Prefer old ipsec SAs

cubsfan

Running 2.0-RC2 (i386) built on Mon May 23 02:20:40 EDT 2011. I've got an IPsec tunnel that needs the prefer old IPsec SAs option to stay up and running. It was working fine on 1.2.3 but on 2.0 it doesn't seem to work.

thanks

-andy

cubsfan

Do I need to file a bug on this or anything? I've setup a 1.2.3 box for my VPN endpoints for the time being.

thanks
-andy

jimp

Can you check

sysctl net.key.preferred_oldsa

With the option on and off, see if that changes for you.

cubsfan

With it enabled it reports

net.key.preferred_oldsa: -30

with it disabled it reports

net.key.preferred_oldsa: 0

thanks

-andy

jimp

Then it should be operating normally. If you're seeing some other issue, the IPsec logs might be helpful, and/or the setkey -D and setkey -DP output. It probably isn't the SA preferral.