<DIV>I established a IPsec Connection between Linux box(of course, use openswan) and Cisco Router.The topology is easiest:</DIV>
<DIV>Linux(200.1.1.2)=======(200.1.1.1)Cisco</DIV>
<DIV>The IPsec SA is established.And I ping Cisco Router from Linux,I see ESP packets going up and down .But when I check it again after about 5 hours,I only see ESP packets go to Cisco Router ,but no response.I check the Cisco side ,logs shows like this:</DIV>
<DIV>rec'd IPSEC packet has invalid SPI for destaddr=200.1.1.1 ,prot=50,SPI=0xF4500A32, srcaddr=200.1.1.2</DIV>
<DIV>200.1.1.1 is the Cisco side ,200.1.1.2 is the Linux side.</DIV>
<DIV>At this time ,If I ping 200.1.1.2 from Cisco (200.1.1.1) , I see the IPsec Phase 2 is renegotiated:</DIV>
<DIV>2009-09-14 13:18:32 System0.Warning 192.168.1.3 Mar 14 05:20:44 pluto[1180]: "tunnelipsec" #38: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW to replace #32 {using isakmp#36 msgid:2581170f proposal=defaults pfsgroup=OAKLEY_GROUP_MODP1024}<000><BR>2009-09-14 13:18:32 System0.Warning 192.168.1.3 Mar 14 05:20:44 pluto[1180]: "tunnelipsec" #36: received Delete SA payload: replace IPSEC State #32 in 10 seconds<000><BR>2009-09-14 13:18:32 System0.Warning 192.168.1.3 Mar 14 05:20:44 pluto[1180]: "tunnelipsec" #36: received and ignored informational message<000><BR>2009-09-14 13:18:37 System0.Warning 192.168.1.3 Mar 14 05:20:49 pluto[1180]: "tunnelipsec" #36: received Delete SA payload: already replacing IPSEC State #32 in 5 seconds<000><BR>2009-09-14 13:18:37 System0.Warning 192.168.1.3 Mar 14 05:20:49 pluto[1180]: "tunnelipsec" #36: received and ignored informational message<000><BR>2009-09-14 13:18:39 System0.Warning 192.168.1.3 Mar 14 05:20:51 pluto[1180]: "tunnelipsec" #37: discarding duplicate packet; already STATE_QUICK_R0<000><BR>2009-09-14 13:18:42 System0.Warning 192.168.1.3 Mar 14 05:20:54 pluto[1180]: "tunnelipsec" #36: received Delete SA payload: already replacing IPSEC State #32 in 0 seconds<000><BR>2009-09-14 13:18:42 System0.Warning 192.168.1.3 Mar 14 05:20:54 pluto[1180]: "tunnelipsec" #36: received and ignored informational message<000><BR>2009-09-14 13:18:42 System0.Warning 192.168.1.3 Mar 14 05:20:54 pluto[1180]: "tunnelipsec" #39: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW to replace #32 {using isakmp#36 msgid:82a7553f proposal=defaults pfsgroup=OAKLEY_GROUP_MODP1024}<000><BR>2009-09-14 13:18:42 System0.Warning 192.168.1.3 Mar 14 05:20:54 pluto[1180]: "tunnelipsec" #39: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME msgid=82a7553f<000><BR>2009-09-14 13:18:42 System0.Warning 192.168.1.3 Mar 14 05:20:54 pluto[1180]: "tunnelipsec" #39: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2<000><BR>2009-09-14 13:18:42 System0.Warning 192.168.1.3 Mar 14 05:20:54 pluto[1180]: "tunnelipsec" #39: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x6a6218a8 <0x5479d8ff xfrm=AES_128-HMAC_MD5 NATOA=none NATD=none DPD=none}<000><BR>2009-09-14 13:18:43 System0.Warning 192.168.1.3 Mar 14 05:20:55 pluto[1180]: "tunnelipsec" #38: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME msgid=2581170f<000><BR>2009-09-14 13:18:43 System0.Warning 192.168.1.3 Mar 14 05:20:55 pluto[1180]: "tunnelipsec" #38: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2<000><BR>2009-09-14 13:18:43 System0.Warning 192.168.1.3 Mar 14 05:20:55 pluto[1180]: "tunnelipsec" #38: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x8b9b5c1c <0x317936d6 xfrm=AES_128-HMAC_MD5 NATOA=none NATD=none DPD=none}<000><BR>2009-09-14 13:18:49 System0.Warning 192.168.1.3 Mar 14 05:21:01 pluto[1180]: "tunnelipsec" #37: discarding duplicate packet; already STATE_QUICK_R0<000></DIV>
<DIV>And after renegotiated, Things return to normal:ESP packets can be seen both directions.</DIV>
<DIV>I know this may not be the Openswan problem, but can any one give me a hint on how to renegotiate the connection automatically.DPD can be used?Or REKEY be used?</DIV>
<DIV>My current config file is easy:</DIV>
<DIV>version 2.0<BR>config setup<BR> interfaces=%defaultroute<BR> klipsdebug=none<BR> plutodebug=none<BR> nat_traversal=yes<BR>conn tunnelipsec<BR> type=tunnel<BR> authby=secret<BR> left=200.1.1.2<BR> right=200.1.1.1<BR> keyexchange=ike<BR> auto=start</DIV>
<DIV>Thank you in advance.</DIV><br><br><span title="neteasefooter"/><hr/>
<a href="http://news.163.com/madeinchina/index.html?from=mailfooter">"中国制造",讲述中国60年往事</a>
</span>