IPsec tunnel blocks after a while without error. Where to find details?
1
vote
1
answer
641
views
There is an IPsec Tunnel created with OpenSwan that works perfectly well packets going through answers received etc until at some point in time traffic stops.
I can regenerate the tunnel doing
ipsec auto --down tunnelName
ipsec auto --up tunnelName
But eventually it will collapse again, sometimes after hours sometimes after days.
I am not able to find any error messages for example in pluto.log that indicate that the tunnel collapsed, the last lines found are the ones reporting Quick_Mode entry.
Our side: Ubuntu 14.04.4 LTS, Linux Openswan U2.6.38/K3.13.0-91-generic (netkey)
Other side: SAP Router and unknown firewall
I tapped this using tcpdump while the tunnel was not doing its job:
10:30:53.357186 IP us.isakmp > them.isakmp: isakmp: phase 1 I ident
10:30:53.384168 IP them.isakmp > us.isakmp: isakmp: phase 1 R ident
10:30:53.384880 IP us.isakmp > them.isakmp: isakmp: phase 1 I ident
10:30:53.425034 IP them.isakmp > us.isakmp: isakmp: phase 1 R ident
10:30:53.425770 IP us.isakmp > them.isakmp: isakmp: phase 1 I ident[E]
10:30:53.451727 IP them.isakmp > us.isakmp: isakmp: phase 1 R ident[E]
10:32:01.089957 IP us > them: ESP(spi=0x6e51327d,seq=0x14b), length 100
10:32:02.089097 IP us > them: ESP(spi=0x6e51327d,seq=0x14c), length 100
First part seems to be a succesful tunnel rekey negotiation second part two failing requests, or not?
Netstat says that requests sent into the tunnel reach nothing more than
SYN_SENT
and then time out.
Are there any other logs I could search as I am not allowed to debug the other end of the tunnel?
Asked by Björn
(158 rep)
Jul 4, 2016, 12:06 PM
Last activity: May 20, 2017, 04:33 AM
Last activity: May 20, 2017, 04:33 AM