[Openswan Users] RE : help with ipsec + zywall
reza
issanyr at olympecti.fr
Wed Jun 10 02:26:07 EDT 2009
Ok, I have the problem right now.
The tunnel seems to be down on the vpn box side :
000 stats db_ops.c: {curr_cnt, total_cnt, maxsz} :context={0,1409,36} trans={0,1409,540} attrs={0,1409,360}
000
000 "techvar": 192.168.2.0/24===xxxx...xxxx===192.168.1.0/24; erouted HOLD; eroute owner: #0
000 "techvar": srcip=unset; dstip=unset; srcup=ipsec _updown; dstup=ipsec _updown;
000 "techvar": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 1
000 "techvar": policy: PSK+ENCRYPT+COMPRESS+TUNNEL+PFS; prio: 24,24; interface: eth1; encap: esp;
000 "techvar": newest ISAKMP SA: #0; newest IPsec SA: #0;
000 "techvar": ESP algorithms wanted: 3DES(3)_000-MD5(1); flags=strict
000 "techvar": ESP algorithms loaded: 3DES(3)_000-MD5(1); flags=strict
000
000 #2822: "techvar":500 STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT in 5s; lastdpd=-1s(seq in:0 out:0)
000 #2824: "techvar":500 STATE_QUICK_I1 (sent QI1, expecting QR1); EVENT_RETRANSMIT in 35s; lastdpd=-1s(seq in:0 out:0)
un 10 08:08:47 zola pluto[3014]: initiate on demand from 192.168.2.1:0 to 192.168.1.1:0 proto=0 state: fos_start because: acquire
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: initiating Main Mode
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: received Vendor ID payload [Dead Peer Detection]
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: ignoring unknown Vendor ID payload [625027749d5ab97f5616c1602765cf480a3b7d0b]
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: STATE_MAIN_I2: sent MI2, expecting MR2
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: I did not send a certificate because I do not have one.
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: STATE_MAIN_I3: sent MI3, expecting MR3
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: Main mode peer ID is ID_IPV4_ADDR: 'xxxxxxxxx'
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2824: initiating Quick Mode PSK+ENCRYPT+COMPRESS+TUNNEL+PFS {using isakmp#2823}
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: ignoring informational payload, type NO_PROPOSAL_CHOSEN
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: received and ignored informational message
Jun 10 08:08:47 zola pluto[3014]: "techvar" #2823: received Delete SA payload: deleting ISAKMP State #2823
Jun 10 08:08:47 zola pluto[3014]: packet from xxxxxxxxx:500: received and ignored informational message
Jun 10 08:08:57 zola pluto[3014]: "techvar" #2820: max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal
On the router side the logs tell that "[SA] No proposal chosen", but in the vpn state, I can see that the vpn is connected.
I have to disconnect using the hangup button to re-build the tunnel :
000 #2826: "techvar":500 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 28526s; newest IPSEC; eroute owner
000 #2826: "techvar" esp.540ef5ea at xxxxx esp.23f623e6 at xxxx tun.0 at 217.128.239.227 tun.0 at xxxxxx
000 #2825: "techvar":500 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 3325s; newest ISAKMP; lastdpd=-1s(seq in:0 out:0)
root at xxx /etc > ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=254 time=38.4 ms
In the router config, I have :
---------- IKE Setup ----------
Authentication Method: Pre-Shared Key
Phase 1 - Negotiation Mode= Main
Authentication= preShareKey
Key= xxxxxxxxxx
Encryption Algorithm= 3DES Authentication Algorithm= MD5
SA Life Time (Seconds)= 86400 Key Group= DH2
ras> ipsec ipsecDisplay 1
---------- IPSec Setup ----------
Index #= 1 Active= Yes Multi Pro = No Protocol= 0 Global SW= 0xA
Bound IKE 1 NailUp = Yes Netbios = No Name= vpn
ControlPing = No LogControlPing = No Control ping address = 0.0.0.0
Local: Addr Type= SUBNET Port Start= 0 End= N/A
IP Addr Start= 192.168.1.0 Mask= 255.255.255.0
Remote: Addr Type= SUBNET Port Start= 0 End= N/A
IP Addr Start= 192.168.2.0 Mask= 255.255.255.0
Enable Replay Detection= Yes Key Management= IKE
Phase 2 - Active Protocol= ESP
Encryption Algorithm= 3DES Authentication Algorithm= MD5
SA Life Time (Seconds)= 86400
Encapsulation= Tunnel Perfect Forward Secrecy (PFS)= DH2
Any idea ?
---
Reza ISSANY
Ingénieur Système
ZA Les Playes - Jean Monnet Sud
Avenue de Lisbonne
83500 La Seyne sur Mer
-------- Message d'origine--------
De: Paul Wouters [mailto:paul at xelerance.com]
Date: mer. 6/10/2009 02:45
À: reza
Cc: users at openswan.org
Objet : Re: [Openswan Users] help with ipsec + zywall
On Tue, 9 Jun 2009, reza wrote:
> I can get workinf the tunnel, but periodically (randomly), the tunnel
> crashes.
>
> When I verify the status of this vpn connection, I can see that the
> tunnel is established,
Is the tunnel still established on both ends?
> but there is no traffic. I have to down my connection, hangup the zywall
> side (bouton hangup in admin panel),
You can try enabling dpd.
Without logs from the end that hangs up, there is nothing much we can tell
you.
Paul
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20090610/9e92b23a/attachment-0001.html
More information about the Users
mailing list