I'm experiencing that my VPN connection drops dead after a few days, and does not manage to bring itself up again (which is what IPSec *should* do). It appears that the Pluto processes on each side get confused by not seeing the packet responses that they expect, or something to that effect. In other words, the two endpoints seem to get "out-of-sync" somehow.
When the connection actually is up and working, I get the message "main mode message is part of an unknown exchange" constantly reported in the logs. What does this mean? I suspect it has something to do with these problems.
As I have noted in other postings in this forum, I have configured several ASLASL connections between different locations, and they have all worked fine (using the same version).
By the way, these two networks are connected by means of an ADSL line, in case that matters.
Here's a snippet from the logs on both sides --
"Left" side:
Mar 18 19:20:50 shadowgate Pluto[22695]: "to-oslo_1" #83: max number of retransmissions (2) reached STATE_MAIN_R1
Mar 18 19:20:52 shadowgate Pluto[22695]: packet from 217.xx.xx.xx:500: Main Mode message is part of an unknown exchange
Mar 18 19:21:00 shadowgate Pluto[22695]: "to-oslo_1" #85: responding to Main Mode
Mar 18 19:21:02 shadowgate Pluto[22695]: packet from 217.xx.xx.xx:500: Main Mode message is part of an unknown exchange
Mar 18 19:21:22 shadowgate Pluto[22695]: packet from 217.xx.xx.xx:500: Main Mode message is part of an unknown exchange
Mar 18 19:21:30 shadowgate Pluto[22695]: "to-oslo_1" #84: max number of retransmissions (2) reached STATE_MAIN_R1
Mar 18 19:21:32 shadowgate Pluto[22695]: packet from 217.xx.xx.xx:500: Main Mode message is part of an unknown exchange
Mar 18 19:21:40 shadowgate Pluto[22695]: "to-oslo_1" #86: responding to Main Mode
Mar 18 19:21:41 shadowgate Pluto[22695]: packet from 217.xx.xx.xx:500: Main Mode message is part of an unknown exchange
Mar 18 19:24:41 shadowgate Pluto[22695]: packet from 217.xx.xx.xx:500: Main Mode message is part of an unknown exchange
Mar 18 19:24:50 shadowgate Pluto[22695]: "to-oslo_1" #89: max number of retransmissions (2) reached STATE_MAIN_R1
Mar 18 19:24:52 shadowgate Pluto[22355]: "to-oslo_1" #7: max number of retransmissions (20) reached STATE_MAIN_I1. No acceptable response to our first IKE message
"Right" side:
Mar 18 19:21:27 astaro-oslo Pluto[2205]: packet from 217.xx.x.xx:500: Main Mode message is part of an unknown exchange
Mar 18 19:21:29 astaro-oslo Pluto[2205]: "to-bergen_2" #778: responding to Main Mode
Mar 18 19:21:29 astaro-oslo Pluto[2205]: "dmz-inbound_1" #2: IPsec SA expired (LATEST!)
Mar 18 19:21:29 astaro-oslo Pluto[2205]: | no phase 1 state where one should be
Mar 18 19:21:29 astaro-oslo Pluto[2205]: | no phase 1 state where one should be
Mar 18 19:21:29 astaro-oslo Pluto[2205]: "to-bergen_2" #3: IPsec SA expired (LATEST!)
Mar 18 19:21:29 astaro-oslo Pluto[2205]: | no phase 1 state where one should be
Mar 18 19:21:29 astaro-oslo Pluto[2205]: | no phase 1 state where one should be
Mar 18 19:21:29 astaro-oslo Pluto[16882]: ERROR: pfkey write() of SADB_X_DELFLOW message 31 for flow %hold failed. Errno 14: Bad address
Mar 18 19:21:29 astaro-oslo Pluto[16882]: | 02 0f 00 0b 0e 00 00 00 1f 00 00 00 f2 41 00 00
Mar 18 19:21:29 astaro-oslo Pluto[16882]: | 03 00 15 00 00 00 00 00 02 00 00 00 0a c9 ff 03
Mar 18 19:21:29 astaro-oslo Pluto[16882]: | 00 20 00 00 01 00 00 00 03 00 16 00 00 00 00 00
Mar 18 19:21:29 astaro-oslo Pluto[16882]: | 02 00 00 00 0a 0a 90 fe 34 fb ff bf 00 00 00 00
Mar 18 19:21:29 astaro-oslo Pluto[16882]: | 03 00 17 00 00 00 00 00 02 00 00 00 ff ff ff ff
Mar 18 19:21:29 astaro-oslo Pluto[16882]: | 00 00 00 00 d8 7a 09 08 03 00 18 00 00 00 00 00
Mar 18 19:21:29 astaro-oslo Pluto[16882]: | 02 00 00 00 ff ff ff ff ac e6 ff bf ff ff ff ff
Mar 18 19:21:36 astaro-oslo Pluto[2205]: packet from 217.xx.x.xx:500: Main Mode message is part of an unknown exchange
Mar 18 19:21:46 astaro-oslo Pluto[2205]: packet from 217.xx.x.xx:500: Main Mode message is part of an unknown exchange
Mar 18 19:21:59 astaro-oslo Pluto[2205]: "to-bergen_2" #777: max number of retransmissions (2) reached STATE_MAIN_R1
Occasionally, the line also goes down with "no route to host" messages, indicating that some network error occured (although briefly). Shouldn't IPSec be able to reconnect even in such an event?
Mar 12 04:04:03 astaro-oslo Pluto[32748]: ERROR: asynchronous network error report on eth1 for message to 217.xx.x.xx port 500: compainant 217.xx.x.xx, errno 113 No route to host, origin ICMP type 11 code 0 (not authenticated)
Mar 12 07:17:51 astaro-oslo Pluto[32748]: "to-bergen_2" #5958: ERROR: asynchronous network error
report on eth1 for message to 217.xx.x.xx port 500: compainant 217.xx.xx.xx, errno 113 No route to host, origin ICMP type 3 code 1 (not authenticated)
As always, any help whatsoever is greatly appreciated.
Best regards,
// Martin
[ 04 April 2002: Message edited by: Martin Andersen ]
This thread was automatically locked due to age.
