From owner-freebsd-net@FreeBSD.ORG Fri Dec 11 19:23:23 2009 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8B643106568B for ; Fri, 11 Dec 2009 19:23:23 +0000 (UTC) (envelope-from mike@sentex.net) Received: from lava.sentex.ca (pyroxene.sentex.ca [199.212.134.18]) by mx1.freebsd.org (Postfix) with ESMTP id 571F38FC1C for ; Fri, 11 Dec 2009 19:23:23 +0000 (UTC) Received: from mdt-xp.sentex.net (simeon.sentex.ca [192.168.43.27]) by lava.sentex.ca (8.14.3/8.14.3) with ESMTP id nBBJNLk3072715; Fri, 11 Dec 2009 14:23:22 -0500 (EST) (envelope-from mike@sentex.net) Message-Id: <200912111923.nBBJNLk3072715@lava.sentex.ca> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Fri, 11 Dec 2009 14:23:26 -0500 To: jon.otterholm@ide.resurscentrum.se, From: Mike Tancsa In-Reply-To: <20091211163343.GE2296@verio.net> References: <20091211163343.GE2296@verio.net> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1"; format=flowed Content-Transfer-Encoding: quoted-printable Cc: Subject: Re: Racoon site-to site X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Dec 2009 19:23:23 -0000 At 11:33 AM 12/11/2009, David DeSimone wrote: >Jon Otterholm wrote: > > > > If I restart racoon or wait approximately 30 min the connection is > > re-established. > >Since this is approximately =C2=BDof the phase 2 lifetime, you are probably >running into lifetime negotiation issues, or PFS issues. > > > What would be the obvious way to debug this? Any suggestions on what > > to tweak appreciated. > >I would turn up the debugging on racoon to get more information around >the time that the tunnel fails. > > > sainfo (address 192.168.1.0/24 any address 192.168.100.0/24 any) > > { > > pfs_group 1; > > lifetime time 3600 sec; > > encryption_algorithm des; > > authentication_algorithm hmac_md5,hmac_sha1; > > compression_algorithm deflate; > > } > >My hunch is that you have a PFS mismatch, so that the first tunnel >negotiates, but the second SA negotiation fails, then the third >succeeds, etc. You might also want to turn on DPD (dead peer=20 detection) in ipsectools if you dont already have=20 it on both sides. Are you really using des for=20 the crypto ? Also, when the session is=20 negotiated, take a look at the output of setkey -D and see what was actually negotiated and post it=20 here (just make sure you get rid of the info on the E and A lines. e.g. 1.1.1.2 2.2.2.2 esp mode=3Dtunnel spi=3D125444787(0x077a22b3)= reqid=3D16416(0x00004020) E: 3des-cbc 770cdd7b 770cdd7b 770cdd7b 770cdd7b 770cdd7b 770cdd7b A: hmac-sha1 5cfdbabb 5cfdbabb 5cfdbabb 5cfdbabb 5cfdbabb ie. mask out the 5cfdbabb and 770cdd7b values=20 before posting as thats your crypto :) Also, when things "jam up", try instead, racoonctl vpn-disconnect and you wont have to restart things. Also, what does sysctl net.key.preferred_oldsa show ? ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike@sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike