Hi, I am having issue with vti going down for ipsec site to site tunnel between vyos and paloalto. Following are the logs from vyos side. vyos established spi c436e70e_i afd67238_o and bring up vti. For some reason Paloalto decides to delete old spi and create new one so it first sends create request and then delete. When vyos deletes this spi there is already one existing spi ca05a690_i 965504ab_o so vyos should not bring down vti but it is. This issue is there in vyos 1.1.8 as well as vyos 1.2.4
Jun 13 07:20:52 07[IKE] <peer-10.15.28.171-tunnel-vti|2> CHILD_SA peer-10.15.28.171-tunnel-vti{2} established with SPIs c436e70e_i afd67238_o and TS 0.0.0.0/0 === 0.0.0.0/0
Jun 13 07:20:52 09[KNL] interface vti0 activated
Jun 13 07:20:52 07[IKE] <peer-10.15.28.171-tunnel-vti|2> activating new tasks
Jun 13 07:20:52 07[IKE] <peer-10.15.28.171-tunnel-vti|2> nothing to initiate
Jun 13 07:20:52 10[NET] <peer-10.15.28.171-tunnel-vti|2> received packet: from 10.15.28.171[4500] to 10.15.30.30[4500] (364 bytes)
Jun 13 07:20:52 10[ENC] <peer-10.15.28.171-tunnel-vti|2> parsed CREATE_CHILD_SA request 0 [ SA No KE TSi TSr ]
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> looking for a child config for 0.0.0.0/0 ::/0 === 0.0.0.0/0 ::/0
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> proposing traffic selectors for us:
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> 0.0.0.0/0
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> proposing traffic selectors for other:
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> 0.0.0.0/0
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> candidate “peer-10.15.28.171-tunnel-vti” with prio 10+10
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> found matching child config “peer-10.15.28.171-tunnel-vti” with prio 20
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> selecting proposal:
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> proposal matches
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> received proposals: ESP:AES_CBC_128/HMAC_SHA1_96/ECP_256/NO_EXT_SEQ
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> configured proposals: ESP:AES_CBC_128/HMAC_SHA1_96/ECP_256/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA2_256_128/ECP_256/NO_EXT_SEQ
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> selected proposal: ESP:AES_CBC_128/HMAC_SHA1_96/ECP_256/NO_EXT_SEQ
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> selecting traffic selectors for us:
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> config: 0.0.0.0/0, received: 0.0.0.0/0 => match: 0.0.0.0/0
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> config: 0.0.0.0/0, received: ::/0 => no match
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> selecting traffic selectors for other:
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> config: 0.0.0.0/0, received: 0.0.0.0/0 => match: 0.0.0.0/0
Jun 13 07:20:52 10[CFG] <peer-10.15.28.171-tunnel-vti|2> config: 0.0.0.0/0, received: ::/0 => no match
Jun 13 07:20:52 10[IKE] <peer-10.15.28.171-tunnel-vti|2> CHILD_SA peer-10.15.28.171-tunnel-vti{3} established with SPIs ca05a690_i 965504ab_o and TS 0.0.0.0/0 === 0.0.0.0/0
Jun 13 07:20:52 10[ENC] <peer-10.15.28.171-tunnel-vti|2> generating CREATE_CHILD_SA response 0 [ SA No KE TSi TSr ]
Jun 13 07:20:52 10[NET] <peer-10.15.28.171-tunnel-vti|2> sending packet: from 10.15.30.30[4500] to 10.15.28.171[4500] (284 bytes)
Jun 13 07:20:52 16[IKE] <peer-10.15.28.171-tunnel-vti|2> keeping statically configured path 10.15.30.30 - 10.15.28.171
Jun 13 07:20:53 06[NET] <peer-10.15.28.171-tunnel-vti|2> received packet: from 10.15.28.171[4500] to 10.15.30.30[4500] (76 bytes)
Jun 13 07:20:53 06[ENC] <peer-10.15.28.171-tunnel-vti|2> parsed INFORMATIONAL request 1 [ D ]
Jun 13 07:20:53 06[IKE] <peer-10.15.28.171-tunnel-vti|2> received DELETE for ESP CHILD_SA with SPI afd67238
Jun 13 07:20:53 06[IKE] <peer-10.15.28.171-tunnel-vti|2> closing CHILD_SA peer-10.15.28.171-tunnel-vti{2} with SPIs c436e70e_i (0 bytes) afd67238_o (0 bytes) and TS 0.0.0.0/0 === 0.0.0.0/0
Jun 13 07:20:53 06[IKE] <peer-10.15.28.171-tunnel-vti|2> sending DELETE for ESP CHILD_SA with SPI c436e70e
Jun 13 07:20:53 06[IKE] <peer-10.15.28.171-tunnel-vti|2> CHILD_SA closed
Jun 13 07:20:53 08[KNL] interface vti0 deactivated