[ previous ] [ next ] [ threads ]
 
 From:  Heinz Teichmann <heinz dot teichmann at wanews dot com dot au>
 To:  "m0n0wall at lists dot m0n0 dot ch" <m0n0wall at lists dot m0n0 dot ch>
 Subject:  Monowall VPN with two dynamic IPs
 Date:  Fri, 29 Oct 2010 14:21:20 +0800
Hi guys,

I set up a Monowall again to IPSec with a AVM Fritzbox. The AVM Box keeps changing IP Address every
night.
After the address change the tunnel fails. It has to be turned off and back on at the Monowall end
to make it work again.

Actual addresses: (DNS names are resolving correctly)

Monowall 77.xxx.xxx.173
AVM Box 79.xxx.xxx.121

The Messagelog of the Monowall:

Oct 29 07:13:26 racoon: INFO: IPsec-SA request for 79.xxx.xxx.153 queued due to no phase1 found.
Oct 29 07:10:22 racoon: INFO: delete phase 2 handler.
Oct 29 07:10:22 racoon: ERROR: phase2 negotiation failed due to time up waiting for phase1. ESP
79.xxx.xxx.153[500]->77.xxx.xxx.173[500]
Oct 29 07:10:00 racoon: ERROR: phase1 negotiation failed due to time up.
a503be1a50e0a8cd:0000000000000000
Oct 29 07:09:51 racoon: INFO: request for establishing IPsec-SA was queued due to no phase1 found.
Oct 29 07:09:41 racoon: INFO: delete phase 2 handler.
Oct 29 07:09:41 racoon: ERROR: phase2 negotiation failed due to time up waiting for phase1. ESP
79.xxx.xxx.153[0]->77. xxx.xxx.173[0]
Oct 29 07:09:10 racoon: INFO: begin Aggressive mode.
Oct 29 07:09:10 racoon: INFO: initiate new phase 1 negotiation:
77.xxx.xxx.173[500]<=>79.xxx.xxx.153[500]
Oct 29 07:09:10 racoon: INFO: IPsec-SA request for 79.xxx.xxx.153 queued due to no phase1 found.

IPsec DNS check interval is actually set to 10 seconds.

79.xxx.xxx.153 was the AVM?s address yesterday.
It already starts wrong in the first line, SA request for 79.xxx.xxx.153. This is definitely not the
address where the request comes from, this is the address at the time when racoon had been restarted
the last time.
But, this is also the address stored under IPSec Diagnostics/SPD. Setting the DPD parameter to
different values didn?t help.
In my option that should have happened here, when Monowall detected that the Addresses don?t match
anymore:

Oct 29 02:36:07 racoon: INFO: ISAKMP-SA deleted 77.xxx.xxx.173[500]-79.xxx.xxx.153[500]
spi:6ca97a2eb335f7fb:7895e5cd21564ab5
Oct 29 02:36:07 racoon: ERROR: couldn't find configuration.
Oct 29 02:36:06 racoon: INFO: ISAKMP-SA expired 77.xxx.xxx.173[500]-79.xxx.xxx.153[500]
spi:6ca97a2eb335f7fb:7895e5cd21564ab5
Oct 29 02:36:06 racoon: WARNING: remote address mismatched. db=79.xxx.xxx.153[500],
act=79.xxx.xxx.121[500]
Oct 29 02:36:06 racoon: ERROR: failed to recv from pfkey (Resource temporarily unavailable)
Oct 29 02:36:06 racoon: WARNING: remote address mismatched. db=79.xxx.xxx.153[500],
act=79.xxx.xxx.121[500]
Oct 29 02:36:06 racoon: INFO: purged IPsec-SA proto_id=ESP spi=36494290.
Oct 29 02:36:06 racoon: WARNING: remote address mismatched. db=79.xxx.xxx.153[500],
act=79.xxx.xxx.121[500]

It might work with a shorter phase 1/2 interval but that only covers the real problem. If my
suspicion is correct it should work in 3 hours again, after phase 1 expired. (Established 2:34)
Are there any options to modify Racoon so that the SPD gets deleted as soon as the remote address
mismatch is detected? This should be done as soon as the IPSec DNS check interval is set.

Best Regards

Heinz




www.thewest.com.au

------------------------------------------------------------------------------------
West Australian Newspapers Group
------------------------------------------------------------------------------------ 
Privacy and Confidentiality Notice

The information contained herein and any attachments are intended solely for the named recipients.
It may contain privileged confidential information.  If you are not an intended recipient, please
delete the message and any attachments then notify the sender. Any use or disclosure of the contents
of either is unauthorised and may be unlawful. Any liability for viruses is excluded to the fullest
extent permitted by law.

Advertising Terms & Conditions
Please refer to the current rate card for advertising terms and conditions.  The rate card is
available on request or via www.thewest.com.au/ratecard

Unsubscribe
If you do not wish to receive emails such as this in future please reply to it with "unsubscribe" in
the subject line.