VPN perte tunnel deconnexion

par **grome** » 03 Oct 2005 14:09

Bonjour à tous

J'ai un petit soucis avec mes tunnels vpn. Ils tombent et ne sont pas remontés. Je suis en 1.4.8 sur tous les ipcops et j'ai fixé l'option "dead peer connection" à "restart". Je suis en ipfixe et en dynamique (dyndns)

J'ai lu dans le forum qu'il était conseillé d'installer le script vpn-watch dispo à cette adresse http://www.itechnology.de/front_content.php?idcat=87.

Est ce que c'est utile en considérant le fait que je suis en 1.4.8. L'option "restart" dans la config du tunnel devrait être suffisante non ?

merci d'avance

par **fa_** » 04 Oct 2005 22:46

Dans les nouveautés de la 1 4 9 il y a cela , qui te conviendra peut etre
"VPN users, check Dead Peer Detection action setting as it was wrongly changed during 1.4.7 upgrade 2005-10-03 Informations"

par **grome** » 05 Oct 2005 12:00

Merci beaucoup c'est installé. Je pensais pas qu'une 1.4.9 existait. La liste de mes mises à jour dispo ne se réactualise pas.

Je reposterai sur ce thread vendredi pour vous dire si mes problèmes sont résolus.

Merci encore

Jérôme

par **grome** » 07 Oct 2005 09:34

Bonjour

Mes tunnels continuent de tomber. je suis pourtant passé en 1.4.9, mais rien n'y fait. J'ai remarqué qu'il tombe sans coupures adsl. Au début je pensais que la coupure journalière de quelques secondes pouvait être responsable de la perte de mes tunnels. En fait il n'en est rien.

Par contre dans le journal du pare feu j'ai ceci :
Je me demande si ce n'est pas la source de mes problèmes.
Date: 10/07 08:09:16 Nom: (snort_decoder) WARNING: Not IPv4 datagram!
Priorité: n/a Type: n/a
Informations sur l'adresse IP: n/a:n/a -> n/a:n/a
Références: aucune entrée trouvée SID: n/a

Est ce que le patch vpn-watch est nécessaire sachant que je suis en 1.4.9 ? Est ce qu'il y a un autre moyen de maintenir les tunnels ?
J'ai trouvé des choses sur le forum mais vu l'antériorité des posts j'ai des doutes par rapport aux récentes mises à jour intervenus sur IPCOP:
http://forums.fr.ixus.net/viewtopic.php?t=27256&highlight=crontab+vpn
http://forums.fr.ixus.net/viewtopic.php?t=19028

merci

par **taxaw** » 09 Oct 2005 22:36

Bonsoir,
C'est sûr que la version 1.4.9 redémarre le vpn ?
Là j'ai un vpn entre une ip fixe et une dynamique en test pré-prod.
J'hésite à mettre le vpnwatch.
Ce serait vraiment intéressant si ipcop intégrait ce type de fonctionnalité pour le vpn.

par **grome** » 10 Oct 2005 08:26

Je suis dans le même type de config que toi.
Apparement le vpn-watch ne résoud pas tout.
Je vais attendre car je dois faire des tests complémentaires mais par la suite je crois
que je vais intégrer le script mentionné dans les posts précédents.

par **grome** » 13 Oct 2005 09:13

Bon avant d'installer quoi que ce soit voilà ce que j'ai dans mes journaux ipsec.
Juste pour info. J'ai deux tunnels donc 3 sites. Le site qui centralise a une connexion chez un fournisseur d'accès local. Les deux autres sites sont des connexsions free (une dégroupée l'autre non). Sur le site principal j'utilise dyndns.org pour le VPN. Avec un des deux site cela fonctionne très bien (dégroupé) avec l'autre je perd le tunnel.

Voilà un extrait du site qui fonctionne

Code: Tout sélectionner: 19:51:08 pluto[626] "vpntoto2" #96: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, ST=France, O=toto, OU=informatique, CN=217-XXX-XXX-XXX.monfai.fr' 19:51:08 pluto[626] "vpntoto2" #96: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 19:51:08 pluto[626] "vpntoto2" #96: NAT-Traversal: Result using RFC 3947: no NAT detected 19:51:08 pluto[626] "vpntoto2" #96: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 19:51:08 pluto[626] "vpntoto2" #96: received Vendor ID payload [Dead Peer Detection] 19:51:08 pluto[626] "vpntoto2" #96: received Vendor ID payload [RFC 3947] 19:51:08 pluto[626] "vpntoto2" #96: initiating Main Mode to replace #95 19:10:45 pluto[626] packet from 217.XXX.XXX.XXX:500: Informational Exchange is for an unknown (expired? ) SA 19:01:19 pluto[626] "vpntoto2" #95: ISAKMP SA established 19:01:19 pluto[626] "vpntoto2" #95: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 19:01:19 pluto[626] "vpntoto2" #95: Issuer CRL not found 19:01:19 pluto[626] "vpntoto2" #95: Issuer CRL not found 19:01:19 pluto[626] "vpntoto2" #95: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, ST=France, O=toto, OU=informatique, CN=217-XXX-XXX-XXX.monfai.fr' 19:01:19 pluto[626] "vpntoto2" #95: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 19:01:19 pluto[626] "vpntoto2" #95: NAT-Traversal: Result using RFC 3947: no NAT detected 19:01:19 pluto[626] "vpntoto2" #95: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 19:01:19 pluto[626] "vpntoto2" #95: received Vendor ID payload [Dead Peer Detection] 19:01:19 pluto[626] "vpntoto2" #95: received Vendor ID payload [RFC 3947] 19:01:19 pluto[626] "vpntoto2" #95: initiating Main Mode to replace #94 18:22:50 pluto[626] packet from 217.XXX.XXX.XXX:500: Informational Exchange is for an unknown (expired? ) SA 18:10:45 pluto[626] "vpntoto2" #94: ISAKMP SA established 18:10:45 pluto[626] "vpntoto2" #94: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 18:10:45 pluto[626] "vpntoto2" #94: Issuer CRL not found 18:10:45 pluto[626] "vpntoto2" #94: Issuer CRL not found 18:10:45 pluto[626] "vpntoto2" #94: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, ST=France, O=toto, OU=informatique, CN=217-XXX-XXX-XXX.monfai.fr' 18:10:44 pluto[626] "vpntoto2" #94: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 18:10:44 pluto[626] "vpntoto2" #94: NAT-Traversal: Result using RFC 3947: no NAT detected 18:10:44 pluto[626] "vpntoto2" #94: transition from state STATE_MAIN_

et un extrait du site avec lequel le tunnel tombe au bout d'un moment

Code: Tout sélectionner: 08:56:02 pluto[548] "vpntoto1" #77: max number of retransmissions (2) reached STATE_MAIN_I3. Possib le authentication failure: no acceptable response to our first encrypted message 08:55:22 pluto[548] "vpntoto1" #77: discarding duplicate packet; already STATE_MAIN_I3 08:55:02 pluto[548] "vpntoto1" #77: discarding duplicate packet; already STATE_MAIN_I3 08:54:52 pluto[548] "vpntoto1" #77: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 08:54:52 pluto[548] "vpntoto1" #77: NAT-Traversal: Result using RFC 3947: no NAT detected 08:54:52 pluto[548] "vpntoto1" #77: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 08:54:52 pluto[548] "vpntoto1" #77: received Vendor ID payload [Dead Peer Detection] 08:54:52 pluto[548] "vpntoto1" #77: received Vendor ID payload [RFC 3947] 08:54:52 pluto[548] "vpntoto1" #77: initiating Main Mode to replace #76 08:54:52 pluto[548] "vpntoto1" #76: starting keying attempt 74 of an unlimited number 08:54:52 pluto[548] "vpntoto1" #76: max number of retransmissions (2) reached STATE_MAIN_I3. Possib le authentication failure: no acceptable response to our first encrypted message 08:54:12 pluto[548] "vpntoto1" #76: discarding duplicate packet; already STATE_MAIN_I3 08:53:52 pluto[548] "vpntoto1" #76: discarding duplicate packet; already STATE_MAIN_I3 08:53:42 pluto[548] "vpntoto1" #76: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 08:53:42 pluto[548] "vpntoto1" #76: NAT-Traversal: Result using RFC 3947: no NAT detected 08:53:41 pluto[548] "vpntoto1" #76: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 08:53:41 pluto[548] "vpntoto1" #76: received Vendor ID payload [Dead Peer Detection] 08:53:41 pluto[548] "vpntoto1" #76: received Vendor ID payload [RFC 3947] 08:53:41 pluto[548] "vpntoto1" #76: initiating Main Mode to replace #75 08:53:41 pluto[548] "vpntoto1" #75: starting keying attempt 73 of an unlimited number 08:53:41 pluto[548] "vpntoto1" #75: max number of retransmissions (2) reached STATE_MAIN_I3. Possib le authentication failure: no acceptable response to our first encrypted message 08:53:00 pluto[548] "vpntoto1" #75: discarding duplicate packet; already STATE_MAIN_I3 08:52:40 pluto[548] "vpntoto1" #75: discarding duplicate packet; already STATE_MAIN_I3 08:52:31 pluto[548] "vpntoto1" #75: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 08:52:31 pluto[548] "vpntoto1" #75: NAT-Traversal: Result using RFC 3947: no NAT detected 08:52:30 pluto[548] "vpntoto1" #75: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 08:52:30 pluto[548] "vpntoto1" #75: received Vendor ID payload [Dead Peer Detection] 08:52:30 pluto[548] "vpntoto1" #75: received Vendor ID payload [RFC 3947] 08:52:30 pluto[548] "vpntoto1" #75: initiating Main Mode to replace #74 08:52:30 pluto[548] "vpntoto1" #74: starting keying attempt 72 of an unlimited number

Avez vous une idée à me soumettre ?
que signifie la ligne

Code: Tout sélectionner: max number of retransmissions (2) reached STATE_MAIN_I3. Possib le authentication failure: no acceptable response to our first encrypted message

Merci d'avance

par **grome** » 24 Oct 2005 09:26

Comme j'ai pas eu de réponse vraiment précise je me permet de réitérer.
Dans le cas de perte de tunnels vpn est il utile d'installer des scripts qui circulent sur le forum ou est ce que la version 1.4.9 est censé reconnecté les tunnels vpn tombés.

Merci d'avance...

par **Franck78** » 24 Oct 2005 16:32

grome a écrit:Avez vous une idée à me soumettre ?
que signifie la ligne
Code: Tout sélectionner
max number of retransmissions (2) reached STATE_MAIN_I3. Possib le authentication failure: no acceptable response to our first encrypted message

Merci d'avance

Que l'autre ne réagit pas correctement aux demandes de toto1. C'est pour ça qu'il faut aussi le log de l'autre peer.
D'ailleurs si tu peux décrire vraiment qui est dyndns, qui est fixe, etc.etc.. cela pourrait aider à cerner le problème.
L'option DPD=restart, c'est openswan qui l'a rajoutée. Maintenant, ont-ils vraiment validé le truc, c'est une autre histoire.

par **grome** » 25 Oct 2005 08:36

ok bon avant de commencer je vais expliquer ce que j'ai fait pour essayer de résoudre le problème.
J'ai créé un script celui dispo sur ce thread
http://forums.fr.ixus.net/viewtopic.php?t=27256&highlight=crontab+vpn
je lui est mis les droits (chmod) necessaire
et je l'ai automatisé fcrontab.

En reprenant les logs que j'ai posté ci dessus. Le premier log est celui de mon site principal (fai local). Le deuxieme est une agence (fai free). Sur le site principal j'utilise dyndns.org même si nous avons une adresse ip fixe pour ce site. Je ne l'utilise pas pour le site distant.

Ok j'ai compris pour l'option restart. Je voulais ajouter que je n'ai aucun problème avec un autre tunnel free (site distant) === mon fournisseur local (site principal). Le tunnel reste monté des jours entiers.

je vais essayer de redéfinir mon tunnel mais a priori si les paramètres étaient incorrect cela ne fonctionnerait pas.

par **grome** » 25 Oct 2005 08:54

Bon peut être rien à voir mais quelques informations suplémentaires.
Sur le site principal (mon fai local adsl max) je suis en ppoe pour le red
sur le site distant (free non degroupe 2024) je suis en dhcp pour le red

Pour le tunnel qui fonctionne (on part sur 3 sites donc 2 tunnels :wink:

) et qui est défini exactement de la même manière, le site distant dispose d'un accès free adsl dégroupé. Cet autre site distant est également en dhcp et n'utilise pas dyndns.org.

par **Franck78** » 25 Oct 2005 15:45

Pas sur du tout de l'utilité du script. En tout cas il peut servir seulement quand tout marche. Il ne répare rien.
Donc, encore une fois, les logs des deux machines pendant une tentative d'établissement du VPN.

Tu peux aussi activer le debug pour obtenir plus d'info et parcourir ceci:
http://www.freeswan.org/freeswan_trees/ ... ouble.html
plutodebug="control parsing dns" ou
plutodebug=all (trop bavard)

par **grome** » 25 Oct 2005 17:53

J'ai pas retrouver l'option pour le debug, en esperant que les logs ci dessous soit suffisant.
log du site distant (celui qui pose des problemes)

Code: Tout sélectionner: 17:12:58 pluto[4153] packet from 217.110.47.2:500: received and ignored informational message 17:12:58 pluto[4153] "tunnel1" #5: received Delete SA payload: deleting ISAKMP State #5 17:03:53 pluto[4153] "tunnel1" #6: ISAKMP SA established 17:03:53 pluto[4153] "tunnel1" #6: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 17:03:53 pluto[4153] "tunnel1" #6: Issuer CRL not found 17:03:53 pluto[4153] "tunnel1" #6: Issuer CRL not found 17:03:53 pluto[4153] "tunnel1" #6: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, ST=france, O=toto68, O U=informatique, CN=toto.dyndns.org' 17:03:53 pluto[4153] "tunnel1" #6: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 17:03:53 pluto[4153] "tunnel1" #6: NAT-Traversal: Result using RFC 3947: no NAT detected 17:03:53 pluto[4153] "tunnel1" #6: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 17:03:53 pluto[4153] "tunnel1" #6: received Vendor ID payload [Dead Peer Detection] 17:03:53 pluto[4153] "tunnel1" #6: received Vendor ID payload [RFC 3947] 17:03:53 pluto[4153] "tunnel1" #6: initiating Main Mode to replace #5 16:30:40 pluto[4153] packet from 217.110.47.2:500: Informational Exchange is for an unknown (expired? ) SA 16:12:58 pluto[4153] "tunnel1" #5: ISAKMP SA established 16:12:58 pluto[4153] "tunnel1" #5: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 16:12:58 pluto[4153] "tunnel1" #5: Issuer CRL not found 16:12:58 pluto[4153] "tunnel1" #5: Issuer CRL not found 16:12:58 pluto[4153] "tunnel1" #5: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, ST=france, O=toto68, O U=informatique, CN=toto.dyndns.org' 16:12:57 pluto[4153] "tunnel1" #5: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 16:12:57 pluto[4153] "tunnel1" #5: NAT-Traversal: Result using RFC 3947: no NAT detected 16:12:57 pluto[4153] "tunnel1" #5: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 16:12:57 pluto[4153] "tunnel1" #5: received Vendor ID payload [Dead Peer Detection] 16:12:57 pluto[4153] "tunnel1" #5: received Vendor ID payload [RFC 3947] 16:12:57 pluto[4153] "tunnel1" #5: initiating Main Mode to replace #4 15:46:01 pluto[4153] packet from 217.110.47.2:500: received and ignored informational message 15:46:01 pluto[4153] "tunnel1" #3: received Delete SA payload: deleting ISAKMP State #3 15:30:40 pluto[4153] "tunnel1" #4: ISAKMP SA established 15:30:40 pluto[4153] "tunnel1" #4: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 15:30:40 pluto[4153] "tunnel1" #4: Issuer CRL not found 15:30:40 pluto[4153] "tunnel1" #4: Issuer CRL not found 15:30:40 pluto[4153] "tunnel1" #4: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, ST=france, O=toto68, O U=informatique, CN=toto.dyndns.org' 15:30:40 pluto[4153] "tunnel1" #4: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 15:30:40 pluto[4153] "tunnel1" #4: NAT-Traversal: Result using RFC 3947: no NAT detected 15:30:40 pluto[4153] "tunnel1" #4: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 15:30:40 pluto[4153] "tunnel1" #4: received Vendor ID payload [Dead Peer Detection] 15:30:40 pluto[4153] "tunnel1" #4: received Vendor ID payload [RFC 3947] 15:30:40 pluto[4153] "tunnel1" #4: initiating Main Mode to replace #3 14:55:02 pluto[4153] packet from 217.110.47.2:500: Informational Exchange is for an unknown (expired? ) SA 14:46:03 pluto[4153] "tunnel1" #3: ISAKMP SA established 14:46:03 pluto[4153] "tunnel1" #3: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 14:46:03 pluto[4153] "tunnel1" #3: Issuer CRL not found 14:46:03 pluto[4153] "tunnel1" #3: Issuer CRL not found 14:46:03 pluto[4153] "tunnel1" #3: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, ST=france, O=toto68, O U=informatique, CN=toto.dyndns.org' 14:46:02 pluto[4153] "tunnel1" #3: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 14:46:02 pluto[4153] "tunnel1" #3: NAT-Traversal: Result using RFC 3947: no NAT detected 14:46:02 pluto[4153] "tunnel1" #3: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 14:46:02 pluto[4153] "tunnel1" #3: received Vendor ID payload [Dead Peer Detection] 14:46:02 pluto[4153] "tunnel1" #3: received Vendor ID payload [RFC 3947] 14:46:02 pluto[4153] "tunnel1" #3: initiating Main Mode to replace #1 13:55:03 ipsec__plutorun 004 "tunnel1" #2: STATE_QUICK_I2: sent QI2, IPsec SA established 13:55:03 ipsec__plutorun 122 "tunnel1" #2: STATE_QUICK_I1: initiate 13:55:03 ipsec__plutorun 004 "tunnel1" #1: STATE_MAIN_I4: ISAKMP SA established 13:55:03 ipsec__plutorun 108 "tunnel1" #1: STATE_MAIN_I3: sent MI3, expecting MR3 13:55:03 ipsec__plutorun 003 "tunnel1" #1: NAT-Traversal: Result using RFC 3947: no NAT detected 13:55:03 ipsec__plutorun 106 "tunnel1" #1: STATE_MAIN_I2: sent MI2, expecting MR2 13:55:03 ipsec__plutorun 003 "tunnel1" #1: received Vendor ID payload [Dead Peer Detection] 13:55:03 ipsec__plutorun 003 "tunnel1" #1: received Vendor ID payload [RFC 3947] 13:55:03 ipsec__plutorun 104 "tunnel1" #1: STATE_MAIN_I1: initiate 13:55:03 pluto[4153] "tunnel1" #2: sent QI2, IPsec SA established 13:55:03 pluto[4153] "tunnel1" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2 13:55:03 pluto[4153] "tunnel1" #2: Dead Peer Detection (RFC3706) enabled 13:55:02 pluto[4153] "tunnel1" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS 13:55:02 pluto[4153] "tunnel1" #1: ISAKMP SA established 13:55:02 pluto[4153] "tunnel1" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 13:55:02 pluto[4153] "tunnel1" #1: Issuer CRL not found 13:55:02 pluto[4153] "tunnel1" #1: Issuer CRL not found 13:55:02 pluto[4153] "tunnel1" #1: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, ST=france, O=toto68, O U=informatique, CN=toto.dyndns.org' 13:55:02 pluto[4153] "tunnel1" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 13:55:02 pluto[4153] "tunnel1" #1: NAT-Traversal: Result using RFC 3947: no NAT detected 13:55:02 pluto[4153] "tunnel1" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 13:55:02 pluto[4153] "tunnel1" #1: received Vendor ID payload [Dead Peer Detection] 13:55:02 pluto[4153] "tunnel1" #1: received Vendor ID payload [RFC 3947] 13:55:02 pluto[4153] "tunnel1" #1: initiating Main Mode 13:55:02 pluto[4153] loaded private key file '/var/ipcop/certs/hostkey.pem' (891 bytes) 13:55:02 pluto[4153] loading secrets from "/etc/ipsec.secrets" 13:55:02 pluto[4153] adding interface ipsec0/eth1 82.56.123.123:4500 13:55:02 pluto[4153] adding interface ipsec0/eth1 82.56.123.123 13:55:02 pluto[4153] listening for IKE messages 13:55:02 pluto[4153] added connection description "tunnel1" 13:55:02 pluto[4153] loaded host cert file '/var/ipcop/certs/hostcert.pem' (1180 bytes) 13:55:02 pluto[4153] loaded host cert file '/var/ipcop/certs/tunnel1cert.pem' (1468 bytes) 13:55:02 pluto[4153] | from whack: got --ike=3des 13:55:02 pluto[4153] | from whack: got --esp=3des 13:55:01 pluto[4153] OpenPGP certificate file '/etc/pgpcert.pgp' not found 13:55:01 pluto[4153] loaded crl file 'cacrl.pem' (564 bytes) 13:55:01 pluto[4153] Changing to directory '/etc/ipsec.d/crls' 13:55:01 pluto[4153] file coded in unknown format, discarded 13:55:01 pluto[4153] loaded cacert file '.rnd' (1024 bytes) 13:55:01 pluto[4153] loaded cacert file 'cacert.pem' (1269 bytes) 13:55:01 pluto[4153] error in X.509 certificate 13:55:01 pluto[4153] loaded cacert file 'cakey.pem' (1679 bytes) 13:55:01 pluto[4153] loaded cacert file 'toto68cert.pem' (1667 bytes) 13:55:01 ipsec_setup ...Openswan IPsec started 13:55:01 pluto[4153] Changing to directory '/etc/ipsec.d/cacerts' 13:55:01 pluto[4153] ike_alg_register_enc(): Activating OAKLEY_SSH_PRIVATE_65289: Ok (ret=0) 13:55:01 pluto[4153] ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0) 13:55:01 pluto[4153] ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0) 13:55:01 pluto[4153] ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0) 13:55:01 pluto[4153] ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0) 13:55:01 pluto[4153] ike_alg_register_enc(): Activating OAKLEY_CAST_CBC: Ok (ret=0) 13:55:01 pluto[4153] ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0) 13:55:01 pluto[4153] ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0) 13:55:01 pluto[4153] including NAT-Traversal patch (Version 0.6) 13:55:01 pluto[4153] including X.509 patch with traffic selectors (Version 0.9.42) 13:55:01 pluto[4153] Starting Pluto (Openswan Version 1.0.10rc2) 13:55:01 ipsec__plutorun Starting Pluto subsystem... 13:55:01 ipsec_setup KLIPS ipsec0 on eth1 82.56.123.123/255.255.255.0 broadcast 82.56.123.255 13:55:01 ipsec_setup KLIPS debug `none' 13:55:01 ipsec_setup Starting Openswan IPsec 1.0.10rc2... 13:55:01 ipsec_setup ...Openswan IPsec stopped 13:55:01 ipsec_setup ipsec: Device or resource busy 13:55:01 ipsec_setup /usr/lib/ipsec/tncfg: Socket ioctl failed on detach -- No such device. Is the v irtual device valid? The ipsec module may not be linked into the kernel or load ed as a module. 13:55:00 pluto[3900] shutting down interface ipsec0/eth1 82.56.123.123 13:55:00 pluto[3900] shutting down interface ipsec0/eth1 82.56.123.123 13:55:00 pluto[3900] forgetting secrets 13:55:00 pluto[3900] shutting down 13:55:00 ipsec_setup Stopping Openswan IPsec... 13:50:28 ipsec__plutorun ...could not start conn "tunnel1" 13:50:28 ipsec__plutorun 021 no connection named "tunnel1" 13:50:28 ipsec__plutorun ...could not route conn "tunnel1" 13:50:28 ipsec__plutorun 021 no connection named "tunnel1" 13:50:28 pluto[3900] loaded private key file '/var/ipcop/certs/hostkey.pem' (891 bytes) 13:50:28 pluto[3900] loading secrets from "/etc/ipsec.secrets" 13:50:28 pluto[3900] adding interface ipsec0/eth1 82.56.123.123:4500 13:50:28 pluto[3900] adding interface ipsec0/eth1 82.56.123.123 13:50:28 pluto[3900] listening for IKE messages 13:50:28 ipsec__plutorun ...could not add conn "tunnel1" 13:50:28 ipsec__plutorun whack error: "tunnel1" does not look numeric and name lookup failed "toto.dyndns .org" 13:50:12 pluto[3900] OpenPGP certificate file '/etc/pgpcert.pgp' not found 13:50:12 pluto[3900] loaded crl file 'cacrl.pem' (564 bytes) 13:50:12 pluto[3900] Changing to directory '/etc/ipsec.d/crls' 13:50:12 pluto[3900] file coded in unknown format, discarded 13:50:12 pluto[3900] loaded cacert file '.rnd' (1024 bytes) 13:50:12 pluto[3900] loaded cacert file 'cacert.pem' (1269 bytes) 13:50:12 pluto[3900] error in X.509 certificate 13:50:12 pluto[3900] loaded cacert file 'cakey.pem' (1679 bytes) 13:50:12 pluto[3900] loaded cacert file 'toto68cert.pem' (1667 bytes) 13:50:12 ipsec_setup ...Openswan IPsec started 13:50:12 pluto[3900] Changing to directory '/etc/ipsec.d/cacerts' 13:50:12 pluto[3900] ike_alg_register_enc(): Activating OAKLEY_SSH_PRIVATE_65289: Ok (ret=0) 13:50:12 pluto[3900] ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0) 13:50:12 pluto[3900] ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0) 13:50:12 pluto[3900] ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0) 13:50:12 pluto[3900] ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0) 13:50:12 pluto[3900] ike_alg_register_enc(): Activating OAKLEY_CAST_CBC: Ok (ret=0) 13:50:12 pluto[3900] ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0) 13:50:12 pluto[3900] ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0) 13:50:12 pluto[3900] including NAT-Traversal patch (Version 0.6) 13:50:12 pluto[3900] including X.509 patch with traffic selectors (Version 0.9.42)

par **grome** » 25 Oct 2005 17:55

log du site principal

Code: Tout sélectionner: 17:12:58 pluto[607] packet from 82.56.123.123:500: Informational Exchange is for an unknown (expired ?) SA 17:03:54 pluto[607] "tunnel1" #30: sent MR3, ISAKMP SA established 17:03:54 pluto[607] "tunnel1" #30: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3 17:03:54 pluto[607] "tunnel1" #30: Issuer CRL not found 17:03:54 pluto[607] "tunnel1" #30: Issuer CRL not found 17:03:54 pluto[607] "tunnel1" #30: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, O=toto54, CN=lns-vlq- 17f-82-56-123-123.adsl.proxad.net' 17:03:54 pluto[607] "tunnel1" #30: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 17:03:53 pluto[607] "tunnel1" #30: NAT-Traversal: Result using RFC 3947: no NAT detected 17:03:53 pluto[607] "tunnel1" #30: transition from state (null) to state STATE_MAIN_R1 17:03:53 pluto[607] "tunnel1" #30: responding to Main Mode 17:03:53 pluto[607] packet from 82.56.123.123:500: received Vendor ID payload [Dead Peer Detection] 17:03:53 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-00] 17:03:53 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-02] 17:03:53 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-03] 17:03:53 pluto[607] packet from 82.56.123.123:500: received Vendor ID payload [RFC 3947] 16:30:40 pluto[607] packet from 82.56.123.123:500: Informational Exchange is for an unknown (expired ?) SA 16:12:58 pluto[607] "tunnel1" #29: sent MR3, ISAKMP SA established 16:12:58 pluto[607] "tunnel1" #29: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3 16:12:58 pluto[607] "tunnel1" #29: Issuer CRL not found 16:12:58 pluto[607] "tunnel1" #29: Issuer CRL not found 16:12:58 pluto[607] "tunnel1" #29: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, O=toto54, CN=lns-vlq- 17f-82-56-123-123.adsl.proxad.net' 16:12:58 pluto[607] "tunnel1" #29: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 16:12:58 pluto[607] "tunnel1" #29: NAT-Traversal: Result using RFC 3947: no NAT detected 16:12:58 pluto[607] "tunnel1" #29: transition from state (null) to state STATE_MAIN_R1 16:12:58 pluto[607] "tunnel1" #29: responding to Main Mode 16:12:58 pluto[607] packet from 82.56.123.123:500: received Vendor ID payload [Dead Peer Detection] 16:12:58 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-00] 16:12:58 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-02] 16:12:58 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-03] 16:12:58 pluto[607] packet from 82.56.123.123:500: received Vendor ID payload [RFC 3947] 15:46:02 pluto[607] packet from 82.56.123.123:500: Informational Exchange is for an unknown (expired ?) SA 15:30:40 pluto[607] "tunnel1" #28: sent MR3, ISAKMP SA established 15:30:40 pluto[607] "tunnel1" #28: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3 15:30:40 pluto[607] "tunnel1" #28: Issuer CRL not found 15:30:40 pluto[607] "tunnel1" #28: Issuer CRL not found 15:30:40 pluto[607] "tunnel1" #28: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, O=toto54, CN=lns-vlq- 17f-82-56-123-123.adsl.proxad.net' 15:30:40 pluto[607] "tunnel1" #28: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 15:30:40 pluto[607] "tunnel1" #28: NAT-Traversal: Result using RFC 3947: no NAT detected 15:30:40 pluto[607] "tunnel1" #28: transition from state (null) to state STATE_MAIN_R1 15:30:40 pluto[607] "tunnel1" #28: responding to Main Mode 15:30:40 pluto[607] packet from 82.56.123.123:500: received Vendor ID payload [Dead Peer Detection] 15:30:40 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-00] 15:30:40 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-02] 15:30:40 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-03] 15:30:40 pluto[607] packet from 82.56.123.123:500: received Vendor ID payload [RFC 3947] 14:55:02 pluto[607] packet from 82.56.123.123:500: received and ignored informational message 14:55:02 pluto[607] "tunnel1" #25: received Delete SA payload: deleting ISAKMP State #25 14:46:02 pluto[607] "tunnel1" #27: sent MR3, ISAKMP SA established 14:46:02 pluto[607] "tunnel1" #27: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3 14:46:02 pluto[607] "tunnel1" #27: Issuer CRL not found 14:46:02 pluto[607] "tunnel1" #27: Issuer CRL not found 14:46:02 pluto[607] "tunnel1" #27: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, O=toto54, CN=lns-vlq- 17f-82-56-123-123.adsl.proxad.net' 14:46:02 pluto[607] "tunnel1" #27: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 14:46:02 pluto[607] "tunnel1" #27: NAT-Traversal: Result using RFC 3947: no NAT detected 14:46:02 pluto[607] "tunnel1" #27: transition from state (null) to state STATE_MAIN_R1 14:46:02 pluto[607] "tunnel1" #27: responding to Main Mode 14:46:02 pluto[607] packet from 82.56.123.123:500: received Vendor ID payload [Dead Peer Detection] 14:46:02 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-00] 14:46:02 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-02] 14:46:02 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-03] 14:46:02 pluto[607] packet from 82.56.123.123:500: received Vendor ID payload [RFC 3947] 13:55:03 pluto[607] "tunnel1" #26: IPsec SA established 13:55:03 pluto[607] "tunnel1" #26: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 13:55:03 pluto[607] "tunnel1" #26: Dead Peer Detection (RFC3706) enabled 13:55:03 pluto[607] "tunnel1" #26: transition from state (null) to state STATE_QUICK_R1 13:55:03 pluto[607] "tunnel1" #26: responding to Quick Mode 13:55:03 pluto[607] "tunnel1" #25: sent MR3, ISAKMP SA established 13:55:03 pluto[607] "tunnel1" #25: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3 13:55:03 pluto[607] "tunnel1" #25: Issuer CRL not found 13:55:03 pluto[607] "tunnel1" #25: Issuer CRL not found 13:55:03 pluto[607] "tunnel1" #25: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, O=toto54, CN=lns-vlq- 17f-82-56-123-123.adsl.proxad.net' 13:55:03 pluto[607] "tunnel1" #25: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 13:55:03 pluto[607] "tunnel1" #25: NAT-Traversal: Result using RFC 3947: no NAT detected 13:55:03 pluto[607] "tunnel1" #25: transition from state (null) to state STATE_MAIN_R1 13:55:03 pluto[607] "tunnel1" #25: responding to Main Mode 13:55:03 pluto[607] packet from 82.56.123.123:500: received Vendor ID payload [Dead Peer Detection] 13:55:03 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-00] 13:55:03 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-02] 13:55:03 pluto[607] packet from 82.56.123.123:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat- t-ike-03] 13:55:03 pluto[607] packet from 82.56.123.123:500: received Vendor ID payload [RFC 3947] 13:50:43 pluto[607] "tunnel1" #23: could not find newest phase 1 state for DPD 13:50:43 pluto[607] "tunnel1" #24: could not find newest phase 1 state for DPD 13:50:22 pluto[607] packet from 82.56.123.123:500: received and ignored informational message 13:50:22 pluto[607] "tunnel1" #22: received Delete SA payload: deleting ISAKMP State #22 13:49:13 pluto[607] "tunnel1" #24: sent QI2, IPsec SA established 13:49:13 pluto[607] "tunnel1" #24: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2 13:49:13 pluto[607] "tunnel1" #24: Dead Peer Detection (RFC3706) enabled 13:49:13 pluto[607] "tunnel1" #23: IPsec SA established 13:49:13 pluto[607] "tunnel1" #23: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 13:49:13 pluto[607] "tunnel1" #23: Dead Peer Detection (RFC3706) enabled 13:49:13 pluto[607] "tunnel1" #24: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS 13:49:13 pluto[607] "tunnel1" #23: transition from state (null) to state STATE_QUICK_R1 13:49:13 pluto[607] "tunnel1" #23: responding to Quick Mode 13:49:13 pluto[607] "tunnel1" #22: sent MR3, ISAKMP SA established 13:49:13 pluto[607] "tunnel1" #22: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3 13:49:13 pluto[607] "tunnel1" #22: Issuer CRL not found 13:49:13 pluto[607] "tunnel1" #22: Issuer CRL not found 13:49:13 pluto[607] "tunnel1" #22: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, O=toto54, CN=lns-vlq- 17f-82-56-123-123.adsl.proxad.net' 13:49:12 pluto[607] "tunnel1" #22: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 13:49:12 pluto[607] "tunnel1" #22: NAT-Traversal: Result using RFC 3947: no NAT detected

par **Franck78** » 26 Oct 2005 12:08

J'ai passé du temps a remettre en parallèle les deux logs. Malheuresement je ne constate pas de problème évident. Il y a bien renégociation IKE (ISAKMP) toutes ~45 minutes. Normalement c'est par défaut 60 minutes.
Pourtant exactement 60 minutes après une renégociation, chaque peer recoit un message d'info inutile (il y 10 minutes déjà passée depuis la renégociation).
Bref j'ai pas assez de background pour savoir ce qui est normal ou pas.

Je ne vois rien concernant le deuxième tunnel. Il était arrété pendant l'après midi ?

Quand tu dis que le VPN tombe, cela se traduit comment ?

ipsec auto --status donne quoi ?

Code: Tout sélectionner: 82.56.123.123 217.... démarrage 13:55 ISAKMP#25 14:46 #3=>#1 14:46 ISAKMP#27 14:55 info expired 14:55 delete SA#25 décalé??? 15:30 #4=>#3 15:30 ISAKMP#28 15:46 delete #3 15:46 info expired SA (#27)??? 16:12 #5=>#4 16:12 ISAKMP#29 16:30 info expired 16:30 info expired SA (#28)??? 17:03 #6=>#5 17:03 ISAKMP#30 17:12 delete #5 17:12 info expired SA (#29)???

Voila pour les échanges IKE. A part les messages d'infos 'en retard' et pas toujours pareils, ils se passent bien.
Pour les SA IPSEc (#2 et #26) il faut 8 heures pour qu'il change aussi.

Tu peux essayer dans 'advanced options' de placer le délai a 60 minutes.

VPN perte tunnel deconnexion

VPN perte tunnel deconnexion

Up

Qui est en ligne ?