strongSwan

I couldn't see anything in the logs that can identify this error.
Everytime i try to connect another device with same username password, the newly connected device is assigned same ip e.g, 10.10.10.1. And the connection connected at the very end has the internet access, while the devices connected before, i am not able to access any site.

I have gone through some old issues like these:
https://wiki.strongswan.org/issues/1182 , it seems like "supporting multiple connections using SAME username and password was a bug that got fixed two years back".

Now my question is, does uniqueids=never means multiple clients can connect using SAME username and password? is that correct ?

Secondly, is there any way i can support more than one client using same credentials (or psk) , on Android strongswan client ? As you said "it might not perform well if there are lots of users (they are just stored in an unsorted linked list and searched linearly)."

Just to update , the strongswan version my epel repo got me is 5.6.1 not 5.6.2,
Can this be the issue ?

Is this "/var/log/charon.log" the right place where i need to check my logs ? because even if i cleared this file and reconnected the devices to watch the logs, this file is still so big to go through line by line.

Is this "/var/log/charon.log" the right place where i need to check my logs ? because even if i cleared this file and reconnected the devices to watch the logs, this file is still so big to go through line by line.

See LoggerConfiguration and also the example in HelpRequests.

And from /var/log/messages , below is what i got:

May 2 09:01:01 CNSB003 systemd: Starting Session 341 of user root.
May 2 09:08:23 CNSB003 systemd-logind: Removed session 336.
May 2 09:20:19 CNSB003 systemd-logind: Removed session 340.
May 2 10:01:01 CNSB003 systemd: Started Session 342 of user root.
May 2 10:01:01 CNSB003 systemd: Starting Session 342 of user root.
May 2 10:14:42 CNSB003 systemd-logind: Removed session 338.
May 2 10:31:09 CNSB003 systemd: Started Session 343 of user root.
May 2 10:31:09 CNSB003 systemd-logind: New session 343 of user root.
May 2 10:31:09 CNSB003 systemd: Starting Session 343 of user root.
May 2 10:31:29 CNSB003 systemd-logind: Removed session 343.

This time i tried to connect two clients on different connections i.e, one on wifi and one on 3G network. This time they got assigned different ips 10.24.24.1 & 10.24.24.2
But still they are kicking off each other. Where uniqueids=never.
If i do uniqueids=yes , both can stay connected, but only the one connected at last have internet access, for the first one's internet doesnt work, they are not able to access any site.

I cleared this file. Then connected a Android client 1. Then i tried to connect another client using same username/password,

You should stop the daemon, clear the file and then start the daemon again and connect from one and then a second device. So we see everything from start to finish. Do that with uniqueids=never and perhaps also with yes but restart the daemon (and perhaps save and clear the log file) in-between.

Also, you should reduce the log level for the enc subsystem to 1, these messages are not useful here and make the log quite difficult to read.

And the log you posted above just shows the creation and deletion of two SAs. The deletion of the first apparently happens overlapping with the creation of the second, however, the deletion is initiated by the client.

And from /var/log/messages , below is what i got:

Why would these messages be relevant?

But still they are kicking off each other.

What do you mean?

If i do uniqueids=yes , both can stay connected

That seems unlikely, at least if you connect them consecutively (there could be races where the uniqueness policy can't be applied successfully).

This is your problem:

loaded plugins: charon pkcs11 tpm aesni aes des rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints acert pubkey pkcs1 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt fips-prf gmp curve25519 chapoly xcbc cmac hmac ctr ccm gcm curl attr kernel-netlink resolve socket-default farp stroke vici updown eap-identity eap-sim eap-aka eap-aka-3gpp eap-aka-3gpp2 eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam xauth-noauth dhcp led duplicheck unity counters

Please refer to the description of the duplicheck plugin, in particular its behavior. Basically, you want to disable this as it does exactly the opposite of what you want (and its behavior is not related to the uniqueids setting).

Oh Man!
But the documentation says for enabling duplicheck, we need to do this "charon.plugins.duplicheck.enable" in strongswan.conf file. While, when i checked my conf file, it looks like the plugin is already disabled:

"charon {
load_modular = yes
duplicheck.enable = no
compress = yes
plugins {
include strongswan.d/charon/*.conf
}..."

Do you still think duplicheck is somehow on and is the cause of problem ?

Duplicheck was the problem here.
I had to turn it off like this. In strongswan.d/charon/duplicheck.conf,i had to set enable = no and load = no and the problem is resolved.

duplicheck {
enable = no
load = no
}

I couldn't be more thankful Tobias. Bundle of thanks.

Just one more question, Now that i am able to connect multiple clients using same credentials, is there any limit for max client supported on same credentials?

Thanks once again.!