Re: Pix doesn't respond after a while
Kindy Sylla <[email protected]> Wed, 10 May 2006 12:14:14 +0200 (CEST)
| Newsgroups | gmane.comp.security.vpn |
|---|---|
| Message-ID | <[email protected]> |
--===============0865754710== Content-Type: multipart/alternative; boundary="0-2135792730-1147256054=:59041" Content-Transfer-Encoding: 7bit --0-2135792730-1147256054=:59041 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Hi Chris, =20 Thanks for the suggestion. =20 I verify and the otherside has the same lifetime value. =20 Any other idea? Any help would be great!!! =20 Kindy Meidinger Chris <[email protected]> a =E9crit : Hi Kindy, It sounds like the tunnel lifetimes are not the same. You have 'isakmp policy 9 lifetime 86400' which means that the tunnel wil= l be torn down and renegotiated after 86400 seconds. Does the other side = have the same lifetime? If not, the peer gateway won't be ready to reneg = the tunnel and will (probably) spit out a Bad SPI log message for each of= your side's negotiation attempts. That's definately the first thing to check! HTH, Chris -----Original Message----- From: [email protected] on behalf = of Kindy Sylla Sent: Tue 09-May-06 10:55 To: [email protected] Subject: [VPN] Pix doesn't respond after a while Hi, =20 I am having a strange behaviour with a Cisco PIX Firewall Version 6.3(5= ). The configuration is done , the VPN are created between the 2 differen= ts sites. The probl=E8me is after 5 to 6 hours of running, the ping to th= e remote hosts doesn't go through. When i try to ping a remote host, I se= e the followings line in the debug icmp trace: =20 -request from inside:10.102.158.152 to 10.5.113.142 ID=3D512 seq=3D5376= length=3D40 44: ICMP echo-request: translating inside:10.102.158.152 to outside:10.10= 2.158.152 45: ICMP echo-request from inside:10.102.158.152 to 10.5.113.142 ID=3D512= seq=3D5632 length=3D40 46: ICMP echo-request: translating inside:10.102.158.152 to outside:10.10= 2.158.152 And When remote host try to ping a local machine, i can see the request= coming without any reply. =20 To get the ping work , we have to reload it. =20 Do you have any idea?=20 =20 Please find below my config file : PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password N7FecZuSHJlVZC2P encrypted passwd N7FecZuSHJlVZC2P encrypted hostname pixbenin domain-name boabenin.bj fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list acl_vpn permit icmp 10.102.156.0 255.255.252.0 192.168.0.0 25= 5.255.255.0 access-list acl_vpn permit ip 10.102.156.0 255.255.252.0 192.168.0.0 255.= 255.255.0 access-list acl_blgo permit icmp 10.102.156.0 255.255.252.0 10.5.113.128 = 255.255.255.224 access-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.5.113.128 25= 5.255.255.224 access-list acl_blgo permit icmp 10.102.156.0 255.255.252.0 10.102.128.0 = 255.255.254.0 access-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.102.128.0 25= 5.255.254.0 access-list acl_blgo permit icmp 10.102.156.0 255.255.252.0 10.102.130.0 = 255.255.255.128 access-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.102.130.0 25= 5.255.255.128 pager lines 24 mtu outside 500 mtu inside 1500 ip address outside 81.91.235.147 255.255.255.192 ip address inside 10.102.155.135 255.255.255.128 ip audit info action alarm ip audit attack action alarm pdm history enable arp timeout 14400 nat (inside) 0 10.102.156.0 255.255.252.0 0 0 route outside 0.0.0.0 0.0.0.0 81.91.235.129 1 route inside 10.102.156.0 255.255.252.0 10.102.155.129 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:0= 0:00 ip audit attack action alarm pdm history enable arp timeout 14400 nat (inside) 0 10.102.156.0 255.255.252.0 0 0 route outside 0.0.0.0 0.0.0.0 81.91.235.129 1 route inside 10.102.156.0 255.255.252.0 10.102.155.129 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:0= 0:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set strong esp-3des esp-sha-hmac crypto dynamic-map dynmap 30 set transform-set strong crypto map toX 20 ipsec-isakmp crypto map toX 20 match address acl_vpn crypto map toX 20 set peer 196.200.82.35 crypto map toX 20 set transform-set strong crypto map toX 30 ipsec-isakmp crypto map toX 30 match address acl_blgo crypto ipsec transform-set strong esp-3des esp-sha-hmac crypto dynamic-map dynmap 30 set transform-set strong crypto map toX 20 ipsec-isakmp crypto map toX 20 match address acl_vpn crypto map toX 20 set peer 196.200.82.35 crypto map toX 20 set transform-set strong crypto map toX 30 ipsec-isakmp crypto map toX 30 match address acl_blgo crypto map toX 30 set peer 194.78.211.130 crypto map toX 30 set transform-set strong crypto map toX 9990 ipsec-isakmp dynamic dynmap crypto map toX interface outside isakmp enable outside isakmp key ******** address 196.200.82.35 netmask 255.255.255.255 isakmp key ******** address 194.78.211.130 netmask 255.255.255.255 isakmp identity address isakmp policy 9 authentication pre-share isakmp policy 9 encryption 3des isakmp policy 9 hash sha isakmp policy 9 group 1 isakmp policy 9 lifetime 86400 isakmp policy 19 authentication pre-share isakmp policy 19 encryption 3des isakmp policy 19 hash sha isakmp policy 19 group 2 isakmp policy 19 lifetime 86400 telnet timeout 5 ssh 194.7.174.162 255.255.255.255 outside ssh 194.7.174.163 255.255.255.255 outside ssh 10.102.156.0 255.255.252.0 inside ssh 10.102.155.0 255.255.255.0 inside ssh timeout 5 console timeout 0 terminal width 80 Cryptochecksum:7458b1b938134f7d52ed82d4e2003210 =20 Regrds, =20 Kindy =20 =20 --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directem= ent vos services pr=E9f=E9r=E9s : v=E9rifiez vos nouveaux mails, lancez v= os recherches et suivez l'actualit=E9 en temps r=E9el. Cliquez ici. =09 --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directem= ent vos services pr=E9f=E9r=E9s : v=E9rifiez vos nouveaux mails, lancez v= os recherches et suivez l'actualit=E9 en temps r=E9el. Cliquez ici. --0-2135792730-1147256054=:59041 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable <div>Hi Chris,</div> <div> </div> <div>Thanks for the suggestion.<= /div> <div> </div> <div>I verify and the otherside has the same li= fetime value.</div> <div> </div> <div>Any other idea? Any help wou= ld be great!!!</div> <div> </div> <div>Kindy<BR><BR><B><I>Meidinge= r Chris <[email protected]></I></B> a =E9crit :</div>= <BLOCKQUOTE class=3Dreplbq style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px= ; BORDER-LEFT: #1010ff 2px solid"> <META content=3D"MS Exchange Server v= ersion 6.5.7226.0" name=3DGenerator><!-- Converted from text/plain format= --> <div><FONT size=3D2>Hi Kindy,<BR><BR>It sounds like the tunnel life= times are not the same.<BR><BR>You have 'isakmp policy 9 lifetime 86400' = which means that the tunnel will be torn down and renegotiated after 8640= 0 seconds. Does the other side have the same lifetime? If not, the peer g= ateway won't be ready to reneg the tunnel and will (probably) spit out a = Bad SPI log message for each of your side's negotiation attempts.<BR><BR>That's definately the first thing to check!= <BR><BR>HTH,<BR><BR>Chris<BR><BR>-----Original Message-----<BR>From: vpn-= [email protected] on behalf of Kindy S= ylla<BR>Sent: Tue 09-May-06 10:55<BR>To: [email protected]<BR>Subject: = [VPN] Pix doesn't respond after a while<BR><BR>Hi,<BR> <BR>&nb= sp; I am having a strange behaviour with a Cisco PIX Firewall Version 6.3= (5). The configuration is done , the VPN are created between the 2 differ= ents sites. The probl=E8me is after 5 to 6 hours of running, the ping to = the remote hosts doesn't go through. When i try to ping a remote host, I = see the followings line in the debug icmp trace:<BR> <BR> = ; -request from inside:10.102.158.152 to 10.5.113.142 ID=3D512 seq=3D5376= length=3D40<BR>44: ICMP echo-request: translating inside:10.102.158.152 = to outside:10.102.158.152<BR>45: ICMP echo-request from inside:10.102.158= .152 to 10.5.113.142 ID=3D512 seq=3D5632 length=3D40<BR>46: ICMP echo-request: translating inside:10.102.158.152 = to outside:10.102.158.152<BR><BR> And When remote host try to ping = a local machine, i can see the request coming without any reply.<BR> = ; <BR> To get the ping work , we have to reload it.<BR> &= nbsp;<BR> Do you have any idea? <BR> <BR> Ple= ase find below my config file :<BR> PIX Version 6.3(5)<BR>interface= ethernet0 auto<BR>interface ethernet1 auto<BR>nameif ethernet0 outside s= ecurity0<BR>nameif ethernet1 inside security100<BR>enable password N7FecZ= uSHJlVZC2P encrypted<BR>passwd N7FecZuSHJlVZC2P encrypted<BR>hostname pix= benin<BR>domain-name boabenin.bj<BR>fixup protocol dns maximum-length 512= <BR>fixup protocol ftp 21<BR>fixup protocol h323 h225 1720<BR>fixup proto= col h323 ras 1718-1719<BR>fixup protocol http 80<BR>fixup protocol rsh 51= 4<BR>fixup protocol rtsp 554<BR>fixup protocol sip 5060<BR>fixup protocol= sip udp 5060<BR>fixup protocol skinny 2000<BR>fixup protocol smtp 25<BR>fixup protocol sqlnet 1521<BR>fixup pr= otocol http 80<BR>fixup protocol rsh 514<BR>fixup protocol rtsp 554<BR>fi= xup protocol sip 5060<BR>fixup protocol sip udp 5060<BR>fixup protocol sk= inny 2000<BR>fixup protocol smtp 25<BR>fixup protocol sqlnet 1521<BR>fixu= p protocol tftp 69<BR>names<BR>access-list acl_vpn permit icmp 10.102.156= .0 255.255.252.0 192.168.0.0 255.255.255.0<BR>access-list acl_vpn permit = ip 10.102.156.0 255.255.252.0 192.168.0.0 255.255.255.0<BR>access-list ac= l_blgo permit icmp 10.102.156.0 255.255.252.0 10.5.113.128 255.255.255.22= 4<BR>access-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.5.113.1= 28 255.255.255.224<BR>access-list acl_blgo permit icmp 10.102.156.0 255.2= 55.252.0 10.102.128.0 255.255.254.0<BR>access-list acl_blgo permit ip 10.= 102.156.0 255.255.252.0 10.102.128.0 255.255.254.0<BR>access-list acl_blg= o permit icmp 10.102.156.0 255.255.252.0 10.102.130.0 255.255.255.128<BR>= access-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.102.130.0 255.255.255.128<BR>pager lines 2= 4<BR>mtu outside 500<BR>mtu inside 1500<BR>ip address outside 81.91.235.1= 47 255.255.255.192<BR>ip address inside 10.102.155.135 255.255.255.128<BR= >ip audit info action alarm<BR>ip audit attack action alarm<BR>pdm histor= y enable<BR>arp timeout 14400<BR>nat (inside) 0 10.102.156.0 255.255.252.= 0 0 0<BR>route outside 0.0.0.0 0.0.0.0 81.91.235.129 1<BR>route inside 10= .102.156.0 255.255.252.0 10.102.155.129 1<BR>timeout xlate 3:00:00<BR>tim= eout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:0= 0<BR>ip audit attack action alarm<BR>pdm history enable<BR>arp timeout 14= 400<BR>nat (inside) 0 10.102.156.0 255.255.252.0 0 0<BR>route outside 0.0= .0.0 0.0.0.0 81.91.235.129 1<BR>route inside 10.102.156.0 255.255.252.0 1= 0.102.155.129 1<BR>timeout xlate 3:00:00<BR>timeout conn 1:00:00 half-clo= sed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00<BR>timeout h323 0:05:00 = mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00<BR>timeout sip-disconnect 0:02:00 sip-invite 0:03:00<BR>timeout = uauth 0:05:00 absolute<BR>aaa-server TACACS+ protocol tacacs+<BR>aaa-serv= er TACACS+ max-failed-attempts 3<BR>aaa-server TACACS+ deadtime 10<BR>aaa= -server RADIUS protocol radius<BR>aaa-server RADIUS max-failed-attempts 3= <BR>aaa-server RADIUS deadtime 10<BR>aaa-server LOCAL protocol local<BR>n= o snmp-server location<BR>no snmp-server contact<BR>snmp-server community= public<BR>no snmp-server enable traps<BR>floodguard enable<BR>sysopt con= nection permit-ipsec<BR>crypto ipsec transform-set strong esp-3des esp-sh= a-hmac<BR>crypto dynamic-map dynmap 30 set transform-set strong<BR>crypto= map toX 20 ipsec-isakmp<BR>crypto map toX 20 match address acl_vpn<BR>cr= ypto map toX 20 set peer 196.200.82.35<BR>crypto map toX 20 set transform= -set strong<BR>crypto map toX 30 ipsec-isakmp<BR>crypto map toX 30 match = address acl_blgo<BR>crypto ipsec transform-set strong esp-3des esp-sha-hm= ac<BR>crypto dynamic-map dynmap 30 set transform-set strong<BR>crypto map toX 20 ipsec-isakmp<BR>crypto map toX= 20 match address acl_vpn<BR>crypto map toX 20 set peer 196.200.82.35<BR>= crypto map toX 20 set transform-set strong<BR>crypto map toX 30 ipsec-isa= kmp<BR>crypto map toX 30 match address acl_blgo<BR>crypto map toX 30 set = peer 194.78.211.130<BR>crypto map toX 30 set transform-set strong<BR>cryp= to map toX 9990 ipsec-isakmp dynamic dynmap<BR>crypto map toX interface o= utside<BR>isakmp enable outside<BR>isakmp key ******** address 196.200.82= .35 netmask 255.255.255.255<BR>isakmp key ******** address 194.78.211.130= netmask 255.255.255.255<BR>isakmp identity address<BR>isakmp policy 9 au= thentication pre-share<BR>isakmp policy 9 encryption 3des<BR>isakmp polic= y 9 hash sha<BR>isakmp policy 9 group 1<BR>isakmp policy 9 lifetime 86400= <BR>isakmp policy 19 authentication pre-share<BR>isakmp policy 19 encrypt= ion 3des<BR>isakmp policy 19 hash sha<BR>isakmp policy 19 group 2<BR>isak= mp policy 19 lifetime 86400<BR>telnet timeout 5<BR>ssh 194.7.174.162 255.255.255.255 outside<BR>ssh 194.7.174.= 163 255.255.255.255 outside<BR>ssh 10.102.156.0 255.255.252.0 inside<BR>s= sh 10.102.155.0 255.255.255.0 inside<BR>ssh timeout 5<BR>console timeout = 0<BR>terminal width 80<BR>Cryptochecksum:7458b1b938134f7d52ed82d4e2003210= <BR> <BR>Regrds,<BR> <BR> Kindy<BR> <BR>= <BR> &n= bsp; <BR>---------------------------------<BR> Faites de = Yahoo! votre page d'accueil sur le web pour retrouver directement vos ser= vices pr=E9f=E9r=E9s : v=E9rifiez vos nouveaux mails, lancez vos recherch= es et suivez l'actualit=E9 en temps r=E9el. Cliquez ici.<BR><BR></FONT></= div></BLOCKQUOTE><BR><p> <hr size=3D"1" />=20 <b>Faites de Yahoo! votre page d'accueil sur le web</b> pour retrouver di= rectement vos services pr=E9f=E9r=E9s : v=E9rifiez vos nouveaux mails, la= ncez vos recherches et suivez l'actualit=E9 en temps r=E9el. <a href=3D"h= ttp://us.rd.yahoo.com/mail/mail_taglines/yahoofr/*http://fr.yahoo.com/set= " target=3D_blank>Cliquez ici</a>. --0-2135792730-1147256054=:59041-- --===============0865754710== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ VPN mailing list [email protected] http://lists.shmoo.com/mailman/listinfo/vpn --===============0865754710==--