[7.920][BUG][FIXED] No IPSEC Tunnel when IPS enable

If I disable IPS, the tunnel comes up directly, but if I enable IPS the tunnel goes later down and not reconnected.

[7.920]

Parents

0 kbr over 15 years ago

Can you please take a look at this thread and see if you have similar error messages in the ips.log file? I'd bet it's the same cause.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BPirro over 15 years ago in reply to kbr

no this not help, i have the same problem with new installed from iso !!

halt wait 2 min. and the IPSEC ist okay -> but we becomes this message

IPSEC Log
2010:06:03-17:49:46 mail pluto[5639]: | *received kernel message
2010:06:03-17:49:46 mail pluto[5639]: | next event EVENT_DPD in 16 seconds for #16
2010:06:03-17:49:46 mail pluto[5639]: |
2010:06:03-17:49:46 mail pluto[5639]: | *received kernel message
2010:06:03-17:49:46 mail pluto[5639]: | next event EVENT_DPD in 16 seconds for #16

IPS Log
2010:06:03-17:48:58 mail snort[10200]: DynamicPlugin: Rule [3:10161] not enabled in configuration, rule will not be used.
2010:06:03-17:48:58 mail snort[10200]:
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[detection-filter-config]------------------------------
2010:06:03-17:48:58 mail snort[10200]: | memory-cap : 1048576 bytes
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[detection-filter-rules]-------------------------------
2010:06:03-17:48:58 mail snort[10200]: -------------------------------------------------------------------------------
2010:06:03-17:48:58 mail snort[10200]:
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[rate-filter-config]-----------------------------------
2010:06:03-17:48:58 mail snort[10200]: | memory-cap : 1048576 bytes
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[rate-filter-rules]------------------------------------
2010:06:03-17:48:58 mail snort[10200]: | none
2010:06:03-17:48:58 mail snort[10200]: -------------------------------------------------------------------------------
2010:06:03-17:48:58 mail snort[10200]:
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[event-filter-config]----------------------------------
2010:06:03-17:48:58 mail snort[10200]: | memory-cap : 1048576 bytes
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[event-filter-global]----------------------------------
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[event-filter-local]-----------------------------------
2010:06:03-17:48:58 mail snort[10200]: | none
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[suppression]------------------------------------------
2010:06:03-17:48:58 mail snort[10200]: | none
2010:06:03-17:48:58 mail snort[10200]: -------------------------------------------------------------------------------
2010:06:03-17:48:58 mail snort[10200]: Rule application order: activation->dynamic->pass->drop->sdrop->reject->alert->log
2010:06:03-17:48:58 mail snort[10200]: Verifying Preprocessor Configurations!
2010:06:03-17:48:59 mail snort[10200]: Warning: 'ignore_any_rules' option for Stream5 UDP disabled because of UDP rule with flow or flowbits option
2010:06:03-17:48:59 mail snort[10200]: ICMP tracking disabled, no ICMP sessions allocated
2010:06:03-17:48:59 mail snort[10200]: Warning: flowbits key 'java_class_file.request' is set but not ever checked.
2010:06:03-17:48:59 mail snort[10200]: Warning: flowbits key 'lmageshack.request' is set but not ever checked.
2010:06:03-17:48:59 mail snort[10200]: 380 out of 512 flowbits in use.
2010:06:03-17:48:59 mail snort[10200]: Initializing daemon mode
2010:06:03-17:48:59 mail snort[10200]: Daemon parent exiting
2010:06:03-17:48:59 mail snort[10354]: Daemon initialized, signaled parent pid: 10200
2010:06:03-17:48:59 mail snort[10354]: Reload thread starting...
2010:06:03-17:48:59 mail snort[10354]: Reload thread started, thread 3040033680 (10354)
2010:06:03-17:48:59 mail snort[10354]: Checking PID path...
2010:06:03-17:48:59 mail snort[10354]: PID path stat checked out ok, PID path set to /var/run/
2010:06:03-17:48:59 mail snort[10354]: Writing PID "10354" to file "/var/run//snort_inline_1.pid"
2010:06:03-17:48:59 mail snort[10354]: Cannot set uid and gid when running Snort in inline mode.
2010:06:03-17:48:59 mail snort[10354]: Setting the Packet Processor to decode packets from iptables
2010:06:03-17:49:10 mail snort[10354]:
2010:06:03-17:49:10 mail snort[10354]: [ Port Based Pattern Matching Memory ]
2010:06:03-17:49:10 mail snort[10354]: +-[AC-BNFA Search Info Summary]------------------------------
2010:06:03-17:49:10 mail snort[10354]: | Instances : 863
2010:06:03-17:49:10 mail snort[10354]: | Patterns : 165563
2010:06:03-17:49:10 mail snort[10354]: | Pattern Chars : 1665963
2010:06:03-17:49:10 mail snort[10354]: | Num States : 1215162
2010:06:03-17:49:10 mail snort[10354]: | Num Match States : 168283
2010:06:03-17:49:10 mail snort[10354]: | Memory : 28.57Mbytes
2010:06:03-17:49:10 mail snort[10354]: | Patterns : 5.38M
2010:06:03-17:49:10 mail snort[10354]: | Match Lists : 8.37M
2010:06:03-17:49:10 mail snort[10354]: | Transitions : 14.62M
2010:06:03-17:49:10 mail snort[10354]: +-------------------------------------------------
2010:06:03-17:49:10 mail snort[10354]: [ Number of null byte prefixed patterns trimmed: 16054 ]
2010:06:03-17:49:10 mail snort[10354]:
2010:06:03-17:49:10 mail snort[10354]: --== Initialization Complete ==--
2010:06:03-17:49:10 mail snort[10354]: Snort initialization completed successfully (pid=10354)
2010:06:03-17:49:10 mail snort[10354]: Not Using PCAP_FRAMES
2010:06:03-17:49:10 mail snort[10354]: snort_nfq_open: using queue id 0
2010:06:03-17:49:10 mail snort[10354]: backend 'nfqueue' initialized
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 BPirro over 15 years ago in reply to kbr

no this not help, i have the same problem with new installed from iso !!

halt wait 2 min. and the IPSEC ist okay -> but we becomes this message

IPSEC Log
2010:06:03-17:49:46 mail pluto[5639]: | *received kernel message
2010:06:03-17:49:46 mail pluto[5639]: | next event EVENT_DPD in 16 seconds for #16
2010:06:03-17:49:46 mail pluto[5639]: |
2010:06:03-17:49:46 mail pluto[5639]: | *received kernel message
2010:06:03-17:49:46 mail pluto[5639]: | next event EVENT_DPD in 16 seconds for #16

IPS Log
2010:06:03-17:48:58 mail snort[10200]: DynamicPlugin: Rule [3:10161] not enabled in configuration, rule will not be used.
2010:06:03-17:48:58 mail snort[10200]:
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[detection-filter-config]------------------------------
2010:06:03-17:48:58 mail snort[10200]: | memory-cap : 1048576 bytes
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[detection-filter-rules]-------------------------------
2010:06:03-17:48:58 mail snort[10200]: -------------------------------------------------------------------------------
2010:06:03-17:48:58 mail snort[10200]:
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[rate-filter-config]-----------------------------------
2010:06:03-17:48:58 mail snort[10200]: | memory-cap : 1048576 bytes
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[rate-filter-rules]------------------------------------
2010:06:03-17:48:58 mail snort[10200]: | none
2010:06:03-17:48:58 mail snort[10200]: -------------------------------------------------------------------------------
2010:06:03-17:48:58 mail snort[10200]:
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[event-filter-config]----------------------------------
2010:06:03-17:48:58 mail snort[10200]: | memory-cap : 1048576 bytes
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[event-filter-global]----------------------------------
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[event-filter-local]-----------------------------------
2010:06:03-17:48:58 mail snort[10200]: | none
2010:06:03-17:48:58 mail snort[10200]: +-----------------------[suppression]------------------------------------------
2010:06:03-17:48:58 mail snort[10200]: | none
2010:06:03-17:48:58 mail snort[10200]: -------------------------------------------------------------------------------
2010:06:03-17:48:58 mail snort[10200]: Rule application order: activation->dynamic->pass->drop->sdrop->reject->alert->log
2010:06:03-17:48:58 mail snort[10200]: Verifying Preprocessor Configurations!
2010:06:03-17:48:59 mail snort[10200]: Warning: 'ignore_any_rules' option for Stream5 UDP disabled because of UDP rule with flow or flowbits option
2010:06:03-17:48:59 mail snort[10200]: ICMP tracking disabled, no ICMP sessions allocated
2010:06:03-17:48:59 mail snort[10200]: Warning: flowbits key 'java_class_file.request' is set but not ever checked.
2010:06:03-17:48:59 mail snort[10200]: Warning: flowbits key 'lmageshack.request' is set but not ever checked.
2010:06:03-17:48:59 mail snort[10200]: 380 out of 512 flowbits in use.
2010:06:03-17:48:59 mail snort[10200]: Initializing daemon mode
2010:06:03-17:48:59 mail snort[10200]: Daemon parent exiting
2010:06:03-17:48:59 mail snort[10354]: Daemon initialized, signaled parent pid: 10200
2010:06:03-17:48:59 mail snort[10354]: Reload thread starting...
2010:06:03-17:48:59 mail snort[10354]: Reload thread started, thread 3040033680 (10354)
2010:06:03-17:48:59 mail snort[10354]: Checking PID path...
2010:06:03-17:48:59 mail snort[10354]: PID path stat checked out ok, PID path set to /var/run/
2010:06:03-17:48:59 mail snort[10354]: Writing PID "10354" to file "/var/run//snort_inline_1.pid"
2010:06:03-17:48:59 mail snort[10354]: Cannot set uid and gid when running Snort in inline mode.
2010:06:03-17:48:59 mail snort[10354]: Setting the Packet Processor to decode packets from iptables
2010:06:03-17:49:10 mail snort[10354]:
2010:06:03-17:49:10 mail snort[10354]: [ Port Based Pattern Matching Memory ]
2010:06:03-17:49:10 mail snort[10354]: +-[AC-BNFA Search Info Summary]------------------------------
2010:06:03-17:49:10 mail snort[10354]: | Instances : 863
2010:06:03-17:49:10 mail snort[10354]: | Patterns : 165563
2010:06:03-17:49:10 mail snort[10354]: | Pattern Chars : 1665963
2010:06:03-17:49:10 mail snort[10354]: | Num States : 1215162
2010:06:03-17:49:10 mail snort[10354]: | Num Match States : 168283
2010:06:03-17:49:10 mail snort[10354]: | Memory : 28.57Mbytes
2010:06:03-17:49:10 mail snort[10354]: | Patterns : 5.38M
2010:06:03-17:49:10 mail snort[10354]: | Match Lists : 8.37M
2010:06:03-17:49:10 mail snort[10354]: | Transitions : 14.62M
2010:06:03-17:49:10 mail snort[10354]: +-------------------------------------------------
2010:06:03-17:49:10 mail snort[10354]: [ Number of null byte prefixed patterns trimmed: 16054 ]
2010:06:03-17:49:10 mail snort[10354]:
2010:06:03-17:49:10 mail snort[10354]: --== Initialization Complete ==--
2010:06:03-17:49:10 mail snort[10354]: Snort initialization completed successfully (pid=10354)
2010:06:03-17:49:10 mail snort[10354]: Not Using PCAP_FRAMES
2010:06:03-17:49:10 mail snort[10354]: snort_nfq_open: using queue id 0
2010:06:03-17:49:10 mail snort[10354]: backend 'nfqueue' initialized
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 UrsWeiss over 15 years ago in reply to BPirro

IPv6 Tunnel Broker does not work either after update when IPS is enabled.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 15 years ago in reply to BPirro

... halt wait 2 min. and the IPSEC ist okay ...

So after you installed a fresh 7.920 it works again?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 15 years ago in reply to UrsWeiss

IPv6 Tunnel Broker does not work either after update when IPS is enabled.

Up2date or fresh install?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 UrsWeiss over 15 years ago in reply to kbr

IPv6 Tunnel Broker does not work either after update when IPS is enabled.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

[7.920][BUG][FIXED] No IPSEC Tunnel when IPS enable

Submitted a Tech Support Case lately from the Support Portal?