|
||||||||
Hi, Vincent Fleuranceau --> m0n0wall (2004-08-02 14:34:17 +0200): > I have the same problem, but not with mobile clients. > > I have 2 sites connected via a IPsec VPN. Both tunnel ends use exactly > the same config (running 1.1b16). > > If I manually reboot the remote IPSec gateway (to simulate a power loss, > for example), the tunnel is unable to re-establish itself. I have to > reboot *both* machines! If I reboot only one machines, it seems some > buggy persistent SA prevent the racoon to go further. Similar problem here: - local side (A.A.A.A) runs m0n0wall 1.1b16, remote side (B.B.B.B) is m0n0wall 1.0 - IPsec VPN works fine until remote side is rebooted - after remote side is up again I try to establish the VPN connection by sending a ICMP packet from the local side over the tunnel - local side logs: racoon: INFO: isakmp.c:952:isakmp_ph2begin_i(): initiate new phase 2 negotiation: A.A.A.A[0]<=>B.B.B.B[0] racoon: ERROR: isakmp_inf.c:141:isakmp_info_recv(): ignore information because the message has no hash payload. last message repeated 2 times racoon: ERROR: pfkey.c:804:pfkey_timeover(): B.B.B.B give up to get IPsec-SA due to time up to wait. - remote side logs: racoon: ERROR: isakmp.c:490:isakmp_main(): can't start the quick mode, there is no ISAKMP-SA, aa2ecfdd4c608fa9:6a3051a4cbce1e88:0000c65f - "Diagnostics -> IPsec" on local side displays: Source Destination Protocol SPI Enc. alg. Auth. alg. B.B.B.B A.A.A.A ESP 08318690 3des-cbc hmac-sha1 B.B.B.B A.A.A.A ESP 0326d2b0 replay=0 pid=1049 - 'setkey -D' on local side: B.B.B.B A.A.A.A esp mode=tunnel spi=137463440(0x08318690) reqid=16564(0x000040b4) E: 3des-cbc a903b945 8589ce49 136a62bf 67fe6d47 401ee686 154e7f41 A: hmac-sha1 73122de1 29c02b56 d5c8d5e1 81784a4d 47ddcaad seq=0x00000000 replay=4 flags=0x00000000 state=mature created: Aug 2 16:00:59 2004 current: Aug 2 16:12:55 2004 diff: 716(s) hard: 3600(s) soft: 2880(s) last: Aug 2 16:09:53 2004 hard: 0(s) soft: 0(s) current: 6864(bytes) hard: 0(bytes) soft: 0(bytes) allocated: 66 hard: 0 soft: 0 sadb_seq=22 pid=1019 refcnt=1 B.B.B.B A.A.A.A esp mode=tunnel spi=206340026(0x0c4c7fba) reqid=16564(0x000040b4) seq=0x00000000 replay=0 flags=0x00000000 state=larval sadb_seq=21 pid=1019 refcnt=1 > I first thought I had misconfigured the lifetimes values (see my > previous posts), but it seems it works very well 24/24 if no machine has > to bee rebooted. On the other hand, I can reproduce the error 80% of the > time. So far it's 100% here... Cheers, Jukka -- bashian roulette: $ ((RANDOM%6)) || rm -rf ~ |