Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 1 subscriber
  • Views 1882 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSec won't work anymore after update from 8.103 to 8.201 on a ASG120

Robert Tausend
Hi there,

i have a problem with a ASG120 at customer site.
At home i have a Soft ASG in Clustermode with 3 Clusternodes.

I have 6 different IPSec tunnels, 5 are working without any problems, they are
connected to other Soft ASGs.

The tunnel from the ASG120 won't connect to my ASG anymore after the update from
8.103 to 8.201. 

In a TCP dump i can see, that the ASG120 tries to connect, get's answerpakets but after some exchange of pakets the ASG120 stops sending.

Any idea? Need any more informations?

Robert




Soft ASG:
10:11:37.650054 IP p4FCEDC24.dip.t-dialin.net.isakmp > firewall.isakmp: isakmp: phase 1 I ident
10:11:37.654129 IP firewall.isakmp > p4FCEDC24.dip.t-dialin.net.isakmp: isakmp: phase 1 R ident
10:11:38.687116 IP p4FCEDC24.dip.t-dialin.net.isakmp > firewall.isakmp: isakmp: phase 1 I ident
10:11:39.163274 IP firewall.isakmp > p4FCEDC24.dip.t-dialin.net.isakmp: isakmp: phase 1 R ident
10:11:49.533445 IP firewall.isakmp > p4FCEDC24.dip.t-dialin.net.isakmp: isakmp: phase 1 R ident
10:12:09.184740 IP firewall.isakmp > p4FCEDC24.dip.t-dialin.net.isakmp: isakmp: phase 1 R ident





ASG120
10:11:37.569023 IP firewall.isakmp > ppp-93-104-244-197.dynamic.mnet-online.de.isakmp: isakmp: phase 1 I ident
10:11:37.812053 IP ppp-93-104-244-197.dynamic.mnet-online.de.isakmp > firewall.isakmp: isakmp: phase 1 R ident
10:11:38.596723 IP firewall.isakmp > ppp-93-104-244-197.dynamic.mnet-online.de.isakmp: isakmp: phase 1 I ident
10:11:39.191112 IP ppp-93-104-244-197.dynamic.mnet-online.de.isakmp > firewall.isakmp: isakmp: phase 1 R ident
10:11:49.561565 IP ppp-93-104-244-197.dynamic.mnet-online.de.isakmp > firewall.isakmp: isakmp: phase 1 R ident
10:12:09.213093 IP ppp-93-104-244-197.dynamic.mnet-online.de.isakmp > firewall.isakmp: isakmp: phase 1 R ident



This thread was automatically locked due to age.
Parents
  • 0
    it seems to be a snort problem, after stoping and restarting snort, the tunnel was working. Seems that snort was blocking outgoing traffic on port 4500. Investigatet this whis the help from Heiko @ Astaro.

    After a reboot, the problem exists again. A exception-rule for the destinationIP did the trick for me at the moment.

    Best regards
    Robert
Reply
  • 0
    it seems to be a snort problem, after stoping and restarting snort, the tunnel was working. Seems that snort was blocking outgoing traffic on port 4500. Investigatet this whis the help from Heiko @ Astaro.

    After a reboot, the problem exists again. A exception-rule for the destinationIP did the trick for me at the moment.

    Best regards
    Robert
Children
No Data