I tried to: connect to my CHR VPN server using my iPhone via IPsec/IKEv2/cert tunnel
Connection mechanics works fine
I saw this problem: lots of attempts to get connected, but it fails, because of “empty pool”.
Ok, it really is (see add. info), but it should remove non-used addresses from the pool, isnt it?
I expected to see: this works properly on 6.45, there were no duplicate pool entries.
There are NO connected R-W clients at the MOMENT, but IPs are still “busy”
And i cant flush it manually. I dont want to enlarge pool - 10.10.10.8/29 is enough for me.
Steps to repeat this issue:
-------- HERE some info
[owner@CHR] > ip ipsec active-peers print detail
Flags: R - responder, N - natt-peer
0 R local-address=10.0.0.1 remote-address=10.0.0.2 state=established side=responder uptime=4m38s last-seen=38s ph2-total=1
1 RN id="mikrouter@CHR" local-address=XX.XX.XX.XX port=4500 remote-address=109.252.108.18 port=18726 state=established side=responder uptime=4m43s last-seen=42s ph2-total=1
[owner@CHR] > &&logdata
Jul/29/2019 08:04:21 ErrorDiskLog ipsec error can't acquire address for 185.211.157.6, glo.iphone.rw.2019@CHR: pool empty (6)
Jul/29/2019 08:04:21 ErrorDiskLog ipsec error :: address relase to pool failed: No such used address entry (6)
Jul/29/2019 08:04:23 ErrorDiskLog ipsec error can't acquire address for 31.173.86.224, alx.iphone.rw.2019@CHR: pool empty (6)
Jul/29/2019 08:04:23 ErrorDiskLog ipsec error :: address relase to pool failed: No such used address entry (6)
[owner@CHR] > ip pool print detail
0 name="vpn-clients" ranges=10.0.0.2
1 name="int-clients" ranges=192.168.97.0/30
2 name="rw-clients" ranges=10.10.10.8/29
[owner@CHR] > ip ipsec mode-config print where name ~"roa"
Flags: * - default, R - responder
0 R name="roadwarrior-setup" system-dns=yes address-pool=rw-clients address-prefix-length=32
[owner@CHR] > ip ipsec profile print where name ~"IOS"
Flags: * - default
0 name="IOS/OSX" hash-algorithm=sha256 enc-algorithm=aes-256 dh-group=modp2048 lifetime=1d proposal-check=obey nat-traversal=yes dpd-interval=2m dpd-maximum-failures=5
[owner@CHR] > ip pool used print detail
pool=rw-clients address=10.10.10.8 owner="IPsec" info="31.173.86.224, alx.iphone.rw.2019@CHR"
pool=rw-clients address=10.10.10.9 owner="IPsec" info="185.211.157.6, glo.iphone.rw.2019@CHR"
pool=rw-clients address=10.10.10.10 owner="IPsec" info="185.211.157.6, glo.iphone.rw.2019@CHR"
pool=rw-clients address=10.10.10.11 owner="IPsec" info="185.211.157.6, glo.iphone.rw.2019@CHR"
pool=rw-clients address=10.10.10.12 owner="IPsec" info="185.211.157.6, glo.iphone.rw.2019@CHR"
pool=rw-clients address=10.10.10.13 owner="IPsec" info="185.211.157.6, glo.iphone.rw.2019@CHR"
pool=rw-clients address=10.10.10.14 owner="IPsec" info="31.173.86.47, alx.iphone.rw.2019@CHR"
pool=rw-clients address=10.10.10.15 owner="IPsec" info="185.211.157.6, glo.iphone.rw.2019@CHR"
[owner@CHR] > system resource print
uptime: 13h14m12s
version: 6.46beta16 (testing)
build-time: Jul/23/2019 06:44:07
free-memory: 936.0MiB
total-memory: 992.0MiB
cpu: Intel(R)
cpu-count: 1
cpu-frequency: 2999MHz
cpu-load: 1%
free-hdd-space: 9.9GiB
total-hdd-space: 9.9GiB
write-sect-since-reboot: 27208
write-sect-total: 27209
architecture-name: x86_64
board-name: CHR
platform: MikroTik