Hall of Fame

1. JFrederic...35,450
2. lrmoore33,932
3. MikeKane33,565
4. bignewf31,648
5. ikalmar28,425
6. RobWill23,749
7. arnold22,751
8. jodylemoine21,600
9. dpk_wal21,550
10. asavener20,650
11. Qlemo19,735
12. deimark18,355
13. kenboonejr14,500
14. 3nerds13,600
15. surbabu1...11,950
16. mitrushi11,500
17. batry_boy11,000
18. RPPreacher9,250
19. MrHusy8,416
20. Paranorm...7,664
21. equalizer7,500
22. Quori7,125
23. ccomley7,000
24. decoleur6,844
25. PeteLong6,700
25. geergon6,700

1. lrmoore434,514
2. RobWill220,523
3. batry_boy130,817
4. richrumble111,117
5. rsivanandan66,407
6. dpk_wal65,975
7. arnold61,186
8. JFrederic...55,250
9. ahoffmann44,523
10. Cyclops3...41,977
11. MikeKane40,065
12. bignewf36,048
13. decoleur35,858
14. grblades35,012
15. harbor23534,898
16. pseudocy...34,059
17. PeteLong29,855
18. Qlemo29,075
19. ikalmar28,425
20. tim_holman27,445
21. kbbcnet26,524
22. MrHusy26,116
23. ebjers25,140
24. RPPreacher24,592
25. Voltz-dk24,020

	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

5.8

IPSec Renegotiating even though it's already conected

Asked by TTCLIVE in IPSec Security Protocol, Virtual Private Networking (VPN), Miscellaneous Networking

Tags: Secure Computing and Linksys, SnapGear SG550 and BEFSX41, Snapgear at one location, Linksys at another.

I have a SnapGear SG550 at my main location doing IPSec tunnels for two remote loactions (for IP phones and network resources). The remote locations both have Linksys BEFSX41's and are configured with the same settings (excluding preshared secret and ip scheme - one is 192.168.1.0 and other is 192.168.2.0) to communicate with my SnapGear at my main location.

I have had one of the tunnels working fine now for a couple weeks and am adding the second tunnel with some issues. The second tunnel on the 192.168.1.0 ip setup is connected and it says "Running" for the status, but it also says "Renegotiating Phase 1 and Renegotiating Phase 2" like it's trying to connect...but it's already connected!

I'm wondering how to get the tunnel to stop trying to connect to a connection it's already connected to.

Below is a part of the Log on the SnapGear that is showing what it's trying to do as well as my IPSEC config file showing my local settings for those tunnels.

***** Just so we don't get off on a tangent about my keylife time, I need to make sure the tunnel does not drp duting the day, so I have it set to 24 hours before it rekeys. The SnapGear keeps the tunnel open, but the Linksys seems to drop the tunel completely and renegotiate every time the key is renegotiated so this seems to be working as a workaround for that problem. *****

View the Solution FREE for 30 Days

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:

           
           
             Feb 28 09:36:53 Pluto[171]: (20080228T093653253) "Phx2WA" #2623: IPsec SA established
Feb 28 09:37:01 Pluto[171]: (20080228T093701078) "Phx2WA" #2621: next payload type of ISAKMP Identification Payload has an unknown value: 91
Feb 28 09:37:01 Pluto[171]: (20080228T093701081) "Phx2WA" #2621: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet 
Feb 28 09:37:20 Pluto[171]: (20080228T093720901) "Phx2WA" #2621: next payload type of ISAKMP Identification Payload has an unknown value: 188
Feb 28 09:37:20 Pluto[171]: (20080228T093720905) "Phx2WA" #2621: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Feb 28 09:37:56 Pluto[171]: (20080228T093756913) "Phx2WA" #2620: max number of retransmissions (2) reached STATE_QUICK_I1
Feb 28 09:37:56 Pluto[171]: (20080228T093756915) "Phx2WA" #2620: starting keying attempt 768 of an unlimited number
Feb 28 09:37:56 Pluto[171]: (20080228T093757004) "Phx2WA" #2624: initiating Quick Mode PSK+ENCRYPT+TUNNEL to replace #2620
Feb 28 09:37:57 Pluto[171]: (20080228T093757077) "Phx2WA" #2622: ignoring informational payload, type NO_PROPOSAL_CHOSEN
Feb 28 09:37:57 Pluto[171]: (20080228T093757078) "Phx2WA" #2622: Notification: Pid=3 SPIsz=4 Type=14 Val=p\036\243W\012
Feb 28 09:37:57 Pluto[171]: (20080228T093757079) "Phx2WA" #2622: received and ignored informational message
Feb 28 09:37:57 Pluto[171]: (20080228T093757342) "Phx2WA" #2625: responding to Main Mode
Feb 28 09:37:58 Pluto[171]: (20080228T093758994) "Phx2WA" #2625: sent MR3, ISAKMP SA established
Feb 28 09:37:59 Pluto[171]: (20080228T093759067) "Phx2WA" #2626: responding to Quick Mode
Feb 28 09:37:59 Pluto[171]: (20080228T093759185) "Phx2WA" #2626: IPsec SA established
___________________________________________________________________
 
config setup
	interfaces = %defaultroute
	X-enabled = yes
	klipsdebug = none
	plutodebug = none
	plutoload = %search
	plutostart = %search
	overridemtu = 1500
	manualstart = 
	uniqueids = yes
 
conn Phx2TX
	type = tunnel
	leftsubnet = 192.168.0.0/24
	rightsubnet = 192.168.2.0/24
	left = %defaultroute
	x-interface = %defaultroute
	right = DOMAINNAME*.gotdns.com
	auto = start
	keyexchange = ike
	authby = secret
	auth = esp
	pfs = no
	pfsgroup = MODP1024
	leftid = vpn@DOMAINNAME*.gotdns.com
	rightid = TEXAS_Linksys
	ike = "3DES-MD5-MODP768"
	esp = "3DES-SHA1"
	keyingtries = 0
	ikelifetime = 86400
	keylife = 86400
	rekeymargin = 600
	rekeyfuzz = 100%
	x-l2tpd = no
 
conn Phx2WA
	type = tunnel
	leftsubnet = 192.168.0.0/24
	rightsubnet = 192.168.1.0/24
	left = %defaultroute
	x-interface = %defaultroute
	right = DOMAINNAME*.gotdns.com
	auto = start
	keyexchange = ike
	authby = secret
	auth = esp
	pfs = no
	pfsgroup = MODP1024
	leftid = vpn@DOMAINNAME*.gotdns.com
	rightid = WA_Linksys
	ike = "3DES-MD5-MODP768"
	esp = "3DES-SHA1"
	keyingtries = 0
	ikelifetime = 86400
	keylife = 86400
	rekeymargin = 600
	rekeyfuzz = 100%
	x-l2tpd = no
           
         

IPSec Renegotiating even though it's already conected

Asked by TTCLIVE in IPSec Security Protocol, Virtual Private Networking (VPN), Miscellaneous Networking

Tags: Secure Computing and Linksys, SnapGear SG550 and BEFSX41, Snapgear at one location, Linksys at another.

About this solution