I am using Ipsec in tunnel mode. Everything works okay. Then I decide to flush my SAD entries, on _one_ side of the tunnel. Naturally, I see a key exchange going on. Afterwards I see that the system on which I flushed the SAD entries does have new ones. However the other side of the tunnel is still using the old one for its tunnel to me. I would guess that that SAD would be replaced as well?
Is there a config ite I overlooked? Tcpdump showing what I just said: 12:33:31.189986 aaa.bbb.ccc.198 > aaa.bbb.ccc.193: ESP(spi=0x00169b89,seq=0x35) [tos 0x10] 12:33:31.322963 aaa.bbb.ccc.193 > aaa.bbb.ccc.198: ESP(spi=0x05c83a78,seq=0x35) [tos 0x10] 12:33:54.695274 aaa.bbb.ccc.198.500 > aaa.bbb.ccc.193.500: isakmp: phase 1 I agg: [|sa] 12:33:55.433767 aaa.bbb.ccc.193.500 > aaa.bbb.ccc.198.500: isakmp: phase 1 R agg: [|sa] 12:33:55.494034 aaa.bbb.ccc.198.500 > aaa.bbb.ccc.193.500: isakmp: phase 1 I agg: (hash: len=20) 12:33:55.524092 aaa.bbb.ccc.198.500 > aaa.bbb.ccc.193.500: isakmp: phase 2/others I oakley-quick[E]: [|hash] 12:33:55.731783 aaa.bbb.ccc.193.500 > aaa.bbb.ccc.198.500: isakmp: phase 2/others R oakley-quick[E]: [|hash] 12:33:55.733311 aaa.bbb.ccc.198.500 > aaa.bbb.ccc.193.500: isakmp: phase 2/others I oakley-quick[E]: [|hash] 12:33:59.650507 aaa.bbb.ccc.198 > aaa.bbb.ccc.193: ESP(spi=0x0aff2f79,seq=0x1) 12:33:59.659407 aaa.bbb.ccc.193 > aaa.bbb.ccc.198: ESP(spi=0x05c83a78,seq=0x36) 12:34:04.660544 aaa.bbb.ccc.198 > aaa.bbb.ccc.193: ESP(spi=0x0aff2f79,seq=0x2) 12:34:04.669431 aaa.bbb.ccc.193 > aaa.bbb.ccc.198: ESP(spi=0x05c83a78,seq=0x37) -Guido To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-net" in the body of the message