Description

When there is a remote Host ip change for the IPSec tunnel connection, SSR ipsec tunnel plugin keeps communicating to an old remote IP and this causes IPSec tunnel down

Symptoms

IPSec connection flaps and triggers IPSec tunnel down, traffic disruption.

Solution

Starting with IPSec plugin version (v4.0), the config file (local IP, remote IP for IPSec) gets created under /etc/netns/IPSEC/ipsec.d/ and in the earlier IPSec plugin version the config file were created under /etc/ipsec.d/. Cases where SSR's are upgraded for the IPSec plugin to v4.0 and then downgraded to v3.4.1, the config files got mismatched after pushing the configuration from Conductor GUI.

Please follow the following workaround on v3.1

 

manual clean-up of below files.

 

/etc/netns/<name-space>/ipsec.d

 

Steps to perform :-

 

1. cd /etc/netns/<name-space>/ipsec.d/

cp -ipr * /tmp/  (Or any directory you wish to backup)

 

2. rm -rf /etc/netns/<name-space>/ipsec.d/*

 

3. touch /var/lib/128technology/plugins/ipsec/config.json

 

Note :- upgrading to v4.1.1 is the most recommended solution

 

Modification History

2025-07-07 : Article Created