i have a strange problem that i've been trying to solve for something abaout 5 evenings now:
we have an UTM 9.1 (9.111-7) as virtual Appliance on our Headquarter Side and Juniper (NS5GT and SSG5) Firewalls on the Remote Sites (6).
I'm able to establish an IPSec connection between the Remotegateways and the Headquarter. Traffic is going through everything is fine.
after some random time i have strange logs on both sides:
Juniper Side:
2014-04-17 07:51:40 info IKE 62.***.***.51 Phase 1: Retransmission limit has been reached.
2014-04-17 07:50:51 info Rejected an IKE packet on ethernet0/0 from 62.***.***.51:500 to 79.***.***.149:500 with cookies 008f5dfd20341c32 and 67e6dfcaaed49d53 because Phase 1 negotiations failed. (The preshared keys might not match.).
2014-04-17 07:50:51 info IKE 62.***.***.51 phase 1:The symmetric crypto key has been generated successfully.
2014-04-17 07:50:50 info IKE 62.***.***.51 Phase 1: Responder starts MAIN mode negotiations.
2014-04-17 07:50:29 info IKE 62.***.***.51 Phase 1: Retransmission limit has been reached.
2014-04-17 07:50:08 warn Admin user "root" logged in for Web(https) management (port 4444) from 10.10.9.53:49622
2014-04-17 07:50:08 info ADM: Local admin authentication successful for login name root
2014-04-17 07:49:51 info IKE 62.***.***.51 Phase 2 msg ID cf030969: Completed negotiations with SPI 535b61bf, tunnel ID 1, and lifetime 180 seconds/0 KB.
2014-04-17 07:49:51 notif Session (id 8012 src-ip 79.***.***.149 dst-ip 62.***.***.51 dst port 0) route is valid.
2014-04-17 07:49:51 info IKE 62.***.***.51 phase 2:The symmetric crypto key has been generated successfully.
2014-04-17 07:49:51 info IKE 62.***.***.51 Phase 2: Initiated negotiations.
2014-04-17 07:49:41 info Rejected an IKE packet on ethernet0/0 from 62.***.***.51:500 to 79.***.***.149:500 with cookies dd241d102f8254fc and 30bbe8c06a328aeb because Phase 1 negotiations failed. (The preshared keys might not match.).
2014-04-17 07:49:41 info IKE 62.***.***.51 phase 1:The symmetric crypto key has been generated successfully.
2014-04-17 07:49:40 info IKE 62.***.***.51 Phase 1: Responder starts MAIN mode negotiations.
2014-04-17 07:49:33 info IKE 62.***.***.51 Phase 1: Completed Main mode negotiations with a 200-second lifetime.
2014-04-17 07:49:33 info IKE 62.***.***.51 phase 1:The symmetric crypto key has been generated successfully.
2014-04-17 07:49:33 info IKE79.***.***.149 62.***.***.51 Phase 1: Initiated negotiations in main mode.
UTM Side:
starting keying attempt 24 of an unlimited number
2014:04:17-07:49:52 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8316: initiating Main Mode to replace #8305
2014:04:17-07:49:52 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8316: ignoring Vendor ID payload [e7a811cf8de6140e3adc82fd7855ff8ff1eadb8f000000130000061e]
2014:04:17-07:49:52 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8316: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2014:04:17-07:49:52 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8316: received Vendor ID payload [Dead Peer Detection]
2014:04:17-07:49:52 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8316: ignoring Vendor ID payload [HeartBeat Notify 386b0100]
2014:04:17-07:49:52 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8316: enabling possible NAT-traversal with method RFC 3947
2014:04:17-07:49:53 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8316: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: no NAT detected
2014:04:17-07:49:53 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8316: next payload type of ISAKMP Hash Payload has an unknown value: 144
2014:04:17-07:49:53 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8316: malformed payload in packet
2014:04:17-07:49:57 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8316: discarding duplicate packet; already STATE_MAIN_I3
2014:04:17-07:50:01 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8316: discarding duplicate packet; already STATE_MAIN_I3
2014:04:17-07:50:03 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8318: responding to Quick Mode
2014:04:17-07:50:03 mx pluto[4930]: "S_NGW13"[4] 79.***.***.149 #8318: IPsec SA established {ESP=>0x535b61bf
As you can see the tunnel gets reastablished in between.
I set the lifetime of Phase1 and Phase2 to a low value so i can test the rekeying progress. But that is fine.
The UTM is in respond only Mode. The Encryption mode ist set to a Juniper Standard:
(Phase1: Preshared Key - Group 2 - AES128 - SHA1)
(Phase 2: Group 2 - ESP - AES128 - SHA1)
NAT is enabled on both sides
DPD is enabled on both sides
Key Probing is enabled on UTM side...
any help would be appreciated.
thx
This thread was automatically locked due to age.
