I've visited a similar problem back in 2007 (old forum post) and it was never solved (the other party eventually changed VPN-vendor).
Today I'm back with "the same" problem. My Astaro (v7.510) is configured to connect to our customer using a Nortel box (Contivity 600 i believe it is). They told me Nortel doesn't differenciate between phase 1 and 2, so I've created them equal on my side, see attachment.
When I enable the tunnel, it comes up just fine, and everything works fine for 8 hours (28800 seconds) and then fails to reestablish.
IPSec establishment when I restart manually by disabling and reenabling the tunnel (IP/names removed):
2011:10:21-11:18:00 fwg10 pluto[4149]: "VPN-Description-Name-Removed" #1117551: responding to Main Mode
2011:10:21-11:18:01 fwg10 pluto[4149]: "VPN-Description-Name-Removed" #1117550: ignoring Vendor ID payload [424e455300000008]
2011:10:21-11:18:01 fwg10 pluto[4149]: "VPN-Description-Name-Removed" #1117550: received Vendor ID payload [Dead Peer Detection]
2011:10:21-11:18:02 fwg10 pluto[4149]: "VPN-Description-Name-Removed" #1117551: Peer ID is ID_IPV4_ADDR: '138.x.y.139'
2011:10:21-11:18:02 fwg10 pluto[4149]: "VPN-Description-Name-Removed" #1117551: sent MR3, ISAKMP SA established
2011:10:21-11:18:03 fwg10 pluto[4149]: "VPN-Description-Name-Removed" #1117552: responding to Quick Mode
2011:10:21-11:18:05 fwg10 pluto[4149]: "VPN-Description-Name-Removed" #1117550: Peer ID is ID_IPV4_ADDR: '138.x.y.139'
2011:10:21-11:18:05 fwg10 pluto[4149]: "VPN-Description-Name-Removed" #1117550: ISAKMP SA established
2011:10:21-11:18:05 fwg10 pluto[4149]: "VPN-Description-Name-Removed" #1117553: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP {using isakmp#1117550}
2011:10:21-11:18:05 fwg10 pluto[4149]: "VPN-Description-Name-Removed" #1117552: IPsec SA established {ESP=>0x00038615 0x001a6de6
One thing I've noticed in the ipsec log, I'm getting a "Delete SA, replace in 10 seconds" every 16 minutes or so:
2011:10:18-03:02:16 fwg10 pluto[4149]: "S_REF_SOnHMCivlh_0" #1098091: received Delete SA payload: replace IPSEC State #1099472 in 10 seconds
...
10 seconds later - 3 new loglines:
...
2011:10:18-03:02:26 fwg10 pluto[4149]: "S_REF_SOnHMCivlh_0" #1099517: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP to replace #1099472 {using isakmp#1098091}
2011:10:18-03:02:27 fwg10 pluto[4149]: "S_REF_SOnHMCivlh_0" #1099517: Dead Peer Detection (RFC 3706) enabled
2011:10:18-03:02:27 fwg10 pluto[4149]: "S_REF_SOnHMCivlh_0" #1099517: sent QI2, IPsec SA established {ESP=>0x0008e467
Anyone had problems with Nortel? And solved it?
This thread was automatically locked due to age.
