IPSEC tunnels all dropping at random times after upgrade from 1.2.3 to 2.0

Reply to IPSEC tunnels all dropping at random times after upgrade from 1.2.3 to 2.0 on Fri, 16 Sep 2011 15:10:56 GMT

afinkinfotech — Fri, 16 Sep 2011 15:10:56 GMT

Hello everyone,
Thank you for responses. I have since downgraded to 1.2.3 stable and have not had a tunnel drop out since. It is too bad because I really wanted to use some of the new functionality of pfSense 2.0 however, everyone is much happier now that the network is stable.

Andrew

Reply to IPSEC tunnels all dropping at random times after upgrade from 1.2.3 to 2.0 on Mon, 12 Sep 2011 17:51:40 GMT

dhatz — Mon, 12 Sep 2011 17:51:40 GMT

It's quite possible that the DPD (Dead Peer Detection) feature is the culprit for some of the problems with IPsec VPNs to third-party routers reported here, since pfSense 2.0 uses the latest racoon (ipsec-tools 0.8.0).

Have a look at the discussion and patch at ipsec-tools list:

http://sourceforge.net/mailarchive/forum.php?thread_name=4DA4F48F.1060809%40open.ch&forum_name=ipsec-tools-devel

Racoon (0.8.0) strictly checks the cookies within the encrypted part of
DPD messages. According to RFC 3706 section 5.3 [1], the SPI content may
contain the cookies, but it does not have to.

In comparison, pluto from openswan strictly checks the SPI size,
tolerating any SPI content. But the SPI size can be arbitrary as well,
according to RFC.

In the field I encountered a Cisco device (version/type unknown; Vendor
ID: CISCO-UNITY), which sends the cookies of the encrypted part of DPD
packets in reversed order, "violating" section 5.3 of RFC 3706 as I
understand the relevant phrase:

Security Parameter Index (16 octets) - SHOULD be set to the
cookies of the Initiator and Responder of the IKE SA (in that
order)

So my understanding is "you may put the cookies in there, and if you do,
they must come in the given order".

Since I fail to see any security implication, I produced this patch that
makes racoon ignore the cookie content in DPD acks. This is in full
compliance to RFC 3706 and allows racoon to use DPD with old Cisco
devices that send inverted cookies (initiator/responder) in the
encrypted part of the packets.

This patch can also make DPD work with other vendors that do not send
valid cookies within the DPD payload at all.

Because the sequence number, which is in the encrypted part of DPD
packets, is still being checked, this does not mean that racoon will
accept bogus DPD acks.

Reply to IPSEC tunnels all dropping at random times after upgrade from 1.2.3 to 2.0 on Thu, 01 Sep 2011 02:33:58 GMT

kalu — Thu, 01 Sep 2011 02:33:58 GMT

afinkinfotech thanks for the info
i already had tried that when this problem first aroused.
and doing that didn't helped me but for some it might work

changed mode to main mode
disabled DPD
ticked prefer old IPSEC
worked for 2-3 hours without any problem and raccon stops after that.
tried to read the log but could not find the actual cause.
friends at this forum suggested might be a mismatching configuration but that's not so because it works for hours.
so what i diagnosed was IPSEC between pfsense to pfsense is perfect but there might be problem with other hardwares in my case it was Trendnet Router.
thanks for sharing
kalu

Reply to IPSEC tunnels all dropping at random times after upgrade from 1.2.3 to 2.0 on Wed, 31 Aug 2011 19:20:00 GMT

afinkinfotech — Wed, 31 Aug 2011 19:20:00 GMT

Here is what I did, and I think it has resolved the issue:

1. Switched all tunnels to main mode.
2. Disabled DPD (Dead Peer Detection)

So far all good. *Knocking on wood.

Reply to IPSEC tunnels all dropping at random times after upgrade from 1.2.3 to 2.0 on Wed, 31 Aug 2011 11:58:41 GMT

kalu — Wed, 31 Aug 2011 11:58:41 GMT

i had quite similar issue with ipsec and i switched to open vpn
http://forum.pfsense.org/index.php/topic,39383.0.html
may be a bug in ipsec in v2
thanks

Reply to IPSEC tunnels all dropping at random times after upgrade from 1.2.3 to 2.0 on Wed, 31 Aug 2011 01:30:36 GMT

afinkinfotech — Wed, 31 Aug 2011 01:30:36 GMT

I have switched all of my tunnels to main mode as suggested to me in #pfSense IRC as well as suggested on a similar thread (http://forum.pfsense.org/index.php/topic,34595.0.html). I will report the success or failure, in a couple days.