(racoon 913) Re: Multiple SAD entries (ref racoon 905)

At Fri, 25 Feb 2005 05:28:16 -0500 (EST),
"John Doe" <[email protected]> wrote:
> 
> The problem is that packets from FreeBSD to WinXP continue to use
> the old SA, even though the new one is also present in the SAD thus
> communication between the two gateways fails. (as WinXP is expecting
> to use the new SA). It then takes several minutes to reestablish a
> working tunnel. Below I have attached a dump of the SAD entries.
> 
> Is this behaviour correct/by design/known problem and does this
> relate to a racoon problem or IPSec/Kernel problem??

This is a known kernel behavior and if you are using FreeBSD,
	sysctl net.key.prefered_oldsa=0     (for 4.x)
	sysctl net.key.preferred_oldsa=0    (for 5.x)
may help you.

Regards,
-- 
KAMADA Ken'ichi <[email protected]>