<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<!-- Template generated by Exclaimer Signature Manager Exchange Edition on 06:22:33 Wednesday, 26 August 2015 -->
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css">P.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
LI.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
DIV.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
TABLE.ImprintUniqueIDTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style><!-- Template generated by Exclaimer Signature Manager Exchange Edition on 06:22:33 Wednesday, 26 August 2015 --><style type="text/css">P.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
LI.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
DIV.ImprintUniqueID {
MARGIN: 0cm 0cm 0pt
}
TABLE.ImprintUniqueIDTable {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Latha;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#2F5496;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#2F5496;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#2F5496;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#2F5496">I have modified the config to set “rekey=no” based on feedback from lots of other threads, but this doesn’t help. I have requested for details at ASA to check the renegotiation policy at the other end.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">What would be the other possible reasons for continuous reset?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Prakash<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<div></div>
</div>
<br>
<a href="www.sdl.com/" target=""><img width="150" height="68" style="" src="http://dr0muzwhcp26z.cloudfront.net/static/corporate/SDL-logo-2014.png"></a><br>
www.sdl.com <br>
<br>
<table style="BORDER-COLLAPSE: collapse" class="ImprintUniqueIDTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
</tr>
</tbody>
</table>
<table style="BORDER-COLLAPSE: collapse" class="ImprintUniqueIDTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
</tbody>
</table>
<div class="WordSection1">
<div></div>
</div>
<br>
<table style="BORDER-COLLAPSE: collapse" class="ImprintUniqueIDTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td width="800"><font style="COLOR: #a1a1a1; FONT-SIZE: 8pt" size="+0">SDL PLC confidential, all rights reserved. If you are not the intended recipient of this mail SDL requests and requires that you delete it without acting upon or copying any of its contents,
and we further request that you advise us.<br>
<br>
SDL PLC is a public limited company registered in England and Wales. Registered number: 02675207.
<br>
Registered address: Globe House, Clivemont Road, Maidenhead, Berkshire SL6 7DY, UK.
</font></td>
</tr>
</tbody>
</table>
<br>
<div class="WordSection1">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Prakash Palanisamy <br>
<b>Sent:</b> Monday, August 24, 2015 4:54 PM<br>
<b>To:</b> 'users@lists.openswan.org' <users@lists.openswan.org><br>
<b>Subject:</b> Connection is getting reset every few seconds<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#2F5496">VPN connection between Linux Openswan U2.6.38 (Ubuntu EC2 instance in VPC with EIP) & Cisco ASA 5510 is getting reset every few seconds. Earlier today with the help of the community I solved the another problem
with “pending phase 2” issue and after that we see that the connection is being very flaky.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Other details about the setup can be found in my previous thread -
<a href="https://lists.openswan.org/pipermail/users/2015-August/023391.html">https://lists.openswan.org/pipermail/users/2015-August/023391.html</a>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="color:#2F5496">Auth logs:<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: initiating Main Mode<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: ignoring Vendor ID payload [Cisco IKE Fragmentation]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: STATE_MAIN_I2: sent MI2, expecting MR2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: received Vendor ID payload [Cisco-Unity]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: received Vendor ID payload [XAUTH]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: ignoring unknown Vendor ID payload [ec43b53de4bd9e2ec73fcf4ea211143f]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: ignoring Vendor ID payload [Cisco VPN 3000 Series]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: STATE_MAIN_I3: sent MI3, expecting MR3<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: received Vendor ID payload [Dead Peer Detection]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: Main mode peer ID is ID_FQDN: '@Connection1-ASA.global.sdl.corp'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1536}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:b9dab225 proposal=AES(12)_256-SHA1(2)_160 pfsgroup=OAKLEY_GROUP_MODP1536}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: ignoring informational payload, type NO_PROPOSAL_CHOSEN msgid=00000000<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: received and ignored informational message<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: "Connection1/1x1" #1: received Delete SA payload: deleting ISAKMP State #1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:52 gateway3 pluto[31154]: packet from 87.213.46.220:500: received and ignored informational message<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: packet from 87.213.46.220:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but port floating is off<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: packet from 87.213.46.220:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but port floating is off<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: packet from 87.213.46.220:500: received Vendor ID payload [RFC 3947] meth=115, but port floating is off<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: packet from 87.213.46.220:500: ignoring Vendor ID payload [Cisco IKE Fragmentation]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: responding to Main Mode<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: Oakley Transform [OAKLEY_3DES_CBC (192), OAKLEY_SHA1, OAKLEY_GROUP_MODP1024] refused due to strict flag<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: Oakley Transform [OAKLEY_3DES_CBC (192), OAKLEY_MD5, OAKLEY_GROUP_MODP1024] refused due to strict flag<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: Oakley Transform [OAKLEY_AES_CBC (128), OAKLEY_SHA1, OAKLEY_GROUP_MODP1024] refused due to strict flag<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: Oakley Transform [OAKLEY_AES_CBC (128), OAKLEY_SHA1, OAKLEY_GROUP_MODP1024] refused due to strict flag<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: Oakley Transform [OAKLEY_AES_CBC (256), OAKLEY_SHA1, OAKLEY_GROUP_MODP1024] refused due to strict flag<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: STATE_MAIN_R1: sent MR1, expecting MI2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: received Vendor ID payload [Cisco-Unity]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: received Vendor ID payload [XAUTH]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: ignoring unknown Vendor ID payload [f7d4c0744bc4c632afa9ec7e85bf857b]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: ignoring Vendor ID payload [Cisco VPN 3000 Series]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: STATE_MAIN_R2: sent MR2, expecting MI3<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: received Vendor ID payload [Dead Peer Detection]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: Main mode peer ID is ID_FQDN: '@Connection1-ASA.global.sdl.corp'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1536}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #3: the peer proposed: 172.21.8.0/24:0/0 -> 10.100.0.0/16:0/0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: responding to Quick Mode proposal {msgid:b23b46bc}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: us: 172.21.8.0/24===172.21.8.43[52.17.237.123]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: them: 87.213.46.220<87.213.46.220>[@Connection1-ASA.global.sdl.corp]===10.100.0.0/16<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Aug 24 13:35:58 gateway3 pluto[31154]: "Connection1/1x1" #4: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x22ef875d <0x409dd686 xfrm=AES_256-HMAC_SHA1 NATOA=none NATD=none DPD=none}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Prakash<o:p></o:p></span></p>
</div>
<br><br>
<P align=center><FONT style="BACKGROUND-COLOR: #ffffff">This message has been scanned for malware by Websense. </FONT><A href="http://www.websense.com/"><FONT style="BACKGROUND-COLOR: #ffffff" color=#000000>www.websense.com</FONT></A></P>
</body>
</html>