I use both iOS and Windows clients to connect to my strongSwan server, and have
observed that when a Windows client closes the connection, the following log
entries are written:
Jul 03 12:50:26 pvn charon-systemd[39509]: received DELETE for ESP CHILD_SA
with SPI 44bf3ff8
Jul 03 12:50:26 pvn charon-systemd[39509]: closing CHILD_SA net{4} with SPIs
c6d196ed_i (3210654 bytes) 44bf3ff8_o (153861005 bytes) and TS 0.0.0.0/0 ===
10.92.10.2/32
Jul 03 12:50:26 pvn charon-systemd[39509]: sending DELETE for ESP CHILD_SA with
SPI c6d196ed
Jul 03 12:50:26 pvn charon-systemd[39509]: CHILD_SA closed
Jul 03 12:50:26 pvn charon-systemd[39509]: generating INFORMATIONAL response 2
[ D ]
Jul 03 12:50:26 pvn charon-systemd[39509]: sending packet: from
192.168.92.5[4500] to 166.176.185.31[9914] (80 bytes)
Jul 03 12:50:26 pvn charon-systemd[39509]: received packet: from
166.176.185.31[9914] to 192.168.92.5[4500] (80 bytes)
Jul 03 12:50:26 pvn charon-systemd[39509]: parsed INFORMATIONAL request 3 [ D ]
Jul 03 12:50:26 pvn charon-systemd[39509]: received DELETE for IKE_SA
conn-windows[9]
Jul 03 12:50:26 pvn charon-systemd[39509]: deleting IKE_SA conn-windows[9]
between 192.168.92.5[windows.mydomain.com]...166.176.185.31[C=US,
O=pvn-strongSwan, CN=bls-bsur>
Jul 03 12:50:26 pvn charon-systemd[39509]: IKE_SA deleted
Jul 03 12:50:26 pvn charon-systemd[39509]: generating INFORMATIONAL response 3
[ ]
Jul 03 12:50:26 pvn charon-systemd[39509]: sending packet: from
192.168.92.5[4500] to 166.176.185.31[9914] (80 bytes)
Jul 03 12:50:26 pvn charon-systemd[39509]: lease 10.92.10.2 by 'C=US,
O=pvn-strongSwan,
[email protected]<mailto:[email protected]>' went offline
But when an iOS client closes the connection, there is no "closing CHILD_SA"
log entry, thus the bytes transferred information is not there.
Jul 02 19:11:22 pvn charon-systemd[39509]: received DELETE for IKE_SA
conn-ios[5]
Jul 02 19:11:22 pvn charon-systemd[39509]: deleting IKE_SA conn-ios[5] between
192.168.92.5[ios.mydomain.com]...166.176.186.243[[email protected]]
Jul 02 19:11:22 pvn charon-systemd[39509]: IKE_SA deleted
Jul 02 19:11:22 pvn charon-systemd[39509]: generating INFORMATIONAL response 10
[ ]
Jul 02 19:11:22 pvn charon-systemd[39509]: sending packet: from
192.168.92.5[4500] to 166.176.186.243[53457] (80 bytes)
Jul 02 19:11:22 pvn charon-systemd[39509]: lease 10.92.10.1 by
'[email protected]' went offline
Presumably this is because the Windows client is a bit more fastidious and
actually closes the CHILD_SA, but iOS doesn't?
Is there a reason that strongSwan can't log an implicit CHILD_SA close when the
DELETE is received so that the bytes transferred information can be logged? Or,
am I missing something in my configuration to cause this to be logged?
Thanks!
Configuration:
conn-defaults {
version = 2
send_certreq = yes
send_cert = always
unique = never
fragmentation = yes
# Force esp encapsulation for restrictive firewalls
encap = yes
dpd_delay = 120s
rekey_time = 0s
pools = primary-pool-ipv4
local {
auth = pubkey
cacerts = strongSwanCACert.pem
}
}
remote-defaults {
remote {
id = %any
}
}
child-defaults {
net {
dpd_action = clear
rekey_time = 0s
updown = /usr/lib/ipsec/_updown iptables
}
}
connections {
conn-android: conn-defaults, remote-defaults {
proposals =
aes256-aes192-aes128-sha384-sha256-sha1-modp3072-modp2048-modp1536
local {
certs = android-strongSwanVPNCert.pem
id = android.mydomain.com
}
children {
net : child-defaults {
local_ts = 0.0.0.0/0
esp_proposals = aes256-sha256
}
}
}
conn-windows: conn-defaults, remote-defaults {
proposals = aes256-sha256-modp1024
local {
certs = windows-strongSwanVPNCert.pem
id = windows.mydomain.com
}
children {
net : child-defaults {
local_ts = 0.0.0.0/0
esp_proposals = aes256-sha256-sha1-modp1024
}
}
}
conn-linux: conn-defaults, remote-defaults {
proposals = aes192-sha256-modp3072
local {
certs = linux-strongSwanVPNCert.pem
id = linux.mydomain.com
}
remote {
auth = pubkey
}
children {
net : child-defaults {
local_ts = 0.0.0.0/0
esp_proposals = aes128gcm128-x25519
}
}
}
conn-ios : conn-defaults, remote-defaults {
proposals = aes256-sha256-modp2048,
aes256-sha256-modp1024,aes256-sha1-modp1024
local {
certs = ios-strongSwanVPNCert.pem
id = ios.mydomain.com
}
remote {
auth = eap-tls
}
children {
net : child-defaults {
local_ts = 0.0.0.0/0
esp_proposals = aes256-sha256
}
}
}
}
pools {
primary-pool-ipv4 {
addrs = 10.92.10.0/24
dns = 192.168.92.3
}
}
Thanks
