hi all, i have problem with ipsec tunnel between obsd 3.8 and cisco pix 506, ios 6.3.1 - tunnel is stable, for example for 1 or 2 days, after this period, tunnel is down for 1 hour or more, this time is accidental :-(, new operation is automatic, without manual check
same configuration i had on obsd 3.1 with same pix, without problem can you help me with this problem please ? bellow are relevant (i think) debug and cfg: thank you regards lukas obsd: [General] Retransmits = 3 Exchange-max-time = 30 Check-interval = 60 Default-phase-1-lifetime = 3600,60:86400 Default-phase-2-lifetime = 1200,60:86400 [Default-main-mode] DOI= IPSEC EXCHANGE_TYPE= ID_PROT Transforms= 3DES-SHA [Default-quick-mode] DOI = IPSEC EXCHANGE_TYPE = QUICK_MODE Suites = QM-ESP-3DES-SHA-PFS-SUITE [3DES-SHA] ENCRYPTION_ALGORITHM = 3DES_CBC ENCAPSULATION_MODE = TUNNEL HASH_ALGORITHM = SHA AUTHENTICATION_METHOD = PRE_SHARED GROUP_DESCRIPTION = MODP_1024 [QM-ESP-3DES-SHA-PFS-SUITE] Protocols = QM-ESP-3DES-SHA-PFS pix: tunnel policy: esp-3des-sha sa lifetime: 4608000K and 8 hours enable PFS, DH group 2 ike: 3des-sha DH group 2, lifetime 3600s keep alive: 1200s nat t: enable, keep alive: 20s obsd debug without active tunnel: May 11 08:06:34 bart isakmpd[12443]: exchange_setup_p1: icookie ab5a28c03d618c97 rcookie 79d55bd4c0ec5334 May 11 08:06:34 bart isakmpd[12443]: exchange_setup_p1: msgid 00000000 May 11 08:06:34 bart isakmpd[12443]: message_parse_payloads: offset 40 payload PROPOSAL May 11 08:06:34 bart isakmpd[12443]: message_parse_payloads: offset 48 payload TRANSFORM May 11 08:06:34 bart isakmpd[12443]: Transform 1's attributes May 11 08:06:34 bart isakmpd[12443]: Attribute ENCRYPTION_ALGORITHM value 5 May 11 08:06:34 bart isakmpd[12443]: Attribute HASH_ALGORITHM value 2 May 11 08:06:34 bart isakmpd[12443]: Attribute GROUP_DESCRIPTION value 2 May 11 08:06:34 bart isakmpd[12443]: Attribute AUTHENTICATION_METHOD value 1 May 11 08:06:34 bart isakmpd[12443]: Attribute LIFE_TYPE value 1 May 11 08:06:34 bart isakmpd[12443]: Attribute LIFE_DURATION value 3600 May 11 08:06:34 bart isakmpd[12443]: ipsec_responder: phase 1 exchange 2 step 0 May 11 08:06:34 bart isakmpd[12443]: message_negotiate_sa: transform 1 proto 1 proposal 1 ok May 11 08:06:34 bart isakmpd[12443]: ike_phase_1_validate_prop: failure May 11 08:06:34 bart isakmpd[12443]: message_negotiate_sa: proposal 1 failed May 11 08:06:34 bart isakmpd[12443]: message_negotiate_sa: no compatible proposal found May 11 08:06:34 bart isakmpd[12443]: dropped message from remote ip port 500 due to notification type NO_PROPOSAL_CHOSEN tcpdump: 10:59:29.317686 remote ip.500 > my ip.500: [udp sum ok] isakmp v1.0 exchange ID_PROT cookie: ab5a28c047f60374->0000000000000000 msgid: 00000000 len: 120 payload: SA len: 52 DOI: 1(IPSEC) situation: IDENTITY_ONLY payload: PROPOSAL len: 40 proposal: 1 proto: ISAKMP spisz: 0 xforms: 1 payload: TRANSFORM len: 32 transform: 1 ID: ISAKMP attribute ENCRYPTION_ALGORITHM = 3DES_CBC attribute HASH_ALGORITHM = SHA attribute GROUP_DESCRIPTION = MODP_1024 attribute AUTHENTICATION_METHOD = PRE_SHARED attribute LIFE_TYPE = SECONDS attribute LIFE_DURATION = 3600 payload: VENDOR len: 20 (supports v3 NAT-T, draft-ietf-ipsec-nat-t-ike-03) payload: VENDOR len: 20 (supports v2 NAT-T, draft-ietf-ipsec-nat-t-ike-02) (ttl 239, id 35366, len 148) 10:59:29.319114 my ip.500 > remote ip.500: [udp sum ok] isakmp v1.0 exchange INFO cookie: 62c104f0b13012b5->0000000000000000 msgid: 00000000 len: 40 payload: NOTIFICATION len: 12 notification: NO PROPOSAL CHOSEN (ttl 64, id 51632, len 68) obsd debug with active tunnel: May 11 08:07:15 bart isakmpd[12443]: message_free: freeing 0x7e1bd200 May 11 08:07:16 bart isakmpd[12443]: virtual_clone: old 0x876caac0 new 0x7c79dc00 (main is 0x7c79de00) May 11 08:07:16 bart isakmpd[12443]: message_free: freeing 0x7e1bd100 May 11 08:07:16 bart isakmpd[12443]: timer_remove_event: removing event message_send_expire(0x7e1bd100) May 11 08:07:16 bart isakmpd[12443]: message_parse_payloads: offset 28 payload SA May 11 08:07:16 bart isakmpd[12443]: message_parse_payloads: offset 40 payload PROPOSAL May 11 08:07:16 bart isakmpd[12443]: message_parse_payloads: offset 48 payload TRANSFORM May 11 08:07:16 bart isakmpd[12443]: Transform 1's attributes May 11 08:07:16 bart isakmpd[12443]: Attribute ENCRYPTION_ALGORITHM value 5 May 11 08:07:16 bart isakmpd[12443]: Attribute HASH_ALGORITHM value 2 May 11 08:07:16 bart isakmpd[12443]: Attribute GROUP_DESCRIPTION value 2 May 11 08:07:16 bart isakmpd[12443]: Attribute AUTHENTICATION_METHOD value 1 May 11 08:07:16 bart isakmpd[12443]: Attribute LIFE_TYPE value 1 May 11 08:07:16 bart isakmpd[12443]: Attribute LIFE_DURATION value 3600 May 11 08:07:16 bart isakmpd[12443]: message_negotiate_sa: transform 1 proto 1 proposal 1 ok May 11 08:07:16 bart isakmpd[12443]: ike_phase_1_validate_prop: success May 11 08:07:16 bart isakmpd[12443]: message_negotiate_sa: proposal 1 succeeded May 11 08:07:16 bart isakmpd[12443]: ipsec_decode_transform: transform 1 chosen May 11 08:07:16 bart isakmpd[12443]: exchange_run: exchange 0x7e639d00 finished step 1, advancing... May 11 08:07:16 bart isakmpd[12443]: exchange_run: exchange 0x7e639d00 finished step 2, advancing...