Unable to install policy for changed child config (new traffic selector added to local_ts list) about strongswan HOT 2 CLOSED

That won't work like that. Reqids are allocated based on the complete set of traffic selectors. So adding a new subnet changes that and a new reqid is allocated causing that conflict when the "duplicate" policy for the first subnet is installed. In order for this to work, you either have to terminate the established CHILD_SA before updating the config (the policies for that active SA cause the policies to remain installed in the kernel when the trap policies are removed). Alternatively, you can configure a static reqid for this CHILD_SA, which remains the same no matter how you modify the traffic selectors.

from strongswan.

Oh okay, given that reqids are allocated based on a complete set of traffic selectors, the behavior makes sense. Thanks!

from strongswan.