Racoon site-to site

[Mike Tancsa]

At 11:33 AM 12/11/2009, David DeSimone wrote:
>Jon Otterholm <jon.otterholm at ide.resurscentrum.se> wrote:
> >
> > If I restart racoon or wait approximately 30 min the connection is
> > re-established.
>
>Since this is approximately ½of the phase 2 lifetime, you are probably
>running into lifetime negotiation issues, or PFS issues.
>
> > What would be the obvious way to debug this?  Any suggestions on what
> > to tweak appreciated.
>
>I would turn up the debugging on racoon to get more information around
>the time that the tunnel fails.
>
> > sainfo  (address 192.168.1.0/24 any address 192.168.100.0/24 any)
> > {
> >     pfs_group       1;
> >     lifetime        time    3600 sec;
> >     encryption_algorithm    des;
> >     authentication_algorithm        hmac_md5,hmac_sha1;
> >     compression_algorithm   deflate;
> > }
>
>My hunch is that you have a PFS mismatch, so that the first tunnel
>negotiates, but the second SA negotiation fails, then the third
>succeeds, etc.


You might also want to turn on DPD (dead peer 
detection) in ipsectools if you dont already have 
it on both sides.  Are you really using des for 
the crypto ? Also, when the session is 
negotiated, take a look at the output of
setkey -D
and see what was actually negotiated and post it 
here (just make sure you get rid of the info on the E and A lines.

e.g.
1.1.1.2 2.2.2.2
         esp mode=tunnel spi=125444787(0x077a22b3) reqid=16416(0x00004020)
         E: 3des-cbc  770cdd7b 770cdd7b 770cdd7b 770cdd7b 770cdd7b 770cdd7b
         A: hmac-sha1  5cfdbabb 5cfdbabb 5cfdbabb 5cfdbabb 5cfdbabb

ie. mask out the 5cfdbabb and 770cdd7b values 
before posting as thats your crypto :)



   Also, when things "jam up", try instead,

racoonctl vpn-disconnect <remote peer's IP>

and you wont have to restart things.

Also, what does
sysctl net.key.preferred_oldsa

show ?

         ---Mike


--------------------------------------------------------------------
Mike Tancsa,                                      tel +1 519 651 3400
Sentex Communications,                            mike at sentex.net
Providing Internet since 1994                    www.sentex.net
Cambridge, Ontario Canada                         www.sentex.net/mike