Loading...
Loading...
When disabling an ike-peer, sometimes the traffic-selector is not marked "down" in one or both directions.
Cosmetic. The traffic selector is incorrectly reported as up for one or both directions.
All the following must be true -- IKEv2 IPsec tunnel -- A nonzero value for ipsec.pfkey.load, ipsec.sp.migrate and ipsec.sp.owner is set. -- During the life of the SA the tunnel was migrated to another tmm owner. The final point is not normally visible unless debug2 logging is enabled on ike-daemon.
The selector state cannot be changed unless it goes up/down again. There is no way to manually fix it.
Disabling an ike-peer config object will correctly mark the associated traffic-selector down.
F5 Integration
Learn more about where this data comes from
BugZero Plan
Streamline upgrades with automated vendor bug scrubs
BugZero Prevent
Wish you caught this bug sooner? Get proactive today.