<html><body><div>Hi guys.</div><div><br></div><div>Firstly, I would really appreciate some help with this - its something I've been trying to deal with for the last week or so, so here goes.</div><div><br></div><div>I have a server hosted in Amazon, it details below.</div><div>
<p class="p1">root@ip-10-99-0-240:/var/log# ipsec --version</p>
<p class="p1">Linux Openswan U2.6.43/K3.13.0-44-generic (netkey)</p>
<p class="p1">See `ipsec --copyright' for copyright information.</p><p class="p1"><br></p>
<p class="p1">root@ip-10-99-0-240:/var/log# uname -a</p>
<p class="p1">Linux ip-10-99-0-240 3.13.0-44-generic #73-Ubuntu SMP Tue Dec 16 00:22:43 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux</p>
<p class="p1">root@ip-10-99-0-240:/var/log# cat /etc/issue.net </p>
<p class="p1">Ubuntu 14.04.2 LTS</p></div><div><br></div><div>We have a tunnel established to a third party which is a Cisco ASA 55xx device using 3des-md5. the config i've included at our side the end of the mail. Every day or so the tunnel drops with the ASA (seemingly on our side) for no apparent reason apart from a re-keying issue on the SA /phase 2 side. this is happening at least every day, if not randomly at no exact time. I have spoken to our third party who are looking into this again, and with Amazon last friday who helped me identify the re-key issue originally which was due to the phase 2 lifetime not matching with the ASA config. The tunnel facilitates connectivity via an application we use on our network and we get a report from the app (by email alert) as to when the connection to the third party side times out ( The application tries to re-establish the tcp connection for a few minutes but partially fails to reconnect to one of the two servers at the remote end.. </div><div><br></div><div>I have also got bandwidth/snmp monitoring going into Cacti on the same hosts and i do not see any issues with max bandwidth usage (infact its not showing much usage until the tunnel drops at around 9am (pictured)</div><div><img class="graphimage" id="graph_18" src="http://52.17.104.250/cacti/graph_image.php?action=view&local_graph_id=18&rra_id=5" border="0" alt="aws-dev-p-vpn-p - Traffic - eth0"></div><div>However since I modified the phase2 SA lifetime issue yesterday (supposedly) the problem has still remained and I'm really none the wiser about how to fix this. I've attached the logs from today's vpn drop (at 08:01 UTC/ 9:01 BST) Is there anything else i can do to identify whats causing the issue ? </div><div><br></div><div><span style="line-height: 1.5;">Our third party who administer the Cisco Asa, are going to email me screen shots of the tunnel configs because they have around 50 third party tunnels in place.</span></div><div><br></div><div>Thanks very much in advance.</div><div><br></div><div>##### ipsec status ####</div><div>
<p class="p1">000 </p>
<p class="p1">000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,1,64} trans={0,1,3072} attrs={0,1,2048} </p>
<p class="p1">000 </p>
<p class="p1">000 "idc-dr/1x1": 10.99.0.0/16===10.99.0.240[52.17.104.250]---10.99.0.1...10.99.0.1---198.202.190.103<198.202.190.103>===192.168.30.0/24; erouted; eroute owner: #42</p>
<p class="p1">000 "idc-dr/1x1": myip=10.99.0.240; hisip=unset;</p>
<p class="p1">000 "idc-dr/1x1": ike_life: 86400s; ipsec_life: 86400s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; force_encaps: yes </p>
<p class="p1">000 "idc-dr/1x1": policy: PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 16,24; interface: eth0; </p>
<p class="p1">000 "idc-dr/1x1": dpd: action:clear; delay:0; timeout:0; </p>
<p class="p1">000 "idc-dr/1x1": newest ISAKMP SA: #41; newest IPsec SA: #42; </p>
<p class="p1">000 "idc-dr/1x1": aliases: idc-dr </p>
<p class="p1">000 "idc-dr/1x1": IKE algorithm newest: 3DES_CBC_192-MD5-MODP1024</p>
<p class="p1">000 </p>
<p class="p1">000 #42: "idc-dr/1x1":4500 STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 71259s; newest IPSEC; eroute owner; isakmp#41; idle; import:admin initiate</p>
<p class="p1">000 #42: "idc-dr/1x1" esp.e947a46f@198.202.190.103 esp.f58e8811@10.99.0.240 tun.0@198.202.190.103 tun.0@10.99.0.240 ref=0 refhim=4294901761</p>
<p class="p1">000 #41: "idc-dr/1x1":4500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 71519s; newest ISAKMP; lastdpd=8761s(seq in:0 out:0); idle; import:admin initiate</p>
<p class="p1">000 </p>
<p class="p1">000 10.99.101.90/32:49059 -6-> 192.168.30.26/32:8200 => %hold 0 %acquire-netlink</p></div><div><br></div><div>####### CPU and RAm usage ######</div><div><br></div><div>
<p class="p1">root@ip-10-99-0-240:/var/log# cat /proc/cpuinfo |egrep "core|proc|Mhz"</p>
<p class="p1"><span class="s1"><b>proc</b></span>essor<span class="Apple-tab-span"> </span>: 0</p>
<p class="p1"><span class="s1"><b>core</b></span> id<span class="Apple-tab-span"> </span><span class="Apple-tab-span"> </span>: 0</p>
<p class="p1">cpu <span class="s1"><b>core</b></span>s<span class="Apple-tab-span"> </span>: 2</p>
<p class="p1"><span class="s1"><b>proc</b></span>essor<span class="Apple-tab-span"> </span>: 1</p>
<p class="p1"><span class="s1"><b>core</b></span> id<span class="Apple-tab-span"> </span><span class="Apple-tab-span"> </span>: 1</p>
<p class="p1">cpu <span class="s1"><b>core</b></span>s<span class="Apple-tab-span"> </span>: 2</p>
<p class="p1">root@ip-10-99-0-240:/var/log# free -h</p>
<p class="p1"> total used free shared buffers cached</p>
<p class="p1">Mem: 3.9G 1.2G 2.7G 6.2M 196M 685M</p>
<p class="p1">-/+ buffers/cache: 337M 3.5G</p>
<p class="p1">Swap: 0B 0B 0B</p></div><div><br></div><div>####### Our side. Amazon Ubuntu box, externally nat'd to a public IP.</div><div><br></div><div><br></div><div>
<p class="p1">config setup</p>
<p class="p1"><span class="Apple-tab-span"> </span>#interfaces=%defaultroute</p>
<p class="p1"><span class="Apple-tab-span"> </span>#</p>
<p class="p1"><span class="Apple-tab-span"> </span>plutodebug=all</p>
<p class="p1"><span class="Apple-tab-span"> </span># This is required for abrtd to work properly</p>
<p class="p1"><span class="Apple-tab-span"> </span># Note: incorrect SElinux policies might prevent pluto writing the core</p>
<p class="p1"><span class="Apple-tab-span"> </span>dumpdir=/var/run/pluto/</p>
<p class="p1"><span class="Apple-tab-span"> </span>#</p>
<p class="p1"><span class="Apple-tab-span"> </span># NAT-TRAVERSAL support, see README.NAT-Traversal</p>
<p class="p1"><span class="Apple-tab-span"> </span>nat_traversal=yes</p>
<p class="p1"><span class="Apple-tab-span"> </span># exclude networks used on server side by adding %v4:!a.b.c.0/24</p>
<p class="p1"><span class="Apple-tab-span"> </span># It seems that T-Mobile in the US and Rogers/Fido in Canada are</p>
<p class="p1"><span class="Apple-tab-span"> </span># using 25/8 as "private" address space on their 3G network.</p>
<p class="p1"><span class="Apple-tab-span"> </span># This range has not been announced via BGP (at least upto 2010-12-21)</p>
<p class="p1"><span class="Apple-tab-span"> </span>virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10</p>
<p class="p1"><span class="Apple-tab-span"> </span># OE is now off by default. Uncomment and change to on, to enable.</p>
<p class="p1"><span class="Apple-tab-span"> </span>#oe=off</p>
<p class="p1"><span class="Apple-tab-span"> </span># which IPsec stack to use. auto will try netkey, then klips then mast</p>
<p class="p1"><span class="Apple-tab-span"> </span>protostack=netkey</p>
<p class="p1"><span class="Apple-tab-span"> </span># Use this to log to a file, or disable logging on embedded systems (like openwrt)</p>
<p class="p1"><span class="Apple-tab-span"> </span>#plutostderrlog=/dev/null</p>
<p class="p2"><br></p>
<p class="p1"> force_keepalive=yes</p>
<p class="p2"><br></p>
<p class="p1"> keep_alive=60</p>
<p class="p1"><span class="Apple-tab-span"> </span>nhelpers=0</p>
<p class="p1"># Add connections here</p>
<p class="p2"><br></p>
<p class="p1">conn idc-dr</p>
<p class="p1"> type=tunnel</p>
<p class="p1"># connaddrfamily=ipv4</p>
<p class="p1"> authby=secret</p>
<p class="p1"> auto=start</p>
<p class="p1"> compress=no</p>
<p class="p1"># ike=3des-md5</p>
<p class="p1"># phase2alg=3des-md5</p>
<p class="p1"># phase2=esp</p>
<p class="p1"> ikelifetime=86400s</p>
<p class="p1"># keyexchange=ike</p>
<p class="p1"> keylife=28800s</p>
<p class="p1"> ## was## keylife=86400s</p>
<p class="p1"> keyingtries=%forever</p>
<p class="p1"> left=%defaultroute</p>
<p class="p1"> leftid=ex.tern.al.250</p>
<p class="p1"> leftsubnets=10.99.0.0/16</p>
<p class="p1"> leftsourceip=10.99.0.240</p>
<p class="p2"><br></p>
<p class="p1"> right=198.202.190.103</p>
<p class="p1"> rightsubnets=192.168.30.0/24</p>
<p class="p1"> rightid=198.202.190.103</p>
<p class="p1"> rightnexthop=%defaultroute</p>
<p class="p1"> forceencaps=yes</p>
<p class="p1"> pfs=no</p>
<p class="p2"><br></p></div></body></html>