I have noticed that my vpn site-to site ipsec tunnel is not coming up correctly.
For 1 tunnel i get some strange error and dont have a glue how to fix it.
received 364 bytes from ***xx:4500 on eth1
2013:05:16-11:45:35 proxy pluto[5633]: | ICOOKIE: 91 c6 ff 74 f8 f9 5e d3
2013:05:16-11:45:35 proxy pluto[5633]: | RCOOKIE: 95 72 a9 f7 81 8a 41 67
2013:05:16-11:45:35 proxy pluto[5633]: | peer: 54 6a ca df
2013:05:16-11:45:35 proxy pluto[5633]: | state hash entry 25
2013:05:16-11:45:35 proxy pluto[5633]: | state object #5 found, in STATE_QUICK_I1
2013:05:16-11:45:35 proxy pluto[5633]: | kernel_alg_esp_enc_ok(12,128): alg_id=12, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
2013:05:16-11:45:35 proxy pluto[5633]: | our client is subnet 192.168.14.0/24 (Local Net on ASG1)
2013:05:16-11:45:35 proxy pluto[5633]: | our client protocol/port is 0/0
2013:05:16-11:45:35 proxy pluto[5633]: | peer client is subnet 192.168.10.0/24 (Remote Net on ASG 2)
2013:05:16-11:45:35 proxy pluto[5633]: | peer client protocol/port is 0/0
2013:05:16-11:45:35 proxy pluto[5633]: | kernel_alg_esp_enc_keylen(): alg_id=12, keylen=16
2013:05:16-11:45:35 proxy pluto[5633]: | kernel_alg_esp_auth_keylen(auth=1, sadb_aalg=2): a_keylen=16
2013:05:16-11:45:35 proxy pluto[5633]: | install_ipsec_sas() for #5: inbound and outbound
2013:05:16-11:45:35 proxy pluto[5633]: | route owner of "S_ASG-home" unrouted: "X_ASG-home" prospective erouted; eroute owner: "X_ASG-home" prospective erouted
2013:05:16-11:45:35 proxy pluto[5633]: "S_ASG-home" #5: cannot route -- route already in use for "X_ASG-home"
2013:05:16-11:45:35 proxy pluto[5633]: | state transition function for STATE_QUICK_I1 had internal error
2013:05:16-11:45:35 proxy pluto[5633]: | next event EVENT_RETRANSMIT in 20 seconds for #5
Where do i find the route 'X_ASG-home' which seems to be using my routing for the failed subnet ??
I have only 1 IPSEC tunnel configured, on ASG set to respond only.
It have been working for a long time but as far as i can recall it stopped working since the last update.
This thread was automatically locked due to age.