<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-family: Verdana,Geneva,sans-serif'>
<p>Hi.</p>
<p>What would it be the problem with an ipsec setup witch constantly rekey (every 30 seconds)?</p>
<p>One side is a debian strongswan 5.1.0 and the other is a cisco device.</p>
<p>At the log I have, among other lines:</p>
<p>Nov 4 17:39:48 vpnipsec charon: 16[IKE] IKE_SA dtbcisco[1] established between LEFT_IP[LEFT_ID]...RIGHT_IP[RIGHT_ID]<br />...<br />Nov 4 17:39:48 vpnipsec charon: 16[IKE] scheduling reauthentication in 14397s<br />Nov 4 17:39:48 vpnipsec charon: 16[IKE] maximum IKE_SA lifetime 14400s<br />...<br />Nov 4 17:39:48 vpnipsec charon: 11[ENC] parsed QUICK_MODE request 2783151246 [ HASH SA No ID ID ]<br />Nov 4 17:39:48 vpnipsec charon: 11[IKE] received 4608000000 lifebytes, configured 0<br />...<br />Nov 4 17:39:48 vpnipsec charon: 09[IKE] CHILD_SA dtbcisco{1} established with SPIs c49c75de_i 9488c540_o and TS LEFTSUBNET_IP === RIGHTSUBNET_IP <br />Nov 4 17:39:48 vpnipsec vpn: + RIGHT_ID %any/0 == RIGHT_IP -- LEFT_IP == LEFTSUBNET_IP</p>
<p> </p>
<p>At this point, the tunnel is up and the traffic flows ok. Then, about 30 seconds later:</p>
<p>Nov 4 17:40:12 vpnipsec charon: 09[IKE] sending keep alive to RIGHT_IP[4500]<br />Nov 4 17:40:18 vpnipsec charon: 15[NET] received packet: from RIGHT_IP[4500] to LEFT_IP[4500] (172 bytes)<br />Nov 4 17:40:18 vpnipsec charon: 15[ENC] parsed QUICK_MODE request 2321010703 [ HASH SA No ID ID ]<br />Nov 4 17:40:18 vpnipsec charon: 15[IKE] received 4608000000 lifebytes, configured 0<br />Nov 4 17:40:18 vpnipsec charon: 15[IKE] detected rekeying of CHILD_SA dtbcisco{1}<br />...<br />Nov 4 17:40:18 vpnipsec charon: 13[IKE] CHILD_SA dtbcisco{1} established with SPIs ca63057c_i 4bdfb1b8_o and TS LEFTSUBNET_IP === RIGHTSUBNET_IP <br />Nov 4 17:40:18 vpnipsec charon: 14[NET] received packet: from RIGHT_IP[4500] to LEFT_IP[4500] (76 bytes)<br />Nov 4 17:40:18 vpnipsec charon: 14[ENC] parsed INFORMATIONAL_V1 request 1304793497 [ HASH D ]<br />Nov 4 17:40:18 vpnipsec charon: 14[IKE] received DELETE for ESP CHILD_SA with SPI ac38214d<br />Nov 4 17:40:18 vpnipsec charon: 14[IKE] CHILD_SA not found, ignored</p>
<p>Then, another 30 seconds later:</p>
<p>Nov 4 17:40:42 vpnipsec charon: 07[IKE] sending keep alive to RIGHT_IP[4500]<br />Nov 4 17:40:48 vpnipsec charon: 11[NET] received packet: from RIGHT_IP[4500] to LEFT_IP[4500] (84 bytes)<br />Nov 4 17:40:48 vpnipsec charon: 11[ENC] parsed INFORMATIONAL_V1 request 231368514 [ HASH D ]<br />Nov 4 17:40:48 vpnipsec charon: 11[IKE] received DELETE for IKE_SA dtbcisco[1]<br />Nov 4 17:40:48 vpnipsec charon: 11[IKE] deleting IKE_SA dtbcisco[1] between LEFT_IP[LEFT_ID]...RIGHT_IP[RIGHT_ID]<br />Nov 4 17:40:48 vpnipsec vpn: - RIGHT_ID %any/0 == RIGHT_IP -- LEFT_IP == LEFTSUBNET_IP<br />Nov 4 17:40:48 vpnipsec charon: 11[CHD] updown: iptables: Bad rule (does a matching rule exist in that chain?).<br />Nov 4 17:40:48 vpnipsec charon: 11[CHD] updown: iptables: Bad rule (does a matching rule exist in that chain?).<br />Nov 4 17:40:48 vpnipsec vpn: - RIGHT_ID %any/0 == RIGHT_IP -- LEFT_IP == LEFTSUBNET_IP</p>
<p> </p>
<p>One minute later and the cicle starts over.</p>
<p>I've tried to setup lifebytes=4608000000 but it didn't make difference.<br />I've tried dpddelay=0 and even dpdaction=none, also without success. Tried inactivity=0 too.</p>
<p> </p>
<p>Could it be a cisco misbehavior?</p>
<p> </p>
<p>Thanks for the attention.</p>
<p> </p>
<p> </p>
<div>-- <br /><!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><!--[if gte mso 9]><xml>
<o:DocumentProperties>
<o:Author>marcsson</o:Author>
<o:LastAuthor>marcsson</o:LastAuthor>
<o:Revision>4</o:Revision>
<o:TotalTime>1</o:TotalTime>
<o:Created>2012-05-09T14:16:00Z</o:Created>
<o:LastSaved>2012-05-09T14:40:00Z</o:LastSaved>
<o:Pages>1</o:Pages>
<o:Words>133</o:Words>
<o:Characters>723</o:Characters>
<o:Lines>6</o:Lines>
<o:Paragraphs>1</o:Paragraphs>
<o:CharactersWithSpaces>855</o:CharactersWithSpaces>
<o:Version>14.00</o:Version>
</o:DocumentProperties>
<o:OfficeDocumentSettings>
<o:AllowPNG/>
</o:OfficeDocumentSettings>
</xml><![endif]-->
<p><span style="font-size: 7.5pt; font-family: 'Arial','sans-serif';"><br /> </span><span><img id="_x0000_i1025" src="http://www.databras.com.br/download/assinaturas/assinatura_email_bruno.gif" alt="" width="314" height="139" /></span></p>
<div class="WordSection1">
<p class="MsoNormal" style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto;"><span style="font-size: 7.5pt; font-family: 'Arial','sans-serif';"> </span></p>
</div>
<p><object id="fa6bcaaa-8879-9989-7ab9-2b8f3abba7a3" style="position: absolute; left: 0px; top: 0px;" width="0" height="0" type="application/gas-events-bb"></object></p>
</div>
</body></html>