Hi, I think I've been hit by this bug to (not with debian but opensuse) with the version 0.7.1. This seems fixed on version 0.7.3 (on opensuse too).
This issue could be due to the idle feature on cisco router, after some idle time the router sends a delete request for both the ISAKMP-SA and IPsec-SA. Racoon 0.7.1 delete the ISAKMP-sa as requested but not the IPsec-SA. At this point the cisco router has deleted its IPsec-sa so no outgoing packets can be decrypted by it. When the IPSec-sa expires on the linux machine, racoon renegotiate both isakmp-sa and ipsec-sa thus reenabling the tunnel. With 0.7.3 the outgoing ipsec-sa is deleted as requested, so this will trigger the renegotiation of both isakmp-sa and ipsec-sa. I'm not 100% sure this is the same bug I experienced but in the original logs we can see delete requests "seen nptype=12(delete)" and according to Till Kahle timmings the 30min values is the default idle timeout on IOS according to the documentation. Have a look at the discussion on ipsec-tools ML: http://sourceforge.net/mailarchive/forum.php?thread_name=20100825192817.1ce9d569%40valmar.bigon.be&forum_name=ipsec-tools-devel my 2ยข Cheers Laurent Bigonville -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
