Hello ,
the problem I have is that the VPN die when the SA lifetime is over and there is no traffic on the line. If there is traffic (ping -n 10000) the VPN tunnel is rebuilt.
We are using PSK and a SA lifetime for the IKE is 169 seconds and for the IPSec is 197 seconds. To me it seems also that the IPSec lifetime must be greater than the IKE lifetime, otherwise the connection isn’t rebuilt even there is traffic. Bug or feature or am I wrong?
Why doesn't the Astaro rebuilt automatically the connection when there is traffic again and the connection is down ?
Here is a piece from the log file:
20:50:19 (none) pluto[5741]: "1" #113: ISAKMP SA expired (LATEST!)
20:50:49 (none) pluto[5741]: "1" #114: IPsec SA expired (LATEST!)
20:50:50 (none) pluto[5741]: "1" #115: initiating Main Mode
20:50:51 (none) pluto[5741]: "1" #115: ignoring Vendor ID payload [XAUTH]
20:50:51 (none) pluto[5741]: "1" #115: received Vendor ID payload [Dead Peer Detection]
20:50:51 (none) pluto[5741]: "1" #115: ignoring Vendor ID payload [Cisco-Unity]
20:50:51 (none) pluto[5741]: "1" #115: ignoring Vendor ID payload [17300726ad0f2446...]
20:50:51 (none) pluto[5741]: "1" #115: Main mode peer ID is ID_IPV4_ADDR: '10.10.10.253'
20:50:51 (none) pluto[5741]: "1" #115: ISAKMP SA established
20:50:51 (none) pluto[5741]: "1" #116: initiating Quick Mode PSK+ENCRYPT+TUNNEL
20:50:51 (none) pluto[5741]: "1" #116: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
20:50:51 (none) pluto[5741]: "1" #116: sent QI2, IPsec SA established
20:51:25 (none) pluto[5741]: "1" #115: ignoring Delete SA payload: IPSEC SA not found (maybe expired)
20:51:25 (none) pluto[5741]: "1" #115: received and ignored informational message
20:53:38 (none) pluto[5741]: "1" #115: ISAKMP SA expired (LATEST!)
20:53:38 (none) pluto[5741]: packet from 10.10.10.253:500: Informational Exchange is for an unknown (expired?) SA
20:53:40 (none) pluto[5741]: packet from 10.10.10.253:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
20:53:40 (none) pluto[5741]: packet from 10.10.10.253:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
20:53:40 (none) pluto[5741]: "1" #117: responding to Main Mode
20:53:41 (none) pluto[5741]: "1" #117: ignoring Vendor ID payload [XAUTH]
20:53:41 (none) pluto[5741]: "1" #117: received Vendor ID payload [Dead Peer Detection]
20:53:41 (none) pluto[5741]: "1" #117: ignoring Vendor ID payload [Cisco-Unity]
20:53:41 (none) pluto[5741]: "1" #117: ignoring Vendor ID payload [9246631000cd5d74...]
20:53:41 (none) pluto[5741]: "1" #117: Main mode peer ID is ID_IPV4_ADDR: '10.10.10.253'
20:53:41 (none) pluto[5741]: "1" #117: sent MR3, ISAKMP SA established
20:53:41 (none) pluto[5741]: "1" #118: responding to Quick Mode
20:53:41 (none) pluto[5741]: "1" #118: IPsec SA established
20:54:07 (none) pluto[5741]: "1" #117: received Delete SA payload: deleting IPSEC State #116
20:54:07 (none) pluto[5741]: "1" #117: received and ignored informational message
20:56:28 (none) pluto[5741]: "1" #117: ISAKMP SA expired (LATEST!)
The connect isn’t rebuilt again.
Has anybody an idea. Thank you !
Regards
Thor
This thread was automatically locked due to age.