Sample Header Ad - 728x90

IPsec tunnel blocks after a while without error. Where to find details?

1 vote
1 answer
641 views
There is an IPsec Tunnel created with OpenSwan that works perfectly well packets going through answers received etc until at some point in time traffic stops. I can regenerate the tunnel doing ipsec auto --down tunnelName ipsec auto --up tunnelName But eventually it will collapse again, sometimes after hours sometimes after days. I am not able to find any error messages for example in pluto.log that indicate that the tunnel collapsed, the last lines found are the ones reporting Quick_Mode entry. Our side: Ubuntu 14.04.4 LTS, Linux Openswan U2.6.38/K3.13.0-91-generic (netkey) Other side: SAP Router and unknown firewall I tapped this using tcpdump while the tunnel was not doing its job: 10:30:53.357186 IP us.isakmp > them.isakmp: isakmp: phase 1 I ident 10:30:53.384168 IP them.isakmp > us.isakmp: isakmp: phase 1 R ident 10:30:53.384880 IP us.isakmp > them.isakmp: isakmp: phase 1 I ident 10:30:53.425034 IP them.isakmp > us.isakmp: isakmp: phase 1 R ident 10:30:53.425770 IP us.isakmp > them.isakmp: isakmp: phase 1 I ident[E] 10:30:53.451727 IP them.isakmp > us.isakmp: isakmp: phase 1 R ident[E] 10:32:01.089957 IP us > them: ESP(spi=0x6e51327d,seq=0x14b), length 100 10:32:02.089097 IP us > them: ESP(spi=0x6e51327d,seq=0x14c), length 100 First part seems to be a succesful tunnel rekey negotiation second part two failing requests, or not? Netstat says that requests sent into the tunnel reach nothing more than SYN_SENT and then time out. Are there any other logs I could search as I am not allowed to debug the other end of the tunnel?
Asked by Björn (158 rep)
Jul 4, 2016, 12:06 PM
Last activity: May 20, 2017, 04:33 AM