<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Have an issue I've never seen before. Connecting to a remote Cisco router. Have verified settings on the cisco, our rekey options look the same. We get an established connection, then 30 seconds later a rekey happens
and it installs under the new one. This goes on forever. Here are the logs showing the original and 1 rekey. If allowed to continue the number of SA increments as such:</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"></p>
<div>
<div>Connections:</div>
<div> sph-main: x.x.x.x...x.x.x.x IKEv1, dpddelay=15s</div>
<div> sph-main: local: [x.x.x.x] uses pre-shared key authentication</div>
<div> sph-main: remote: [x.x.x.x] uses pre-shared key authentication</div>
<div> sph-main: child: x.x.0.0/16 === x.x.x.x/28 TUNNEL, dpdaction=clear</div>
<div>Routed Connections:</div>
<div> sph-main{1}: ROUTED, TUNNEL, reqid 1</div>
<div> sph-main{1}: x.x.0.0/16 === x.x.x.x/28</div>
<div>Security Associations (1 up, 0 connecting):</div>
<div> sph-main[1]: ESTABLISHED 3 minutes ago, x.x.x.x[x.x.x.x]...x.x.x.x[x.x.x.x]</div>
<div> sph-main[1]: IKEv1 SPIs: 6a4fba86489e9e61_i a244a0079084bf87_r*, pre-shared key reauthentication in 7 hours</div>
<div> sph-main[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536</div>
<div> sph-main{2}: REKEYED, TUNNEL, reqid 1, expires in 7 hours</div>
<div> sph-main{2}: x.x.0.0/16 === x.x.x.x/28</div>
<div> sph-main{3}: REKEYED, TUNNEL, reqid 1, expires in 7 hours</div>
<div> sph-main{3}: x.x.0.0/16 === x.x.x.x/28</div>
<div> sph-main{4}: REKEYED, TUNNEL, reqid 1, expires in 7 hours</div>
<div> sph-main{4}: x.x.0.0/16 === x.x.x.x/28</div>
<div> sph-main{5}: REKEYED, TUNNEL, reqid 1, expires in 7 hours</div>
<div> sph-main{5}: x.x.0.0/16 === x.x.x.x/28</div>
<div> sph-main{6}: REKEYED, TUNNEL, reqid 1, expires in 7 hours</div>
<div> sph-main{6}: x.x.0.0/16 === x.x.x.x/28</div>
<div> sph-main{7}: REKEYED, TUNNEL, reqid 1, expires in 7 hours</div>
<div> sph-main{7}: x.x.0.0/16 === x.x.x.x/28</div>
<div> sph-main{8}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c781d0ed_i d0a8e566_o</div>
<div> sph-main{8}: AES_CBC_128/HMAC_SHA1_96/MODP_1536, 0 bytes_i, 0 bytes_o, rekeying in 7 hours</div>
<div> sph-main{8}: x.x.0.0/16 === x.x.x.x/28</div>
<div><br>
</div>
</div>
Here are my logs:
<p></p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"></p>
<div>Jul 24 03:17:31 ip-x-x-x-x journal: Suppressed 379 messages from /user.slice/user-x0.slice</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 11[NET] received packet: from x.x.x.x[500] to x.x.x.x[500] (34x bytes)</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 11[ENC] parsed ID_PROT request 0 [ KE No V V V NAT-D NAT-D ]</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 11[IKE] received DPD vendor ID</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 11[ENC] received unknown vendor ID: 9f:xx:1d:9b:4x:9f:9e:61:5e:40:3x:7e:a5:6a:96:1f</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 11[IKE] received XAuth vendor ID</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 11[IKE] local host is behind NAT, sending keep alives</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 11[ENC] generating ID_PROT response 0 [ KE No NAT-D NAT-D ]</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 11[NET] sending packet: from x.x.x.x[500] to x.x.x.x[500] (30x bytes)</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 12[NET] received packet: from x.x.x.x[4500] to x.x.x.x[4500] (10x bytes)</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 12[ENC] parsed ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 12[CFG] looking for pre-shared key peer configs matching x.x.x.x...x.x.x.x[x.x.x.x]</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 12[CFG] selected peer config "sph-main"</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 12[IKE] IKE_SA sph-main[1] established between x.x.x.x[13.251.151.1x]...x.x.x.x[x.x.x.x]</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 12[IKE] scheduling reauthentication in 2x02xs</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 12[IKE] maximum IKE_SA lifetime 2x56xs</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 12[ENC] generating ID_PROT response 0 [ ID HASH ]</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 12[NET] sending packet: from x.x.x.x[4500] to x.x.x.x[4500] (76 bytes)</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 14[NET] received packet: from x.x.x.x[4500] to x.x.x.x[4500] (3x0 bytes)</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 14[ENC] parsed QUICK_MODE request 225x9x7323 [ HASH SA No KE ID ID ]</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 14[IKE] received 460x000000 lifebytes, configured 0</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 14[ENC] generating QUICK_MODE response 225x9x7323 [ HASH SA No KE ID ID ]</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 14[NET] sending packet: from x.x.x.x[4500] to x.x.x.x[4500] (396 bytes)</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 15[NET] received packet: from x.x.x.x[4500] to x.x.x.x[4500] (60 bytes)</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 15[ENC] parsed QUICK_MODE request 225x9x7323 [ HASH ]</div>
<div>Jul 24 03:17:31 ip-x-x-x-x charon: 15[IKE] CHILD_SA sph-main{2} established with SPIs cx2f9f6f_i c4cx6290_o and TS x.x.0.0/16 === x.x.x.x/2x</div>
<div><br>
</div>
<div><br>
</div>
<div>Jul 24 03:17:46 ip-x-x-x-x charon: 05[IKE] sending DPD request</div>
<div>Jul 24 03:17:46 ip-x-x-x-x charon: 05[ENC] generating INFORMATIONAL_V1 request 43665939 [ HASH N(DPD) ]</div>
<div>Jul 24 03:17:46 ip-x-x-x-x charon: 05[NET] sending packet: from x.x.x.x[4500] to x.x.x.x[4500] (92 bytes)</div>
<div>Jul 24 03:17:46 ip-x-x-x-x charon: 07[NET] received packet: from x.x.x.x[4500] to x.x.x.x[4500] (92 bytes)</div>
<div>Jul 24 03:17:46 ip-x-x-x-x charon: 07[ENC] parsed INFORMATIONAL_V1 request 1316377373 [ HASH N(DPD_ACK) ]</div>
<div>Jul 24 03:1x:01 ip-x-x-x-x charon: 09[IKE] sending DPD request</div>
<div>Jul 24 03:1x:01 ip-x-x-x-x charon: 09[ENC] generating INFORMATIONAL_V1 request 2941x32606 [ HASH N(DPD) ]</div>
<div>Jul 24 03:1x:01 ip-x-x-x-x charon: 09[NET] sending packet: from x.x.x.x[4500] to x.x.x.x[4500] (92 bytes)</div>
<div>Jul 24 03:1x:01 ip-x-x-x-x charon: 10[NET] received packet: from x.x.x.x[4500] to x.x.x.x[4500] (92 bytes)</div>
<div>Jul 24 03:1x:01 ip-x-x-x-x charon: 10[ENC] parsed INFORMATIONAL_V1 request 465745044 [ HASH N(DPD_ACK) ]</div>
<div>Jul 24 03:1x:02 ip-x-x-x-x charon: 11[NET] received packet: from x.x.x.x[4500] to x.x.x.x[4500] (3x0 bytes)</div>
<div>Jul 24 03:1x:02 ip-x-x-x-x charon: 11[ENC] parsed QUICK_MODE request 1506132661 [ HASH SA No KE ID ID ]</div>
<div>Jul 24 03:1x:02 ip-x-x-x-x charon: 11[IKE] received 460x000000 lifebytes, configured 0</div>
<div>Jul 24 03:1x:02 ip-x-x-x-x charon: 11[IKE] detected rekeying of CHILD_SA sph-main{2}</div>
<div>Jul 24 03:1x:02 ip-x-x-x-x charon: 11[ENC] generating QUICK_MODE response 1506132661 [ HASH SA No KE ID ID ]</div>
<div>Jul 24 03:1x:02 ip-x-x-x-x charon: 11[NET] sending packet: from x.x.x.x[4500] to x.x.x.x[4500] (396 bytes)</div>
<div>Jul 24 03:1x:02 ip-x-x-x-x charon: 12[NET] received packet: from x.x.x.x[4500] to x.x.x.x[4500] (60 bytes)</div>
<div>Jul 24 03:1x:02 ip-x-x-x-x charon: 12[ENC] parsed QUICK_MODE request 1506132661 [ HASH ]</div>
<div>Jul 24 03:1x:02 ip-x-x-x-x charon: 12[IKE] CHILD_SA sph-main{3} established with SPIs c3cf290a_i 1cab665a_o and TS x.x.0.0/16 === x.x.x.x/2x</div>
<div><br>
</div>
Thank you in advance for any insight into resolving this.
<p></p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Sincerely,</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="background-color:rgb(255,255,255)">
<p style="margin:0in 0in 0.0001pt"></p>
<p style="font-size:12pt; color:rgb(0,0,0); margin:0in 0in 0.0001pt"><font face="Helvetica, sans-serif"><b>Doug Tucker</b></font></p>
<p style="color:rgb(0,0,0); margin:0in 0in 0.0001pt"><br>
</p>
<p style="font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif; color:rgb(0,0,0); margin:0in 0in 0.0001pt; min-height:13px">
<br>
</p>
<p></p>
<p style="font-size:12pt; font-family:Calibri,Arial,Helvetica,sans-serif; color:rgb(0,0,0); margin:0in 0in 0.0001pt">
<span style="font-size:8.5pt; font-family:"Helvetica",sans-serif; color:#88898B"></span></p>
</div>
</div>
</div>
</body>
</html>