On 2009-12-11 20.23, "Mike Tancsa" <m...@sentex.net> wrote:
> At 11:33 AM 12/11/2009, David DeSimone wrote:
>> Jon Otterholm <jon.otterh...@ide.resurscentrum.se> wrote:
>>>
>>> If I restart racoon or wait approximately 30 min the connection is
>>> re-established.
>>
>> Since this is approximately ½of the phase 2 lifetime, you are probably
>> running into lifetime negotiation issues, or PFS issues.
>>
>>> What would be the obvious way to debug this? Any suggestions on what
>>> to tweak appreciated.
>>
>> I would turn up the debugging on racoon to get more information around
>> the time that the tunnel fails.
>>
>>> sainfo (address 192.168.1.0/24 any address 192.168.100.0/24 any)
>>> {
>>> pfs_group 1;
>>> lifetime time 3600 sec;
>>> encryption_algorithm des;
>>> authentication_algorithm hmac_md5,hmac_sha1;
>>> compression_algorithm deflate;
>>> }
>>
>> My hunch is that you have a PFS mismatch, so that the first tunnel
>> negotiates, but the second SA negotiation fails, then the third
>> succeeds, etc.
>
>
> You might also want to turn on DPD (dead peer
> detection) in ipsectools if you dont already have
> it on both sides. Are you really using des for
> the crypto ? Also, when the session is
> negotiated, take a look at the output of
> setkey -D
> and see what was actually negotiated and post it
> here (just make sure you get rid of the info on the E and A lines.
>
> e.g.
> 1.1.1.2 2.2.2.2
> esp mode=tunnel spi=125444787(0x077a22b3) reqid=16416(0x00004020)
> E: 3des-cbc 770cdd7b 770cdd7b 770cdd7b 770cdd7b 770cdd7b 770cdd7b
> A: hmac-sha1 5cfdbabb 5cfdbabb 5cfdbabb 5cfdbabb 5cfdbabb
>
> ie. mask out the 5cfdbabb and 770cdd7b values
> before posting as thats your crypto :)
>
>
>
> Also, when things "jam up", try instead,
>
> racoonctl vpn-disconnect <remote peer's IP>
>
> and you wont have to restart things.
>
> Also, what does
> sysctl net.key.preferred_oldsa
>
> show ?
It has not jamed up yet but here is output from sysctl:
net.key.preferred_oldsa: 1
Would it help setting it to 0 to force renewal of keys at reconnection?
//Jon
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
