All Tunnels rekeying after exactly 60 seconds.
-
Hello everybody,
About 2 days ago, I've switched from a standard single Pfsense BOX to two PFSense Boxes using CARP. (both using Pfsense 2.2.5)
Before this change, everything was just fine.
I manage to change every tunnel Interface to the CARP interface/address.
After that change, all my IPsec tunnels are now rekeying every 60 seconds.
All my tunnels are using IKEv1, Mutual PKS, Main Mode and 28800 Phase 1 lifetime.
Can anyone shed a light on this situation?Best Regards.
Bellow, a snipped LOG from ipsec.log (I have changed the peers addresses)
Aug 29 11:43:02 washington charon: 12[NET] <con1000|127369>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:43:02 washington charon: 12[IKE] <con1000|127369>received retransmit of response with ID 0, but next request already sent
Aug 29 11:43:04 washington charon: 13[NET] <con1000|127369>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:43:04 washington charon: 13[IKE] <con1000|127369>received retransmit of response with ID 0, but next request already sent
Aug 29 11:43:06 washington charon: 13[NET] <con1000|127369>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:43:06 washington charon: 13[IKE] <con1000|127369>received retransmit of response with ID 0, but next request already sent
Aug 29 11:43:08 washington charon: 13[NET] <con1000|127369>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:43:08 washington charon: 13[IKE] <con1000|127369>received retransmit of response with ID 0, but next request already sent
Aug 29 11:43:10 washington charon: 14[NET] <con1000|127369>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:43:10 washington charon: 14[IKE] <con1000|127369>received retransmit of response with ID 0, but next request already sent
Aug 29 11:43:10 washington charon: 11[IKE] <con1000|127366>IKE_SA con1000[127366] state change: REKEYING => DESTROYING
Aug 29 11:43:12 washington charon: 14[NET] <con1000|127369>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:43:12 washington charon: 14[IKE] <con1000|127369>received retransmit of response with ID 0, but next request already sent
Aug 29 11:43:16 washington charon: 14[NET] <con1000|127369>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:43:16 washington charon: 14[IKE] <con1000|127369>received retransmit of response with ID 0, but next request already sent
Aug 29 11:43:20 washington charon: 07[NET] <con1000|127369>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:43:20 washington charon: 07[IKE] <con1000|127369>received retransmit of response with ID 0, but next request already sent
Aug 29 11:43:24 washington charon: 16[NET] <con1000|127369>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:43:24 washington charon: 16[IKE] <con1000|127369>received retransmit of response with ID 0, but next request already sent
Aug 29 11:43:28 washington charon: 13[NET] <con1000|127369>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:43:28 washington charon: 13[IKE] <con1000|127369>received retransmit of response with ID 0, but next request already sent
Aug 29 11:43:32 washington charon: 05[NET] <con1000|127369>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:43:32 washington charon: 05[IKE] <con1000|127369>received retransmit of response with ID 0, but next request already sent
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>old path is not available anymore, try to find another
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>looking for a route to 200.200.200.2 …
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>reauthenticating IKE_SA due to address change
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>reauthenticating IKE_SA con1000[127369]
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>queueing ISAKMP_VENDOR task
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>queueing ISAKMP_CERT_PRE task
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>queueing MAIN_MODE task
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>queueing ISAKMP_CERT_POST task
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>queueing ISAKMP_NATD task
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>activating new tasks
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>activating ISAKMP_VENDOR task
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>activating ISAKMP_CERT_PRE task
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>activating MAIN_MODE task
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>activating ISAKMP_CERT_POST task
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>activating ISAKMP_NATD task
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>sending XAuth vendor ID
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>sending DPD vendor ID
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>sending Cisco Unity vendor ID
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>sending FRAGMENTATION vendor ID
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>sending NAT-T (RFC 3947) vendor ID
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>sending draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>initiating Main Mode IKE_SA con1000[127390] to 200.200.200.2
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>IKE_SA con1000[127390] state change: CREATED => CONNECTING
Aug 29 11:44:00 washington charon: 15[CFG] <con1000|127369>configured proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:44:00 washington charon: 15[ENC] <con1000|127369>generating ID_PROT request 0 [ SA V V V V V V ]
Aug 29 11:44:00 washington charon: 15[NET] <con1000|127369>sending packet: from 200.186.200.5[500] to 200.200.200.2[500] (196 bytes)
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>activating new tasks
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127369>nothing to initiate
Aug 29 11:44:00 washington charon: 15[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (100 bytes)
Aug 29 11:44:00 washington charon: 15[ENC] <con1000|127390>parsed ID_PROT response 0 [ SA V ]
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127390>received FRAGMENTATION vendor ID
Aug 29 11:44:00 washington charon: 15[CFG] <con1000|127390>selecting proposal:
Aug 29 11:44:00 washington charon: 15[CFG] <con1000|127390>proposal matches
Aug 29 11:44:00 washington charon: 15[CFG] <con1000|127390>received proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:44:00 washington charon: 15[CFG] <con1000|127390>configured proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:44:00 washington charon: 15[CFG] <con1000|127390>selected proposal: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127390>reinitiating already active tasks
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127390>ISAKMP_VENDOR task
Aug 29 11:44:00 washington charon: 15[IKE] <con1000|127390>MAIN_MODE task
Aug 29 11:44:00 washington charon: 15[ENC] <con1000|127390>generating ID_PROT request 0 [ KE No ]
Aug 29 11:44:00 washington charon: 15[NET] <con1000|127390>sending packet: from 200.186.200.5[500] to 200.200.200.2[500] (196 bytes)
Aug 29 11:44:00 washington charon: 07[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (184 bytes)
Aug 29 11:44:00 washington charon: 07[ENC] <con1000|127390>parsed ID_PROT response 0 [ KE No ]
Aug 29 11:44:00 washington charon: 07[IKE] <con1000|127390>reinitiating already active tasks
Aug 29 11:44:00 washington charon: 07[IKE] <con1000|127390>ISAKMP_VENDOR task
Aug 29 11:44:00 washington charon: 07[IKE] <con1000|127390>MAIN_MODE task
Aug 29 11:44:00 washington charon: 07[ENC] <con1000|127390>generating ID_PROT request 0 [ ID HASH ]
Aug 29 11:44:00 washington charon: 07[NET] <con1000|127390>sending packet: from 200.186.200.5[500] to 200.200.200.2[500] (68 bytes)
Aug 29 11:44:00 washington charon: 05[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:44:00 washington charon: 05[ENC] <con1000|127390>parsed ID_PROT response 0 [ ID HASH ]
Aug 29 11:44:00 washington charon: 05[IKE] <con1000|127390>IKE_SA con1000[127390] established between 200.186.200.5[200.186.200.5]…200.200.200.2[200.200.200.2]
Aug 29 11:44:00 washington charon: 05[IKE] <con1000|127390>IKE_SA con1000[127390] state change: CONNECTING => ESTABLISHED
Aug 29 11:44:00 washington charon: 05[IKE] <con1000|127390>scheduling reauthentication in 28168s
Aug 29 11:44:00 washington charon: 05[IKE] <con1000|127390>maximum IKE_SA lifetime 28708s
Aug 29 11:44:00 washington charon: 05[IKE] <con1000|127390>DPD not supported by peer, disabled
Aug 29 11:44:00 washington charon: 05[IKE] <con1000|127390>activating new tasks
Aug 29 11:44:00 washington charon: 05[IKE] <con1000|127390>nothing to initiate
Aug 29 11:44:02 washington charon: 16[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:44:02 washington charon: 16[IKE] <con1000|127390>received retransmit of response with ID 0, but next request already sent
Aug 29 11:44:04 washington charon: 05[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:44:04 washington charon: 05[IKE] <con1000|127390>received retransmit of response with ID 0, but next request already sent
Aug 29 11:44:06 washington charon: 05[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:44:06 washington charon: 05[IKE] <con1000|127390>received retransmit of response with ID 0, but next request already sent
Aug 29 11:44:08 washington charon: 16[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:44:08 washington charon: 16[IKE] <con1000|127390>received retransmit of response with ID 0, but next request already sent
Aug 29 11:44:10 washington charon: 16[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:44:10 washington charon: 16[IKE] <con1000|127390>received retransmit of response with ID 0, but next request already sent
Aug 29 11:44:10 washington charon: 15[IKE] <con1000|127369>IKE_SA con1000[127369] state change: REKEYING => DESTROYING
Aug 29 11:44:12 washington charon: 15[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:44:12 washington charon: 15[IKE] <con1000|127390>received retransmit of response with ID 0, but next request already sent
Aug 29 11:44:16 washington charon: 16[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:44:16 washington charon: 16[IKE] <con1000|127390>received retransmit of response with ID 0, but next request already sent
Aug 29 11:44:20 washington charon: 06[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:44:20 washington charon: 06[IKE] <con1000|127390>received retransmit of response with ID 0, but next request already sent
Aug 29 11:44:24 washington charon: 11[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:44:24 washington charon: 11[IKE] <con1000|127390>received retransmit of response with ID 0, but next request already sent
Aug 29 11:44:28 washington charon: 11[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:44:28 washington charon: 11[IKE] <con1000|127390>received retransmit of response with ID 0, but next request already sent
Aug 29 11:44:32 washington charon: 15[NET] <con1000|127390>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:44:32 washington charon: 15[IKE] <con1000|127390>received retransmit of response with ID 0, but next request already sent
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>old path is not available anymore, try to find another
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>looking for a route to 200.200.200.2 …
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>reauthenticating IKE_SA due to address change
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>reauthenticating IKE_SA con1000[127390]
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>queueing ISAKMP_VENDOR task
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>queueing ISAKMP_CERT_PRE task
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>queueing MAIN_MODE task
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>queueing ISAKMP_CERT_POST task
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>queueing ISAKMP_NATD task
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>activating new tasks
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>activating ISAKMP_VENDOR task
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>activating ISAKMP_CERT_PRE task
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>activating MAIN_MODE task
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>activating ISAKMP_CERT_POST task
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>activating ISAKMP_NATD task
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>sending XAuth vendor ID
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>sending DPD vendor ID
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>sending Cisco Unity vendor ID
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>sending FRAGMENTATION vendor ID
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>sending NAT-T (RFC 3947) vendor ID
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>sending draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>initiating Main Mode IKE_SA con1000[127405] to 200.200.200.2
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>IKE_SA con1000[127405] state change: CREATED => CONNECTING
Aug 29 11:45:00 washington charon: 10[CFG] <con1000|127390>configured proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:45:00 washington charon: 10[ENC] <con1000|127390>generating ID_PROT request 0 [ SA V V V V V V ]
Aug 29 11:45:00 washington charon: 10[NET] <con1000|127390>sending packet: from 200.186.200.5[500] to 200.200.200.2[500] (196 bytes)
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>activating new tasks
Aug 29 11:45:00 washington charon: 10[IKE] <con1000|127390>nothing to initiate
Aug 29 11:45:00 washington charon: 08[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (100 bytes)
Aug 29 11:45:00 washington charon: 08[ENC] <con1000|127405>parsed ID_PROT response 0 [ SA V ]
Aug 29 11:45:00 washington charon: 08[IKE] <con1000|127405>received FRAGMENTATION vendor ID
Aug 29 11:45:00 washington charon: 08[CFG] <con1000|127405>selecting proposal:
Aug 29 11:45:00 washington charon: 08[CFG] <con1000|127405>proposal matches
Aug 29 11:45:00 washington charon: 08[CFG] <con1000|127405>received proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:45:00 washington charon: 08[CFG] <con1000|127405>configured proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:45:00 washington charon: 08[CFG] <con1000|127405>selected proposal: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:45:00 washington charon: 08[IKE] <con1000|127405>reinitiating already active tasks
Aug 29 11:45:00 washington charon: 08[IKE] <con1000|127405>ISAKMP_VENDOR task
Aug 29 11:45:00 washington charon: 08[IKE] <con1000|127405>MAIN_MODE task
Aug 29 11:45:00 washington charon: 08[ENC] <con1000|127405>generating ID_PROT request 0 [ KE No ]
Aug 29 11:45:00 washington charon: 08[NET] <con1000|127405>sending packet: from 200.186.200.5[500] to 200.200.200.2[500] (196 bytes)
Aug 29 11:45:00 washington charon: 14[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (184 bytes)
Aug 29 11:45:00 washington charon: 14[ENC] <con1000|127405>parsed ID_PROT response 0 [ KE No ]
Aug 29 11:45:00 washington charon: 14[IKE] <con1000|127405>reinitiating already active tasks
Aug 29 11:45:00 washington charon: 14[IKE] <con1000|127405>ISAKMP_VENDOR task
Aug 29 11:45:00 washington charon: 14[IKE] <con1000|127405>MAIN_MODE task
Aug 29 11:45:00 washington charon: 14[ENC] <con1000|127405>generating ID_PROT request 0 [ ID HASH ]
Aug 29 11:45:00 washington charon: 14[NET] <con1000|127405>sending packet: from 200.186.200.5[500] to 200.200.200.2[500] (68 bytes)
Aug 29 11:45:00 washington charon: 07[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:45:00 washington charon: 07[ENC] <con1000|127405>parsed ID_PROT response 0 [ ID HASH ]
Aug 29 11:45:00 washington charon: 07[IKE] <con1000|127405>IKE_SA con1000[127405] established between 200.186.200.5[200.186.200.5]…200.200.200.2[200.200.200.2]
Aug 29 11:45:00 washington charon: 07[IKE] <con1000|127405>IKE_SA con1000[127405] state change: CONNECTING => ESTABLISHED
Aug 29 11:45:00 washington charon: 07[IKE] <con1000|127405>scheduling reauthentication in 27793s
Aug 29 11:45:00 washington charon: 07[IKE] <con1000|127405>maximum IKE_SA lifetime 28333s
Aug 29 11:45:00 washington charon: 07[IKE] <con1000|127405>DPD not supported by peer, disabled
Aug 29 11:45:00 washington charon: 07[IKE] <con1000|127405>activating new tasks
Aug 29 11:45:00 washington charon: 07[IKE] <con1000|127405>nothing to initiate
Aug 29 11:45:02 washington charon: 13[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:45:02 washington charon: 13[IKE] <con1000|127405>received retransmit of response with ID 0, but next request already sent
Aug 29 11:45:04 washington charon: 11[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:45:04 washington charon: 11[IKE] <con1000|127405>received retransmit of response with ID 0, but next request already sent
Aug 29 11:45:06 washington charon: 04[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:45:06 washington charon: 04[IKE] <con1000|127405>received retransmit of response with ID 0, but next request already sent
Aug 29 11:45:08 washington charon: 15[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:45:08 washington charon: 15[IKE] <con1000|127405>received retransmit of response with ID 0, but next request already sent
Aug 29 11:45:10 washington charon: 06[IKE] <con1000|127390>IKE_SA con1000[127390] state change: REKEYING => DESTROYING
Aug 29 11:45:10 washington charon: 07[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:45:10 washington charon: 07[IKE] <con1000|127405>received retransmit of response with ID 0, but next request already sent
Aug 29 11:45:12 washington charon: 13[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:45:12 washington charon: 13[IKE] <con1000|127405>received retransmit of response with ID 0, but next request already sent
Aug 29 11:45:16 washington charon: 06[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:45:16 washington charon: 06[IKE] <con1000|127405>received retransmit of response with ID 0, but next request already sent
Aug 29 11:45:20 washington charon: 16[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:45:20 washington charon: 16[IKE] <con1000|127405>received retransmit of response with ID 0, but next request already sent
Aug 29 11:45:24 washington charon: 11[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:45:24 washington charon: 11[IKE] <con1000|127405>received retransmit of response with ID 0, but next request already sent
Aug 29 11:45:28 washington charon: 08[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:45:28 washington charon: 08[IKE] <con1000|127405>received retransmit of response with ID 0, but next request already sent
Aug 29 11:45:32 washington charon: 05[NET] <con1000|127405>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:45:32 washington charon: 05[IKE] <con1000|127405>received retransmit of response with ID 0, but next request already sent
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>old path is not available anymore, try to find another
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>looking for a route to 200.200.200.2 …
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>reauthenticating IKE_SA due to address change
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>reauthenticating IKE_SA con1000[127405]
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>queueing ISAKMP_VENDOR task
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>queueing ISAKMP_CERT_PRE task
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>queueing MAIN_MODE task
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>queueing ISAKMP_CERT_POST task
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>queueing ISAKMP_NATD task
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>activating new tasks
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>activating ISAKMP_VENDOR task
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>activating ISAKMP_CERT_PRE task
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>activating MAIN_MODE task
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>activating ISAKMP_CERT_POST task
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>activating ISAKMP_NATD task
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>sending XAuth vendor ID
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>sending DPD vendor ID
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>sending Cisco Unity vendor ID
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>sending FRAGMENTATION vendor ID
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>sending NAT-T (RFC 3947) vendor ID
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>sending draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>initiating Main Mode IKE_SA con1000[127423] to 200.200.200.2
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>IKE_SA con1000[127423] state change: CREATED => CONNECTING
Aug 29 11:46:00 washington charon: 08[CFG] <con1000|127405>configured proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:46:00 washington charon: 08[ENC] <con1000|127405>generating ID_PROT request 0 [ SA V V V V V V ]
Aug 29 11:46:00 washington charon: 08[NET] <con1000|127405>sending packet: from 200.186.200.5[500] to 200.200.200.2[500] (196 bytes)
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>activating new tasks
Aug 29 11:46:00 washington charon: 08[IKE] <con1000|127405>nothing to initiate
Aug 29 11:46:00 washington charon: 06[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (100 bytes)
Aug 29 11:46:00 washington charon: 06[ENC] <con1000|127423>parsed ID_PROT response 0 [ SA V ]
Aug 29 11:46:00 washington charon: 06[IKE] <con1000|127423>received FRAGMENTATION vendor ID
Aug 29 11:46:00 washington charon: 06[CFG] <con1000|127423>selecting proposal:
Aug 29 11:46:00 washington charon: 06[CFG] <con1000|127423>proposal matches
Aug 29 11:46:00 washington charon: 06[CFG] <con1000|127423>received proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:46:00 washington charon: 06[CFG] <con1000|127423>configured proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:46:00 washington charon: 06[CFG] <con1000|127423>selected proposal: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:46:00 washington charon: 06[IKE] <con1000|127423>reinitiating already active tasks
Aug 29 11:46:00 washington charon: 06[IKE] <con1000|127423>ISAKMP_VENDOR task
Aug 29 11:46:00 washington charon: 06[IKE] <con1000|127423>MAIN_MODE task
Aug 29 11:46:00 washington charon: 06[ENC] <con1000|127423>generating ID_PROT request 0 [ KE No ]
Aug 29 11:46:00 washington charon: 06[NET] <con1000|127423>sending packet: from 200.186.200.5[500] to 200.200.200.2[500] (196 bytes)
Aug 29 11:46:00 washington charon: 04[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (184 bytes)
Aug 29 11:46:00 washington charon: 04[ENC] <con1000|127423>parsed ID_PROT response 0 [ KE No ]
Aug 29 11:46:00 washington charon: 04[IKE] <con1000|127423>reinitiating already active tasks
Aug 29 11:46:00 washington charon: 04[IKE] <con1000|127423>ISAKMP_VENDOR task
Aug 29 11:46:00 washington charon: 04[IKE] <con1000|127423>MAIN_MODE task
Aug 29 11:46:00 washington charon: 04[ENC] <con1000|127423>generating ID_PROT request 0 [ ID HASH ]
Aug 29 11:46:00 washington charon: 04[NET] <con1000|127423>sending packet: from 200.186.200.5[500] to 200.200.200.2[500] (68 bytes)
Aug 29 11:46:00 washington charon: 04[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:46:00 washington charon: 04[ENC] <con1000|127423>parsed ID_PROT response 0 [ ID HASH ]
Aug 29 11:46:00 washington charon: 04[IKE] <con1000|127423>IKE_SA con1000[127423] established between 200.186.200.5[200.186.200.5]…200.200.200.2[200.200.200.2]
Aug 29 11:46:00 washington charon: 04[IKE] <con1000|127423>IKE_SA con1000[127423] state change: CONNECTING => ESTABLISHED
Aug 29 11:46:00 washington charon: 04[IKE] <con1000|127423>scheduling reauthentication in 28163s
Aug 29 11:46:00 washington charon: 04[IKE] <con1000|127423>maximum IKE_SA lifetime 28703s
Aug 29 11:46:00 washington charon: 04[IKE] <con1000|127423>DPD not supported by peer, disabled
Aug 29 11:46:00 washington charon: 04[IKE] <con1000|127423>activating new tasks
Aug 29 11:46:00 washington charon: 04[IKE] <con1000|127423>nothing to initiate
Aug 29 11:46:02 washington charon: 05[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:46:02 washington charon: 05[IKE] <con1000|127423>received retransmit of response with ID 0, but next request already sent
Aug 29 11:46:04 washington charon: 15[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:46:04 washington charon: 15[IKE] <con1000|127423>received retransmit of response with ID 0, but next request already sent
Aug 29 11:46:06 washington charon: 16[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:46:06 washington charon: 16[IKE] <con1000|127423>received retransmit of response with ID 0, but next request already sent
Aug 29 11:46:08 washington charon: 04[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:46:08 washington charon: 04[IKE] <con1000|127423>received retransmit of response with ID 0, but next request already sent
Aug 29 11:46:10 washington charon: 14[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:46:10 washington charon: 14[IKE] <con1000|127423>received retransmit of response with ID 0, but next request already sent
Aug 29 11:46:10 washington charon: 07[IKE] <con1000|127405>IKE_SA con1000[127405] state change: REKEYING => DESTROYING
Aug 29 11:46:12 washington charon: 06[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:46:12 washington charon: 06[IKE] <con1000|127423>received retransmit of response with ID 0, but next request already sent
Aug 29 11:46:16 washington charon: 07[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:46:16 washington charon: 07[IKE] <con1000|127423>received retransmit of response with ID 0, but next request already sent
Aug 29 11:46:20 washington charon: 07[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:46:20 washington charon: 07[IKE] <con1000|127423>received retransmit of response with ID 0, but next request already sent
Aug 29 11:46:24 washington charon: 12[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:46:24 washington charon: 12[IKE] <con1000|127423>received retransmit of response with ID 0, but next request already sent
Aug 29 11:46:28 washington charon: 12[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:46:28 washington charon: 12[IKE] <con1000|127423>received retransmit of response with ID 0, but next request already sent
Aug 29 11:46:32 washington charon: 06[NET] <con1000|127423>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:46:32 washington charon: 06[IKE] <con1000|127423>received retransmit of response with ID 0, but next request already sent
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>old path is not available anymore, try to find another
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>looking for a route to 200.200.200.2 …
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>reauthenticating IKE_SA due to address change
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>reauthenticating IKE_SA con1000[127423]
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>queueing ISAKMP_VENDOR task
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>queueing ISAKMP_CERT_PRE task
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>queueing MAIN_MODE task
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>queueing ISAKMP_CERT_POST task
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>queueing ISAKMP_NATD task
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>activating new tasks
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>activating ISAKMP_VENDOR task
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>activating ISAKMP_CERT_PRE task
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>activating MAIN_MODE task
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>activating ISAKMP_CERT_POST task
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>activating ISAKMP_NATD task
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>sending XAuth vendor ID
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>sending DPD vendor ID
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>sending Cisco Unity vendor ID
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>sending FRAGMENTATION vendor ID
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>sending NAT-T (RFC 3947) vendor ID
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>sending draft-ietf-ipsec-nat-t-ike-02\n vendor ID
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>initiating Main Mode IKE_SA con1000[127428] to 200.200.200.2
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>IKE_SA con1000[127428] state change: CREATED => CONNECTING
Aug 29 11:47:00 washington charon: 05[CFG] <con1000|127423>configured proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:47:00 washington charon: 05[ENC] <con1000|127423>generating ID_PROT request 0 [ SA V V V V V V ]
Aug 29 11:47:00 washington charon: 05[NET] <con1000|127423>sending packet: from 200.186.200.5[500] to 200.200.200.2[500] (196 bytes)
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>activating new tasks
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127423>nothing to initiate
Aug 29 11:47:00 washington charon: 04[NET] <con1000|127428>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (100 bytes)
Aug 29 11:47:00 washington charon: 04[ENC] <con1000|127428>parsed ID_PROT response 0 [ SA V ]
Aug 29 11:47:00 washington charon: 04[IKE] <con1000|127428>received FRAGMENTATION vendor ID
Aug 29 11:47:00 washington charon: 04[CFG] <con1000|127428>selecting proposal:
Aug 29 11:47:00 washington charon: 04[CFG] <con1000|127428>proposal matches
Aug 29 11:47:00 washington charon: 04[CFG] <con1000|127428>received proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:47:00 washington charon: 04[CFG] <con1000|127428>configured proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:47:00 washington charon: 04[CFG] <con1000|127428>selected proposal: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Aug 29 11:47:00 washington charon: 04[IKE] <con1000|127428>reinitiating already active tasks
Aug 29 11:47:00 washington charon: 04[IKE] <con1000|127428>ISAKMP_VENDOR task
Aug 29 11:47:00 washington charon: 04[IKE] <con1000|127428>MAIN_MODE task
Aug 29 11:47:00 washington charon: 04[ENC] <con1000|127428>generating ID_PROT request 0 [ KE No ]
Aug 29 11:47:00 washington charon: 04[NET] <con1000|127428>sending packet: from 200.186.200.5[500] to 200.200.200.2[500] (196 bytes)
Aug 29 11:47:00 washington charon: 05[NET] <con1000|127428>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (184 bytes)
Aug 29 11:47:00 washington charon: 05[ENC] <con1000|127428>parsed ID_PROT response 0 [ KE No ]
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127428>reinitiating already active tasks
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127428>ISAKMP_VENDOR task
Aug 29 11:47:00 washington charon: 05[IKE] <con1000|127428>MAIN_MODE task
Aug 29 11:47:00 washington charon: 05[ENC] <con1000|127428>generating ID_PROT request 0 [ ID HASH ]
Aug 29 11:47:00 washington charon: 05[NET] <con1000|127428>sending packet: from 200.186.200.5[500] to 200.200.200.2[500] (68 bytes)
Aug 29 11:47:00 washington charon: 07[NET] <con1000|127428>received packet: from 200.200.200.2[500] to 200.186.200.5[500] (68 bytes)
Aug 29 11:47:00 washington charon: 07[ENC] <con1000|127428>parsed ID_PROT response 0 [ ID HASH ]
Aug 29 11:47:00 washington charon: 07[IKE] <con1000|127428>IKE_SA con1000[127428] established between 200.186.200.5[200.186.200.5]…200.200.200.2[200.200.200.2]
Aug 29 11:47:00 washington charon: 07[IKE] <con1000|127428>IKE_SA con1000[127428] state change: CONNECTING => ESTABLISHED
Aug 29 11:47:00 washington charon: 07[IKE] <con1000|127428>scheduling reauthentication in 28036s
Aug 29 11:47:00 washington charon: 07[IKE] <con1000|127428>maximum IKE_SA lifetime 28576s
Aug 29 11:47:00 washington charon: 07[IKE] <con1000|127428>DPD not supported by peer, disabled
Aug 29 11:47:00 washington charon: 07[IKE] <con1000|127428>activating new tasks
Aug 29 11:47:00 washington charon: 07[IKE] <con1000|127428>nothing to initiate</con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127428></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127405></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127423></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127390></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127405></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127369></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127390></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127366></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369></con1000|127369>