> It seems that the IPSec features of m0nowall are not useable until this
> issue is fixed.
I have the same problem, but not with mobile clients.
I have 2 sites connected via a IPsec VPN. Both tunnel ends use exactly
the same config (running 1.1b16).
If I manually reboot the remote IPSec gateway (to simulate a power loss,
for example), the tunnel is unable to re-establish itself. I have to
reboot *both* machines! If I reboot only one machines, it seems some
buggy persistent SA prevent the racoon to go further.
Here are the logs:
Aug 2 11:37:27 racoon: INFO: isakmp.c:1368:isakmp_open(): W.X.Y.Z[500]
used as isakmp port (fd=6)
Aug 2 11:37:27 racoon: INFO: isakmp.c:1368:isakmp_open():
127.0.0.1[500] used as isakmp port (fd=7)
Aug 2 11:37:27 racoon: INFO: isakmp.c:1368:isakmp_open():
192.168.1.254[500] used as isakmp port (fd=8)
Aug 2 11:37:29 racoon: INFO: isakmp.c:1694:isakmp_post_acquire():
IPsec-SA request for A.B.C.D queued due to no phase1 found.
Aug 2 11:37:29 racoon: INFO: isakmp.c:808:isakmp_ph1begin_i(): initiate
new phase 1 negotiation: W.X.Y.Z[500]<=>A.B.C.D[500]
Aug 2 11:37:29 racoon: INFO: isakmp.c:813:isakmp_ph1begin_i(): begin
Aggressive mode.
Aug 2 11:38:00 racoon: ERROR: isakmp.c:1786:isakmp_chkph1there():
phase2 negotiation failed due to time up waiting for phase1. ESP
A.B.C.D->W.X.Y.Z
Aug 2 11:38:00 racoon: INFO: isakmp.c:1791:isakmp_chkph1there(): delete
phase 2 handler.
Aug 2 11:38:19 racoon: INFO: isakmp.c:1713:isakmp_post_acquire():
request for establishing IPsec-SA was queued due to no phase1 found.
Aug 2 11:38:30 racoon: ERROR: isakmp.c:1447:isakmp_ph1resend(): phase1
negotiation failed due to time up. 9535936735318ef2:0000000000000000
Aug 2 11:38:50 racoon: ERROR: isakmp.c:1786:isakmp_chkph1there():
phase2 negotiation failed due to time up waiting for phase1. ESP
A.B.C.D->W.X.Y.Z
Aug 2 11:38:50 racoon: INFO: isakmp.c:1791:isakmp_chkph1there(): delete
phase 2 handler.
Aug 2 11:39:11 racoon: INFO: isakmp.c:1694:isakmp_post_acquire():
IPsec-SA request for A.B.C.D queued due to no phase1 found.
And so on...
I first thought I had misconfigured the lifetimes values (see my
previous posts), but it seems it works very well 24/24 if no machine has
to bee rebooted. On the other hand, I can reproduce the error 80% of the
time.
Is anyone working on this? Is OpenVPN more stable and a better option
for m0n0wall?
Comments are welcome!
-- Vincent | 