FreeSwan connectie probleem

[Verwijderd]

Ik raak steeds na ongeveer 4 minuten de ipsec verbinding kwijt.


Ik (Vigor 2200W v2.00b) <> FreeSwan (Debian unstable duhh)
FreeSwan bak doet het prima met andere FreeSwan bakken
Maar hier is het 4 minuten en niet langer

ipsec barf:

Jul 19 12:11:50 bakkie Pluto[15545]: "vbict-rinusthuis" #127: initiating Quick Mode PSK+ENCRYPT+TUNNEL to replace #126
Jul 19 12:11:50 bakkie Pluto[15545]: "vbict-rinusthuis" #128: initiating Main Mode to replace #125
Jul 19 12:11:50 bakkie Pluto[15545]: "vbict-rinusthuis" #127: sent QI2, IPsec SA established
Jul 19 12:11:54 bakkie Pluto[15545]: "vbict-rinusthuis" #128: Peer ID is ID_IPV4_ADDR: '62.131.x.x'
Jul 19 12:11:54 bakkie Pluto[15545]: "vbict-rinusthuis" #128: ISAKMP SA established
Jul 19 12:12:40 bakkie Pluto[15545]: | no phase 1 state where one should be
Jul 19 12:12:40 bakkie Pluto[15545]: | no phase 1 state where one should be
Jul 19 12:12:59 bakkie Pluto[15545]: "vbict-rinusthuis" #129: initiating Main Mode to replace #128
Jul 19 12:13:03 bakkie Pluto[15545]: "vbict-rinusthuis" #129: Peer ID is ID_IPV4_ADDR: '62.131.x.x'
Jul 19 12:13:03 bakkie Pluto[15545]: "vbict-rinusthuis" #129: ISAKMP SA established
Jul 19 12:14:09 bakkie Pluto[15545]: packet from 62.131.x.x:500: Informational Exchange is for an unknown (expired?) SA
Jul 19 12:14:09 bakkie Pluto[15545]: "vbict-rinusthuis" #128: ignoring Delete SA payload
Jul 19 12:14:09 bakkie Pluto[15545]: "vbict-rinusthuis" #128: received and ignored informational message
Jul 19 12:14:09 bakkie Pluto[15545]: "vbict-rinusthuis" #129: ignoring Delete SA payload
Jul 19 12:14:09 bakkie Pluto[15545]: "vbict-rinusthuis" #129: received and ignored informational message
Jul 19 12:14:12 bakkie Pluto[15545]: "vbict-rinusthuis" #130: responding to Main Mode
Jul 19 12:14:12 bakkie Pluto[15545]: "vbict-rinusthuis" #130: OAKLEY_DES_CBC is not supported. Attribute OAKLEY_ENCRYPTION_ALGORITHM
Jul 19 12:14:12 bakkie Pluto[15545]: "vbict-rinusthuis" #130: OAKLEY_DES_CBC is not supported. Attribute OAKLEY_ENCRYPTION_ALGORITHM
Jul 19 12:14:12 bakkie Pluto[15545]: "vbict-rinusthuis" #130: only OAKLEY_GROUP_MODP1024 and OAKLEY_GROUP_MODP1536 supported. Attribute OAKLEY_GROUP_DESCRIPTION
Jul 19 12:14:15 bakkie Pluto[15545]: "vbict-rinusthuis" #130: Peer ID is ID_IPV4_ADDR: '62.131.x.x'
Jul 19 12:14:15 bakkie Pluto[15545]: "vbict-rinusthuis" #130: sent MR3, ISAKMP SA established
Jul 19 12:14:15 bakkie Pluto[15545]: "vbict-rinusthuis" #131: responding to Quick Mode
Jul 19 12:14:16 bakkie Pluto[15545]: "vbict-rinusthuis" #131: IPsec SA established
Jul 19 12:16:00 bakkie Pluto[15545]: | no phase 1 state where one should be
Jul 19 12:16:00 bakkie Pluto[15545]: | no phase 1 state where one should be
Jul 19 12:17:35 bakkie Pluto[15545]: "vbict-rinusthuis" #132: initiating Main Mode to replace #130
Jul 19 12:17:39 bakkie Pluto[15545]: "vbict-rinusthuis" #132: Peer ID is ID_IPV4_ADDR: '62.131.x.x'
Jul 19 12:17:39 bakkie Pluto[15545]: "vbict-rinusthuis" #132: ISAKMP SA established
Jul 19 12:17:39 bakkie Pluto[15545]: "vbict-rinusthuis" #133: initiating Quick Mode PSK+ENCRYPT+TUNNEL to replace #131
Jul 19 12:17:39 bakkie Pluto[15545]: "vbict-rinusthuis" #133: sent QI2, IPsec SA established
Jul 19 12:18:26 bakkie Pluto[15545]: | no phase 1 state where one should be
Jul 19 12:18:26 bakkie Pluto[15545]: | no phase 1 state where one should be
Jul 19 12:19:07 bakkie Pluto[15545]: "vbict-rinusthuis" #134: initiating Quick Mode PSK+ENCRYPT+TUNNEL to replace #133
Jul 19 12:19:07 bakkie Pluto[15545]: "vbict-rinusthuis" #134: sent QI2, IPsec SA established
Jul 19 12:19:30 bakkie Pluto[15545]: "vbict-rinusthuis" #135: initiating Main Mode to replace #132
Jul 19 12:19:34 bakkie Pluto[15545]: "vbict-rinusthuis" #135: Peer ID is ID_IPV4_ADDR: '62.131.x.x'
Jul 19 12:19:34 bakkie Pluto[15545]: "vbict-rinusthuis" #135: ISAKMP SA established
+ _________________________ date
+ date
Fri Jul 19 12:19:59 CEST 2002


Wat doet i hier: initiating Main Mode to replace #130
En hier: packet from 62.131.x.x:500: Informational Exchange is for an unknown (expired?) SA


Heeft er iemand verstand van FreeSwan/IPsec/Vigor

[igmar]

Op vrijdag 19 juli 2002 12:44 schreef marc.de.vries het volgende:

Wat doet i hier: initiating Main Mode to replace #130
En hier: packet from 62.131.x.x:500: Informational Exchange is for an unknown (expired?) SA


Heeft er iemand verstand van FreeSwan/IPsec/Vigor

single DES wordt niet ondersteund (en da's hetgeen de Vigor wil gebruiken).

[Verwijderd]

Wat kan ik het best doen ?

Waarom heb ik dan 4 minuten wel connectie ?

Dit staat er in de Vigor VPN connections 3DES-MD5 dus
1 ( VBN ) IPSec Tunnel 3DES-MD5 Auth 62.131.x.x 192.168.1.0/24 102 60 102 60 0 : 1 : 43

Door wat wordt single DES niet ondersteund? FreeSwan ?

[Verwijderd]

===============Verbinding maken=========================

Jul 19 15:24:14 bakkie Pluto[23499]: "vbict-rinusthuis" #65: Peer ID is ID_IPV4_ADDR: '62.131.153.104'
Jul 19 15:24:14 bakkie Pluto[23499]: "vbict-rinusthuis" #65: sent MR3, ISAKMP SA established
Jul 19 15:24:14 bakkie Pluto[23499]: "vbict-rinusthuis" #66: responding to Quick Mode
Jul 19 15:24:14 bakkie Pluto[23499]: "vbict-rinusthuis" #66: IPsec SA established

==================IPSEC zeurt wat=======================

Jul 19 15:25:47 bakkie Pluto[23499]: | no phase 1 state where one should be
Jul 19 15:25:47 bakkie Pluto[23499]: | no phase 1 state where one should be
Jul 19 15:27:29 bakkie Pluto[23499]: | no phase 1 state where one should be
Jul 19 15:27:29 bakkie Pluto[23499]: | no phase 1 state where one should be
Jul 19 15:27:34 bakkie Pluto[23499]: "vbict-rinusthuis" #67: initiating Quick Mode PSK+ENCRYPT+TUNNEL to replace #66
Jul 19 15:27:34 bakkie Pluto[23499]: "vbict-rinusthuis" #68: initiating Main Mode to replace #65
Jul 19 15:27:34 bakkie Pluto[23499]: "vbict-rinusthuis"
#67: sent QI2, IPsec SA established
Jul 19 15:27:38 bakkie Pluto[23499]: "vbict-rinusthuis" #68: Peer ID is ID_IPV4_ADDR: '62.131.153.104'
Jul 19 15:27:38 bakkie Pluto[23499]: "vbict-rinusthuis"

=======================================================
>>> Hier ergens is de verbinding dus al weg GRRRRR!!!
>>> 4 minuten

#68: ISAKMP SA established
Jul 19 15:28:24 bakkie Pluto[23499]: | no phase 1 state where one should be

=======================================================
>>> Nadat de verbinding weg is zecht ipsec dit nog

Jul 19 15:29:11 bakkie Pluto[23499]: "vbict-rinusthuis" #69: initiating Main Mode to replace #68
Jul 19 15:29:15 bakkie Pluto[23499]: "vbict-rinusthuis" #69: Peer ID is ID_IPV4_ADDR: '62.131.153.104'
Jul 19 15:29:15 bakkie Pluto[23499]: "vbict-rinusthuis" #69: ISAKMP SA established
Jul 19 15:29:46 bakkie Pluto[23499]: "vbict-rinusthuis" #70: initiating Quick Mode PSK+ENCRYPT+TUNNEL to replace #67
Jul 19 15:29:46 bakkie Pluto[23499]: "vbict-rinusthuis" #70: sent QI2, IPsec SA established
Jul 19 15:30:25 bakkie Pluto[23499]: "vbict-rinusthuis" #71: initiating Main Mode to replace #69
Jul 19 15:30:29 bakkie Pluto[23499]: "vbict-rinusthuis" #71: Peer ID is ID_IPV4_ADDR: '62.131.153.104'
Jul 19 15:30:29 bakkie Pluto[23499]: "vbict-rinusthuis" #71: ISAKMP SA established

=======================================================
Daarna gaat hij dit de hele tijd herhalen tot dat je de verbinding dropt vanaf de Vigor


Jul 19 15:31:44 bakkie Pluto[23499]: | no phase 1 state where one should be
Jul 19 15:31:44 bakkie Pluto[23499]: | no phase 1 state where one should be
Jul 19 15:31:45 bakkie Pluto[23499]: "vbict-rinusthuis" #72: initiating Quick Mode PSK+ENCRYPT+TUNNEL to replace #70
Jul 19 15:31:45 bakkie Pluto[23499]: packet from 62.131.153.104:500: Informational Exchange is for an unknown (expired?) SA
Jul 19 15:31:45 bakkie Pluto[23499]: "vbict-rinusthuis" #72: sent QI2, IPsec SA established
Jul 19 15:31:48 bakkie Pluto[23499]: packet from 62.131.153.104:500: Informational Exchange is for an unknown (expired?) SA
Jul 19 15:32:52 bakkie Pluto[23499]: "vbict-rinusthuis" #73: initiating Quick Mode PSK+ENCRYPT+TUNNEL to replace #72
Jul 19 15:32:53 bakkie Pluto[23499]: "vbict-rinusthuis" #73: sent QI2, IPsec SA established
Jul 19 15:32:55 bakkie Pluto[23499]: "vbict-rinusthuis" #74: initiating Main Mode to replace #71
Jul 19 15:33:00 bakkie Pluto[23499]: "vbict-rinusthuis" #74: Peer ID is ID_IPV4_ADDR: '62.131.153.104'
Jul 19 15:33:00 bakkie Pluto[23499]: "vbict-rinusthuis" #74: ISAKMP SA established
Jul 19 15:33:24 bakkie Pluto[23499]: "vbict-rinusthuis" #69: ignoring Delete SA payload
Jul 19 15:33:24 bakkie Pluto[23499]: "vbict-rinusthuis" #69: received and ignored informational message
Jul 19 15:33:56 bakkie Pluto[23499]: | no phase 1 state where one should be
Jul 19 15:33:56 bakkie Pluto[23499]: | no phase 1 state where one should be


Wie ken me helpen PLEASE

[Verwijderd]

Dit staat in /etc/ipsec.conf

# left = me
# right = peer (62.131.y.y, 192.168.2.0/24)
conn vbict-rinusthuis
esp=3des-md5-96
type=tunnel
left=62.131.x.x IPSEC BAK
leftnexthop=195.190.241.165
leftsubnet=192.168.1.0/24
right=62.131.y.y VIGOR
rightnexthop=195.190.241.165
rightsubnet=192.168.2.0/24
keyexchange=ike
auth=esp
keylife=250s hmmz 250 sec 4min. +
keyingtries=2
rekeymargin=100s
rekeyfuzz=100%
ikelifetime=250s <<<< toeval NOT
disablearrivalcheck=no
pfs=no
authby=secret
auto=add


Rekeyen gaat niet goed wie weet daar iets voor (UPDATE ???)

[Verwijderd]

Op vrijdag 19 juli 2002 14:52 schreef marc.de.vries het volgende:
Door wat wordt single DES niet ondersteund? FreeSwan ?

Yup, zat toevallig net de documentatie door te lezen. Ze doen alleen 3DES, omdat single DES niet veilig is. Ik kan je voor de rest helaas niet helpen met IPSEC, want ik ga binnenkort pas voor de eerste keer mee stoeien.

[Verwijderd]

Dat is toch mooi liever 3DES dan single DES ???