Hi,
I have a Problem with a Site-to-Site IPsec vpn betwen Sophos UTM 9.315-2 (SG230) and an Bintec VPN Access 25.
The Tunnel comes up and is working for 1-2 hours. After this time no more packest are going through the tunnel.
The Tunnel State in webadmin is UP and running. Restarting the Bintec Router does not help. The Problem is solved, when I change something in the Sophos VPN Config e.g. enable strict routing, - save an three seconds later the packets are going through the tunnel.
After 2 hours the same problem occurs again, I disable strict routing, three seconds later the packets go through the tunnel again.
The Sophos is using static IP-Addresses the Bintec uses a dynamic Address with dyndns
I checked the Proposals and Lifetime Policys on both systems (IKE phase1 and IKE Phase2)
knows anybody these symptoms?
Because the Tunnel is working for some time i didn't post the settings. If necessary I could do this.
Thanks! Duffix
***edit***
It happend a few Minutes ago:
2015:10:15-17:52:59 moogda2 pluto[24424]: ERROR: asynchronous network error report on eth5 for message to 87.157.xx.xx port 500, complainant 87.157.xx.xx: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
2015:10:15-18:41:30 moogda2 pluto[24424]: ERROR: asynchronous network error report on eth5 for message to 87.157.xx.xx port 500, complainant 87.157.xx.xx Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
No more packets went through...
I changed ECN settings (enabled) in Object RemoteGateway. One second later the following logs appaeared
2015:10:15-19:23:03 moogda2 pluto[24424]: listening for IKE messages
2015:10:15-19:23:03 moogda2 pluto[24424]: forgetting secrets
2015:10:15-19:23:03 moogda2 pluto[24424]: loading secrets from "/etc/ipsec.secrets"
2015:10:15-19:23:03 moogda2 pluto[24424]: loaded PSK secret for 213.157.xx.xx ***x.dyndns.info
2015:10:15-19:23:03 moogda2 pluto[24424]: loaded private key from 'WebAdmin certificate for sophossg230.pem'
2015:10:15-19:23:03 moogda2 pluto[24424]: loaded PSK secret for 213.157.xx.xx %any
2015:10:15-19:23:03 moogda2 pluto[24424]: loaded PSK secret for 213.157.xx.xx moogdres.dyndns.info
2015:10:15-19:23:03 moogda2 pluto[24424]: forgetting secrets
2015:10:15-19:23:03 moogda2 pluto[24424]: loading secrets from "/etc/ipsec.secrets"
2015:10:15-19:23:03 moogda2 pluto[24424]: loaded PSK secret for 213.157.xx.xx ***x.dyndns.info
2015:10:15-19:23:03 moogda2 pluto[24424]: loaded private key from 'WebAdmin certificate for sophossg230.pem'
2015:10:15-19:23:03 moogda2 pluto[24424]: loaded PSK secret for 213.157.xx.xx %any
2015:10:15-19:23:03 moogda2 pluto[24424]: loaded PSK secret for 213.157.xx.xx moogdres.dyndns.info
2015:10:15-19:23:03 moogda2 pluto[24424]: loading ca certificates from '/etc/ipsec.d/cacerts'
2015:10:15-19:23:03 moogda2 pluto[24424]: loaded ca certificate from '/etc/ipsec.d/cacerts/VPN Signing CA.pem'
2015:10:15-19:23:03 moogda2 pluto[24424]: loading aa certificates from '/etc/ipsec.d/aacerts'
2015:10:15-19:23:03 moogda2 pluto[24424]: loading ocsp certificates from '/etc/ipsec.d/ocspcerts'
2015:10:15-19:23:03 moogda2 pluto[24424]: loading attribute certificates from '/etc/ipsec.d/acerts'
2015:10:15-19:23:03 moogda2 pluto[24424]: Changing to directory '/etc/ipsec.d/crls'
2015:10:15-19:23:03 moogda2 ipsec_starter[11535]: no default route - cannot cope with %defaultroute!!!
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x": deleting connection
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #73: deleting state (STATE_QUICK_R2)
2015:10:15-19:23:03 moogda2 pluto[24424]: id="2204" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN down" variant="ipsec" connection="DA-F***x" address="213.157.xx.xx" local_net="192.168.1.0/24" remote_net="192.168.2.0/24"
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #67: deleting state (STATE_MAIN_I4)
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #68: deleting state (STATE_MAIN_R3)
2015:10:15-19:23:03 moogda2 pluto[24424]: added connection description "S_DA-F***x"
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #76: initiating Main Mode
2015:10:15-19:23:03 moogda2 pluto[24424]: packet from 217.5.145.18:500: ignoring Vendor ID payload [0048e2270bea8395ed778d343cc2a076]
2015:10:15-19:23:03 moogda2 pluto[24424]: packet from 217.5.145.18:500: ignoring Vendor ID payload [5cbeb399eb835a7d7a2eb495905db061]
2015:10:15-19:23:03 moogda2 pluto[24424]: packet from 217.5.145.18:500: received Vendor ID payload [Dead Peer Detection]
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #77: responding to Main Mode
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #76: ignoring Vendor ID payload [0048e2270bea8395ed778d343cc2a076]
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #76: ignoring Vendor ID payload [5cbeb399eb835a7d7a2eb495905db061]
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #76: ignoring Vendor ID payload [810fa565f8ab14369105d706fbd57279]
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #76: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #76: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #76: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #76: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
2015:10:15-19:23:03 moogda2 pluto[24424]: "S_DA-F***x" #76: received Vendor ID payload [Dead Peer Detection]
2015:10:15-19:23:05 moogda2 pluto[24424]: "S_DA-F***x" #77: discarding duplicate packet; already STATE_MAIN_R2
2015:10:15-19:23:05 moogda2 pluto[24424]: "S_DA-F***x" #77: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2015:10:15-19:23:05 moogda2 pluto[24424]: "S_DA-F***x" #77: Peer ID is ID_FQDN: '***x.dyndns.info'
2015:10:15-19:23:05 moogda2 pluto[24424]: "S_DA-F***x" #77: Dead Peer Detection (RFC 3706) enabled
2015:10:15-19:23:05 moogda2 pluto[24424]: "S_DA-F***x" #77: sent MR3, ISAKMP SA established
2015:10:15-19:23:05 moogda2 pluto[24424]: "S_DA-F***x" #76: Peer ID is ID_FQDN: '***x.dyndns.info'
2015:10:15-19:23:05 moogda2 pluto[24424]: "S_DA-F***x" #76: Dead Peer Detection (RFC 3706) enabled
2015:10:15-19:23:05 moogda2 pluto[24424]: "S_DA-F***x" #76: ISAKMP SA established
2015:10:15-19:23:05 moogda2 pluto[24424]: "S_DA-F***x" #78: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP {using isakmp#76}
2015:10:15-19:23:06 moogda2 pluto[24424]: id="2203" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN up" variant="ipsec" connection="DA-F***x" address="213.157.xx.xx" local_net="192.168.1.0/24" remote_net="192.168.2.0/24"
2015:10:15-19:23:06 moogda2 pluto[24424]: "S_DA-F***x" #78: sent QI2, IPsec SA established {ESP=>0x143b2bac
This thread was automatically locked due to age.
