- Apply `auto = start` to all the primary and `auto = route` to all the secondary. This makes sure that all the primary will be up. If some packets are coming via a secondary, the tunnel between the secondary and strongSwan will be automatically up.
- `$ cat /etc/ipsec.conf`:
    ~~~bash
    conn %default
        authby      = secret
        dpdaction   = restart
        dpddelay    = 10s
        dpdtimeout  = 30s
        esp         = aes128-sha1-modp1024
        ike         = aes128-sha1-modp1024
        ikelifetime = 8h
        keyexchange = ikev1
        keyingtries = %forever
        keylife     = 1h
        left        = %any
        leftid      = <strongSwan-endpointIP>
        leftsubnet  = 0.0.0.0/0
        rekeymargin = 3m

    conn aws-vpn1-primary
        auto        = start
        right       = <aws-vpn1-primaryIP>
        rightid     = <aws-vpn1-primaryIP>
        rightsubnet = 192.168.1.0/24
        
    conn aws-vpn1-secondary
        auto        = route
        right       = <aws-vpn1-primaryIP>
        rightid     = <aws-vpn1-primaryIP>
        rightsubnet = 192.168.1.0/24
        
    # aws-vpn2...vpn4 are omitted.
    
    conn aws-vpn5-primary
        auto        = start
        right       = <aws-vpn5-primaryIP>
        rightid     = <aws-vpn5-primaryIP>
        rightsubnet = 192.168.5.0/24
        
    conn aws-vpn5-secondary
        auto        = route
        right       = <aws-vpn5-secondaryIP>
        rightid     = <aws-vpn5-secondaryIP>
        rightsubnet = 192.168.5.0/24
    ~~~

# Reference
- [Introduction to strongSwan](https://wiki.strongswan.org/projects/strongswan/wiki/IntroductionTostrongSwan#Invocation-and-Maintenance)