Portál AbcLinuxu, 16. července 2025 13:02


Dotaz: Po restartu racoonu nefunguje navázání spojení z protistrany

4.2.2010 01:18 rakon
Po restartu racoonu nefunguje navázání spojení z protistrany
Přečteno: 380×
Odpovědět | Admin
Mám problém s racoon daemonem. Pokud ho na straně A restartuju, tak na straně B nemohu navázat se stranou A komunikaci(v logu pak je racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, af31a1d38a333223:5db8b022cf387202:0000f444). Nejprve musím třeba pingnout ze strany A na stranu B, což je docela špatné. Konfigurace raccon.conf: 
path certificate "/etc/racoon/certs";

remote 192.168.1.21 {
        exchange_mode main;
	certificate_type x509 "A.pem" "A.private.pem";
        my_identifier asn1dn;
        peers_identifier asn1dn;
        proposal_check obey;
        verify_cert on; 
	peers_certfile x509 "B.pem";
        lifetime time 67 min;
        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method rsasig;
                dh_group modp1024;
        }
        generate_policy off;
}
 
sainfo address 192.168.1.20 any address 192.168.1.21 any {
        pfs_group modp768;
        lifetime time 97 min;
        encryption_algorithm 3des;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
}

Strana B má stejné nastavení(jen proházené ip a certifikáty)
Kde je problém?
Nástroje: Začni sledovat (0) ?Zašle upozornění na váš email při vložení nového komentáře.

Odpovědi

4.2.2010 09:15 NN
Rozbalit Rozbalit vše Re: Po restartu racoonu nefunguje navázání spojení z protistrany
Odpovědět | | Sbalit | Link | Blokovat | Admin
Co vypise druha strana? Z nejakeho duvodu se znovu nesestavy SA, podival bych se na nejake casovace a retry hodnoty..

NN
4.2.2010 11:51 rakon
Rozbalit Rozbalit vše Re: Po restartu racoonu nefunguje navázání spojení z protistrany
Vypíše to samý. Retry se provádí pořád dokola a bez úspěchu. Fakt nevím co s tím. 
Feb  3 22:26:40 racoon: WARNING: the expire message is received but the handler has not been established.
Feb  3 22:26:40 racoon: ERROR: 192.168.1.20 give up to get IPsec-SA due to time up to wait.
Feb  3 22:26:40 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.20[0]->192.168.1.21[0] spi=152493420(0x916dd6c)
Feb  3 22:26:40 racoon: INFO: initiate new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Feb  3 22:26:40 racoon: ERROR: none message must be encrypted
Feb  3 22:26:48 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:0000d509
4.2.2010 13:25 NN
Rozbalit Rozbalit vše Re: Po restartu racoonu nefunguje navázání spojení z protistrany
Odpovědět | | Sbalit | Link | Blokovat | Admin
Tak jsem trochu hledal a skontroloval bych /etc/ipsec.keys a IP-cka, proste se ti nesestavi SA. Jinak jsem posli delsi kus toho logu, protoze ta chyba zacina uz v drivejsi fazi...

NN
4.2.2010 16:55 rakon
Rozbalit Rozbalit vše Re: Po restartu racoonu nefunguje navázání spojení z protistrany 
cat /etc/ipsec-tools.conf 
#!/usr/sbin/setkey -f

# NOTE: Do not use this file if you use racoon with racoon-tool
# utility. racoon-tool will setup SAs and SPDs automatically using
# /etc/racoon/racoon-tool.conf configuration.
# 

## Flush the SAD and SPD
#
flush;
spdflush;


spdadd 192.168.1.20 192.168.1.21 any -P out ipsec

  esp/transport//require

  ah/transport//require;

 

spdadd 192.168.1.21 192.168.1.20 any -P in ipsec

  esp/transport//require

  ah/transport//require;
Druhá strana má akorát proházené ip.
4.2.2010 17:07 rakon
Rozbalit Rozbalit vše Re: Po restartu racoonu nefunguje navázání spojení z protistrany
A tady je log od začátku problému. 
Jan 29 18:55:01 racoon: INFO: caught signal 15
Jan 29 18:55:02 racoon: INFO: racoon shutdown
Jan 29 18:55:02 racoon: INFO: @(#)ipsec-tools 0.7.1 (http://ipsec-tools.sourceforge.net)
Jan 29 18:55:02 racoon: INFO: @(#)This product linked OpenSSL 0.9.8g 19 Oct 2007 (http://www.openssl.org/)
Jan 29 18:55:02 racoon: INFO: Reading configuration from "/etc/racoon/racoon.conf"
Jan 29 18:55:04 racoon: INFO: Resize address pool from 0 to 255
Jan 29 18:55:04 racoon: INFO: 127.0.0.1[500] used as isakmp port (fd=7)
Jan 29 18:55:04 racoon: INFO: 127.0.0.1[500] used for NAT-T
Jan 29 18:55:04 racoon: INFO: 192.168.1.21[500] used as isakmp port (fd=8)
Jan 29 18:55:04 racoon: INFO: 192.168.1.21[500] used for NAT-T
Jan 29 18:55:04 racoon: INFO: ::1[500] used as isakmp port (fd=9)
Jan 29 18:55:04 racoon: INFO: fe80::216:3eff:fe03:3fbc%eth0[500] used as isakmp port (fd=10)
Jan 29 18:56:47 racoon: INFO: respond new phase 1 negotiation: 192.168.1.21[500]<=>192.168.1.1[500]
Jan 29 18:56:47 racoon: INFO: begin Identity Protection mode.
Jan 29 18:56:47 racoon: INFO: received Vendor ID: DPD
Jan 29 18:56:47 racoon: INFO: ISAKMP-SA established 192.168.1.21[500]-192.168.1.1[500] spi:0042e779b9c84a53:6efa86e3d87d8ac4
Jan 29 18:56:48 racoon: INFO: respond new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.1[500]
Jan 29 18:56:48 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.1[0]->192.168.1.21[0] spi=171025257(0xa31a369)
Jan 29 18:56:48 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.1[0]->192.168.1.21[0] spi=175933703(0xa7c8907)
Jan 29 18:56:48 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.21[500]->192.168.1.1[500] spi=32626066(0x1f1d592)
Jan 29 18:56:48 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.21[500]->192.168.1.1[500] spi=102866468(0x6219e24)
Jan 29 18:57:12 racoon: INFO: ISAKMP-SA expired 192.168.1.21[500]-192.168.1.1[500] spi:0042e779b9c84a53:6efa86e3d87d8ac4
Jan 29 18:57:13 racoon: INFO: ISAKMP-SA deleted 192.168.1.21[500]-192.168.1.1[500] spi:0042e779b9c84a53:6efa86e3d87d8ac4
Jan 29 18:57:20 racoon: INFO: respond new phase 1 negotiation: 192.168.1.21[500]<=>192.168.1.1[500]
Jan 29 18:57:20 racoon: INFO: begin Identity Protection mode.
Jan 29 18:57:20 racoon: INFO: received Vendor ID: DPD
Jan 29 18:57:20 racoon: INFO: ISAKMP-SA established 192.168.1.21[500]-192.168.1.1[500] spi:228f99287bead4a2:28d076d567f7aa38
Jan 29 18:57:20 racoon: INFO: purging spi=171025257.
Jan 29 18:57:20 racoon: INFO: purging spi=175933703.
Jan 29 18:57:20 racoon: INFO: purging spi=32626066.
Jan 29 18:57:20 racoon: INFO: purging spi=102866468.
Jan 29 18:57:21 racoon: INFO: respond new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.1[500]
Jan 29 18:57:21 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.1[0]->192.168.1.21[0] spi=4526290(0x4510d2)
Jan 29 18:57:21 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.1[0]->192.168.1.21[0] spi=43050394(0x290e59a)
Jan 29 18:57:21 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.21[500]->192.168.1.1[500] spi=13826066(0xd2f812)
Jan 29 18:57:21 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.21[500]->192.168.1.1[500] spi=39692921(0x25daa79)
Jan 29 19:00:54 racoon: INFO: IPsec-SA request for 192.168.1.20 queued due to no phase1 found.
Jan 29 19:00:54 racoon: INFO: initiate new phase 1 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Jan 29 19:00:54 racoon: INFO: begin Identity Protection mode.
Jan 29 19:00:54 racoon: INFO: received Vendor ID: DPD
Jan 29 19:00:55 racoon: INFO: ISAKMP-SA established 192.168.1.21[500]-192.168.1.20[500] spi:18f7d4042c9ff6b2:78a90f7f0f1dca1c
Jan 29 19:00:55 racoon: INFO: initiate new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Jan 29 19:00:55 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.20[0]->192.168.1.21[0] spi=36688482(0x22fd262)
Jan 29 19:00:55 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.20[0]->192.168.1.21[0] spi=160631287(0x99309f7)
Jan 29 19:00:55 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.21[500]->192.168.1.20[500] spi=70561152(0x434ad80)
Jan 29 19:00:55 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.21[500]->192.168.1.20[500] spi=217076022(0xcf05136)
Jan 29 19:02:48 racoon: INFO: IPsec-SA request for 192.168.1.20 queued due to no phase1 found.
Jan 29 19:02:48 racoon: INFO: initiate new phase 1 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Jan 29 19:02:48 racoon: INFO: begin Identity Protection mode.
Jan 29 19:02:48 racoon: INFO: received Vendor ID: DPD
Jan 29 19:02:48 racoon: INFO: ISAKMP-SA established 192.168.1.21[500]-192.168.1.20[500] spi:af31a1d38a333223:5db8b022cf387202
Jan 29 19:02:49 racoon: INFO: initiate new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Jan 29 19:02:50 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.20[0]->192.168.1.21[0] spi=163025867(0x9b793cb)
Jan 29 19:02:50 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.20[0]->192.168.1.21[0] spi=512407(0x7d197)
Jan 29 19:02:50 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.21[500]->192.168.1.20[500] spi=111798323(0x6a9e833)
Jan 29 19:02:50 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.21[500]->192.168.1.20[500] spi=153684485(0x9290a05)
Jan 29 19:02:55 racoon: INFO: IPsec-SA request for 192.168.1.1 queued due to no phase1 found.
Jan 29 19:02:55 racoon: INFO: initiate new phase 1 negotiation: 192.168.1.21[500]<=>192.168.1.1[500]
Jan 29 19:02:55 racoon: INFO: begin Identity Protection mode.
Jan 29 19:02:55 racoon: INFO: received Vendor ID: DPD
Jan 29 19:02:55 racoon: INFO: ISAKMP-SA established 192.168.1.21[500]-192.168.1.1[500] spi:85ac49200185f595:1cdd9e845f785f11
Jan 29 19:02:56 racoon: INFO: initiate new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.1[500]
Jan 29 19:03:01 racoon: INFO: respond new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.1[500]
Jan 29 19:03:01 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.1[0]->192.168.1.21[0] spi=26138577(0x18ed7d1)
Jan 29 19:03:01 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.1[0]->192.168.1.21[0] spi=142566231(0x87f6357)
Jan 29 19:03:01 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.21[500]->192.168.1.1[500] spi=112500919(0x6b4a0b7)
Jan 29 19:03:01 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.21[500]->192.168.1.1[500] spi=11252200(0xabb1e8)
Jan 29 19:03:26 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.1[0]->192.168.1.21[0] spi=250159532(0xee921ac)
Jan 29 19:03:26 racoon: WARNING: the expire message is received but the handler has not been established.
Jan 29 19:03:26 racoon: ERROR: 192.168.1.1 give up to get IPsec-SA due to time up to wait.
Jan 29 19:03:26 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.1[0]->192.168.1.21[0] spi=233035080(0xde3d548)
Jan 29 19:49:25 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.1[0]->192.168.1.21[0] spi=26138577(0x18ed7d1)
Jan 29 19:49:25 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.1[0]->192.168.1.21[0] spi=142566231(0x87f6357)
Jan 29 19:49:25 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.21[0]->192.168.1.1[0] spi=112500919(0x6b4a0b7)
Jan 29 19:49:25 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.21[0]->192.168.1.1[0] spi=11252200(0xabb1e8)
Jan 29 19:49:25 racoon: INFO: respond new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.1[500]
Jan 29 19:49:25 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.1[0]->192.168.1.21[0] spi=53278745(0x32cf819)
Jan 29 19:49:25 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.1[0]->192.168.1.21[0] spi=31503398(0x1e0b426)
Jan 29 19:49:25 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.21[500]->192.168.1.1[500] spi=26710094(0x197904e)
Jan 29 19:49:25 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.21[500]->192.168.1.1[500] spi=139599395(0x8521e23)
Jan 29 20:01:01 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.1[0]->192.168.1.21[0] spi=26138577(0x18ed7d1)
Jan 29 20:01:01 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.1[0]->192.168.1.21[0] spi=142566231(0x87f6357)
Jan 29 20:01:01 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.21[0]->192.168.1.1[0] spi=112500919(0x6b4a0b7)
Jan 29 20:01:01 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.21[0]->192.168.1.1[0] spi=11252200(0xabb1e8)
Jan 29 20:20:25 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.20[0]->192.168.1.21[0] spi=163025867(0x9b793cb)
Jan 29 20:20:25 racoon: INFO: initiate new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Jan 29 20:20:25 racoon: ERROR: none message must be encrypted
Jan 29 20:20:26 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.20[0]->192.168.1.21[0] spi=512407(0x7d197)
Jan 29 20:20:26 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.21[0]->192.168.1.20[0] spi=111798323(0x6a9e833)
Jan 29 20:20:26 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.21[0]->192.168.1.20[0] spi=153684485(0x9290a05)
Jan 29 20:20:35 racoon: ERROR: none message must be encrypted
Jan 29 20:20:45 racoon: ERROR: none message must be encrypted
Jan 29 20:20:55 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.20[0]->192.168.1.21[0] spi=83616437(0x4fbe2b5)
Jan 29 20:20:55 racoon: WARNING: the expire message is received but the handler has not been established.
Jan 29 20:20:55 racoon: ERROR: 192.168.1.20 give up to get IPsec-SA due to time up to wait.
Jan 29 20:20:55 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.20[0]->192.168.1.21[0] spi=4571922(0x45c312)
Jan 29 20:35:49 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.1[0]->192.168.1.21[0] spi=53278745(0x32cf819)
Jan 29 20:35:49 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.1[0]->192.168.1.21[0] spi=31503398(0x1e0b426)
Jan 29 20:35:49 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.21[0]->192.168.1.1[0] spi=26710094(0x197904e)
Jan 29 20:35:49 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.21[0]->192.168.1.1[0] spi=139599395(0x8521e23)
Jan 29 20:35:50 racoon: INFO: respond new phase 1 negotiation: 192.168.1.21[500]<=>192.168.1.1[500]
Jan 29 20:35:50 racoon: INFO: begin Identity Protection mode.
Jan 29 20:35:50 racoon: INFO: received Vendor ID: DPD
Jan 29 20:35:50 racoon: INFO: ISAKMP-SA established 192.168.1.21[500]-192.168.1.1[500] spi:8f522a25bdbc015c:1f187d9065afcd1f
Jan 29 20:35:51 racoon: INFO: respond new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.1[500]
Jan 29 20:35:51 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.1[0]->192.168.1.21[0] spi=225334230(0xd6e53d6)
Jan 29 20:35:51 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.1[0]->192.168.1.21[0] spi=149676241(0x8ebe0d1)
Jan 29 20:35:51 racoon: INFO: IPsec-SA established: AH/Transport 192.168.1.21[500]->192.168.1.1[500] spi=56271653(0x35aa325)
Jan 29 20:35:51 racoon: INFO: IPsec-SA established: ESP/Transport 192.168.1.21[500]->192.168.1.1[500] spi=223294144(0xd4f32c0)
Jan 29 20:39:49 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.20[0]->192.168.1.21[0] spi=163025867(0x9b793cb)
Jan 29 20:39:50 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.20[0]->192.168.1.21[0] spi=512407(0x7d197)
Jan 29 20:39:50 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.21[0]->192.168.1.20[0] spi=111798323(0x6a9e833)
Jan 29 20:39:50 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.21[0]->192.168.1.20[0] spi=153684485(0x9290a05)
Jan 29 20:40:02 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:000093c3
Jan 29 20:40:12 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:000093c3
Jan 29 20:40:22 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:000093c3
Jan 29 20:40:40 racoon: INFO: initiate new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Jan 29 20:40:40 racoon: ERROR: none message must be encrypted
Jan 29 20:40:50 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:0000c067
Jan 29 20:40:50 racoon: ERROR: none message must be encrypted
Jan 29 20:41:00 racoon: ERROR: none message must be encrypted
Jan 29 20:41:00 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:0000c067
Jan 29 20:41:10 racoon: ERROR: 192.168.1.20 give up to get IPsec-SA due to time up to wait.
Jan 29 20:41:10 racoon: INFO: initiate new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Jan 29 20:41:10 racoon: ERROR: none message must be encrypted
Jan 29 20:41:10 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:0000c067
Jan 29 20:41:10 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.20[0]->192.168.1.21[0] spi=7941970(0x792f52)
Jan 29 20:41:10 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.20[0]->192.168.1.21[0] spi=255167343(0xf358b6f)
Jan 29 20:41:20 racoon: ERROR: none message must be encrypted
Jan 29 20:41:30 racoon: ERROR: none message must be encrypted
Jan 29 20:41:38 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:00009d91
Jan 29 20:41:40 racoon: ERROR: 192.168.1.20 give up to get IPsec-SA due to time up to wait.
Jan 29 20:41:40 racoon: INFO: initiate new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Jan 29 20:41:40 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.20[0]->192.168.1.21[0] spi=77792121(0x4a30379)
Jan 29 20:41:40 racoon: ERROR: none message must be encrypted
Jan 29 20:41:40 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.20[0]->192.168.1.21[0] spi=254146711(0xf25f897)
Jan 29 20:41:48 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:00009d91
Jan 29 20:41:50 racoon: ERROR: none message must be encrypted
Jan 29 20:41:58 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:00009d91
Jan 29 20:42:00 racoon: ERROR: none message must be encrypted
Jan 29 20:42:10 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.20[0]->192.168.1.21[0] spi=161191103(0x99b94bf)
Jan 29 20:42:10 racoon: WARNING: the expire message is received but the handler has not been established.
Jan 29 20:42:10 racoon: ERROR: 192.168.1.20 give up to get IPsec-SA due to time up to wait.
Jan 29 20:42:10 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.20[0]->192.168.1.21[0] spi=10610166(0xa1e5f6)
Jan 29 20:42:10 racoon: INFO: initiate new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Jan 29 20:42:10 racoon: ERROR: none message must be encrypted
Jan 29 20:42:20 racoon: ERROR: none message must be encrypted
Jan 29 20:42:30 racoon: ERROR: none message must be encrypted
Jan 29 20:42:40 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.20[0]->192.168.1.21[0] spi=92927343(0x589f56f)
Jan 29 20:42:40 racoon: WARNING: the expire message is received but the handler has not been established.
Jan 29 20:42:40 racoon: ERROR: 192.168.1.20 give up to get IPsec-SA due to time up to wait.
Jan 29 20:42:40 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.20[0]->192.168.1.21[0] spi=234995394(0xe01bec2)
Jan 29 20:42:40 racoon: INFO: initiate new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Jan 29 20:42:40 racoon: ERROR: none message must be encrypted
Jan 29 20:42:50 racoon: ERROR: none message must be encrypted
Jan 29 20:43:00 racoon: ERROR: none message must be encrypted
Jan 29 20:43:10 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.20[0]->192.168.1.21[0] spi=41140998(0x273c306)
Jan 29 20:43:10 racoon: WARNING: the expire message is received but the handler has not been established.
Jan 29 20:43:10 racoon: ERROR: 192.168.1.20 give up to get IPsec-SA due to time up to wait.
Jan 29 20:43:10 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.20[0]->192.168.1.21[0] spi=178532549(0xaa430c5)
Jan 29 20:43:10 racoon: INFO: initiate new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Jan 29 20:43:10 racoon: ERROR: none message must be encrypted
Jan 29 20:43:14 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:00009cd3
Jan 29 20:43:20 racoon: ERROR: none message must be encrypted
Jan 29 20:43:24 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:00009cd3
Jan 29 20:43:30 racoon: ERROR: none message must be encrypted
Jan 29 20:43:34 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:00009cd3
Jan 29 20:43:40 racoon: INFO: IPsec-SA expired: AH/Transport 192.168.1.20[0]->192.168.1.21[0] spi=246530582(0xeb1c216)
Jan 29 20:43:40 racoon: WARNING: the expire message is received but the handler has not been established.
Jan 29 20:43:40 racoon: ERROR: 192.168.1.20 give up to get IPsec-SA due to time up to wait.
Jan 29 20:43:40 racoon: INFO: IPsec-SA expired: ESP/Transport 192.168.1.20[0]->192.168.1.21[0] spi=108337029(0x6751785)
Jan 29 20:43:40 racoon: INFO: initiate new phase 2 negotiation: 192.168.1.21[500]<=>192.168.1.20[500]
Jan 29 20:43:40 racoon: ERROR: none message must be encrypted
Jan 29 20:43:50 racoon: ERROR: none message must be encrypted
Jan 29 20:43:59 racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, 8d6aff28bc760176:92290ac1b9a4cf1c:0000d625
vencour avatar 4.2.2010 21:31 vencour | skóre: 56 | blog: Tady je Vencourovo | Praha+západní Čechy
Rozbalit Rozbalit vše Re: Po restartu racoonu nefunguje navázání spojení z protistrany
Odpovědět | | Sbalit | Link | Blokovat | Admin

Zapnutí dead peer detection by nemohlo pomoct?

Ty nejhlubší objevy nečekají nutně za příští hvězdou. Jsou uvnitř nás utkány do vláken, která nás spojují, nás všechny.

Založit nové vlákno • Nahoru

Tiskni Sdílej: Linkuj Jaggni to Vybrali.sme.sk Google Del.icio.us Facebook

ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.