Re: Pix doesn't respond after a while
Kindy Sylla <[email protected]> Wed, 10 May 2006 17:25:27 +0200 (CEST)
| Newsgroups | gmane.comp.security.vpn |
|---|---|
| Message-ID | <[email protected]> |
--===============0012002819== Content-Type: multipart/alternative; boundary="0-155198888-1147274727=:27639" Content-Transfer-Encoding: 7bit --0-155198888-1147274727=:27639 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Can you please tell me how to get the information you are requesting. Spe= cially how to get the log from the pix.. =20 Thanks!=20 Meidinger Chris <[email protected]> a =E9crit : =20 is a lot of data traversing the tunnel? maybe there is a size limit on = one side? can you post a log from the pix during while ping is not working? also, can you get a log from the remote peer at that same time? Chris -----Original Message----- From: Kindy Sylla [mailto:[email protected]] Sent: Wed 10-May-06 12:14 To: Meidinger Chris; [email protected] Subject: RE: [VPN] Pix doesn't respond after a while Hi Chris, =20 Thanks for the suggestion. =20 I verify and the otherside has the same lifetime value. =20 Any other idea? Any help would be great!!! =20 Kindy Meidinger Chris <[email protected]> a =E9crit : Hi Kindy, It sounds like the tunnel lifetimes are not the same. You have 'isakmp policy 9 lifetime 86400' which means that the tunnel wil= l be torn down and renegotiated after 86400 seconds. Does the other side = have the same lifetime? If not, the peer gateway won't be ready to reneg = the tunnel and will (probably) spit out a Bad SPI log message for each of= your side's negotiation attempts. That's definately the first thing to check! HTH, Chris -----Original Message----- From: [email protected] on behalf = of Kindy Sylla Sent: Tue 09-May-06 10:55 To: [email protected] Subject: [VPN] Pix doesn't respond after a while Hi, =20 I am having a strange behaviour with a Cisco PIX Firewall Version 6.3(5= ). The configuration is done , the VPN are created between the 2 differen= ts sites. The probl=E8me is after 5 to 6 hours of running, the ping to th= e remote hosts doesn't go through. When i try to ping a remote host, I se= e the followings line in the debug icmp trace: =20 -request from inside:10.102.158.152 to 10.5.113.142 ID=3D512 seq=3D5376= length=3D40 44: ICMP echo-request: translating inside:10.102.158.152 to outside:10.10= 2.158.152 45: ICMP echo-request from inside:10.102.158.152 to 10.5.113.142 ID=3D512= seq=3D5632 length=3D40 46: ICMP echo-request: translating inside:10.102.158.152 to outside:10.10= 2.158.152 And When remote host try to ping a local machine, i can see the request= coming without any reply. =20 To get the ping work , we have to reload it. =20 Do you have any idea? =20 Please find below my config file : PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password N7FecZuSHJlVZC2P encrypted passwd N7FecZuSHJlVZC2P encrypted hostname pixbenin domain-name boabenin.bj fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list acl_vpn permit icmp 10.102.156.0 255.255.252.0 192.168.0.0 25= 5.255.255.0 access-list acl_vpn permit ip 10.102.156.0 255.255.252.0 192.168.0.0 255.= 255.255.0 access-list acl_blgo permit icmp 10.102.156.0 255.255.252.0 10.5.113.128 = 255.255.255.224 access-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.5.113.128 25= 5.255.255.224 access-list acl_blgo permit icmp 10.102.156.0 255.255.252.0 10.102.128.0 = 255.255.254.0 access-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.102.128.0 25= 5.255.254.0 access-list acl_blgo permit icmp 10.102.156.0 255.255.252.0 10.102.130.0 = 255.255.255.128 access-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.102.130.0 25= 5.255.255.128 pager lines 24 mtu outside 500 mtu inside 1500 ip address outside 81.91.235.147 255.255.255.192 ip address inside 10.102.155.135 255.255.255.128 ip audit info action alarm ip audit attack action alarm pdm history enable arp timeout 14400 nat (inside) 0 10.102.156.0 255.255.252.0 0 0 route outside 0.0.0.0 0.0.0.0 81.91.235.129 1 route inside 10.102.156.0 255.255.252.0 10.102.155.129 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:0= 0:00 ip audit attack action alarm pdm history enable arp timeout 14400 nat (inside) 0 10.102.156.0 255.255.252.0 0 0 route outside 0.0.0.0 0.0.0.0 81.91.235.129 1 route inside 10.102.156.0 255.255.252.0 10.102.155.129 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:0= 0:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set strong esp-3des esp-sha-hmac crypto dynamic-map dynmap 30 set transform-set strong crypto map toX 20 ipsec-isakmp crypto map toX 20 match address acl_vpn crypto map toX 20 set peer 196.200.82.35 crypto map toX 20 set transform-set strong crypto map toX 30 ipsec-isakmp crypto map toX 30 match address acl_blgo crypto ipsec transform-set strong esp-3des esp-sha-hmac crypto dynamic-map dynmap 30 set transform-set strong crypto map toX 20 ipsec-isakmp crypto map toX 20 match address acl_vpn crypto map toX 20 set peer 196.200.82.35 crypto map toX 20 set transform-set strong crypto map toX 30 ipsec-isakmp crypto map toX 30 match address acl_blgo crypto map toX 30 set peer 194.78.211.130 crypto map toX 30 set transform-set strong crypto map toX 9990 ipsec-isakmp dynamic dynmap crypto map toX interface outside isakmp enable outside isakmp key ******** address 196.200.82.35 netmask 255.255.255.255 isakmp key ******** address 194.78.211.130 netmask 255.255.255.255 isakmp identity address isakmp policy 9 authentication pre-share isakmp policy 9 encryption 3des isakmp policy 9 hash sha isakmp policy 9 group 1 isakmp policy 9 lifetime 86400 isakmp policy 19 authentication pre-share isakmp policy 19 encryption 3des isakmp policy 19 hash sha isakmp policy 19 group 2 isakmp policy 19 lifetime 86400 telnet timeout 5 ssh 194.7.174.162 255.255.255.255 outside ssh 194.7.174.163 255.255.255.255 outside ssh 10.102.156.0 255.255.252.0 inside ssh 10.102.155.0 255.255.255.0 inside ssh timeout 5 console timeout 0 terminal width 80 Cryptochecksum:7458b1b938134f7d52ed82d4e2003210 Regrds, =20 Kindy =20 =20 --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directem= ent vos services pr=E9f=E9r=E9s : v=E9rifiez vos nouveaux mails, lancez v= os recherches et suivez l'actualit=E9 en temps r=E9el. Cliquez ici. =20 --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directem= ent vos services pr=E9f=E9r=E9s : v=E9rifiez vos nouveaux mails, lancez v= os recherches et suivez l'actualit=E9 en temps r=E9el. Cliquez ici. =09 --------------------------------- Yahoo! Mail r=E9invente le mail ! D=E9couvrez le nouveau Yahoo! Mail et = son interface r=E9volutionnaire. --0-155198888-1147274727=:27639 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable <div>Can you please tell me how to get the information you are requesting= . Specially how to get the log from the pix..</div> <div> </div> <= div>Thanks! <BR><B><I>Meidinger Chris <[email protected]><= /I></B> a =E9crit :</div> <BLOCKQUOTE class=3Dreplbq style=3D"PADDI= NG-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #1010ff 2px solid"> <META c= ontent=3D"MS Exchange Server version 6.5.7226.0" name=3DGenerator><!-- Co= nverted from text/plain format --><BR> <div><FONT size=3D2>is a lot of d= ata traversing the tunnel? maybe there is a size limit on one side?<BR><B= R>can you post a log from the pix during while ping is not working?<BR><B= R>also, can you get a log from the remote peer at that same time?<BR><BR>= Chris<BR><BR>-----Original Message-----<BR>From: Kindy Sylla [<A href=3D"= mailto:[email protected]">mailto:[email protected]</A>]<BR>Sent: Wed 10-May= -06 12:14<BR>To: Meidinger Chris; [email protected]<BR>Subject: RE: [VP= N] Pix doesn't respond after a while<BR><BR>Hi Chris,<BR> <BR> Thanks for the suggestion.<BR> &nb= sp;<BR> I verify and the otherside has the same lifetime value.<BR>= <BR> Any other idea? Any help would be great!!!<BR>&nbs= p; <BR> Kindy<BR><BR>Meidinger Chris <chris.meidinger@baden= IT.de> a =E9crit :<BR> Hi Kindy,<BR><BR>= It sounds like the tunnel lifetimes are not the same.<BR><BR>You have 'is= akmp policy 9 lifetime 86400' which means that the tunnel will be torn do= wn and renegotiated after 86400 seconds. Does the other side have the sam= e lifetime? If not, the peer gateway won't be ready to reneg the tunnel a= nd will (probably) spit out a Bad SPI log message for each of your side's= negotiation attempts.<BR><BR>That's definately the first thing to check!= <BR><BR>HTH,<BR><BR>Chris<BR><BR>-----Original Message-----<BR>From: vpn-= [email protected] on behalf of Kindy S= ylla<BR>Sent: Tue 09-May-06 10:55<BR>To: [email protected]<BR>Subject: [VPN] Pix doesn't respond after a while<= BR><BR>Hi,<BR> <BR> I am having a strange behaviour with a Cis= co PIX Firewall Version 6.3(5). The configuration is done , the VPN are c= reated between the 2 differents sites. The probl=E8me is after 5 to 6 hou= rs of running, the ping to the remote hosts doesn't go through. When i tr= y to ping a remote host, I see the followings line in the debug icmp trac= e:<BR> <BR> -request from inside:10.102.158.152 to 10.5.113.14= 2 ID=3D512 seq=3D5376 length=3D40<BR>44: ICMP echo-request: translating i= nside:10.102.158.152 to outside:10.102.158.152<BR>45: ICMP echo-request f= rom inside:10.102.158.152 to 10.5.113.142 ID=3D512 seq=3D5632 length=3D40= <BR>46: ICMP echo-request: translating inside:10.102.158.152 to outside:1= 0.102.158.152<BR><BR> And When remote host try to ping a local mach= ine, i can see the request coming without any reply.<BR> <BR> = To get the ping work , we have to reload it.<BR> <BR> Do you have any idea?<BR> <BR> Please= find below my config file :<BR> PIX Version 6.3(5)<BR>interface et= hernet0 auto<BR>interface ethernet1 auto<BR>nameif ethernet0 outside secu= rity0<BR>nameif ethernet1 inside security100<BR>enable password N7FecZuSH= JlVZC2P encrypted<BR>passwd N7FecZuSHJlVZC2P encrypted<BR>hostname pixben= in<BR>domain-name boabenin.bj<BR>fixup protocol dns maximum-length 512<BR= >fixup protocol ftp 21<BR>fixup protocol h323 h225 1720<BR>fixup protocol= h323 ras 1718-1719<BR>fixup protocol http 80<BR>fixup protocol rsh 514<B= R>fixup protocol rtsp 554<BR>fixup protocol sip 5060<BR>fixup protocol si= p udp 5060<BR>fixup protocol skinny 2000<BR>fixup protocol smtp 25<BR>fix= up protocol sqlnet 1521<BR>fixup protocol http 80<BR>fixup protocol rsh 5= 14<BR>fixup protocol rtsp 554<BR>fixup protocol sip 5060<BR>fixup protoco= l sip udp 5060<BR>fixup protocol skinny 2000<BR>fixup protocol smtp 25<BR= >fixup protocol sqlnet 1521<BR>fixup protocol tftp 69<BR>names<BR>access-list acl_vpn permit icmp 10.102.156.= 0 255.255.252.0 192.168.0.0 255.255.255.0<BR>access-list acl_vpn permit i= p 10.102.156.0 255.255.252.0 192.168.0.0 255.255.255.0<BR>access-list acl= _blgo permit icmp 10.102.156.0 255.255.252.0 10.5.113.128 255.255.255.224= <BR>access-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.5.113.12= 8 255.255.255.224<BR>access-list acl_blgo permit icmp 10.102.156.0 255.25= 5.252.0 10.102.128.0 255.255.254.0<BR>access-list acl_blgo permit ip 10.1= 02.156.0 255.255.252.0 10.102.128.0 255.255.254.0<BR>access-list acl_blgo= permit icmp 10.102.156.0 255.255.252.0 10.102.130.0 255.255.255.128<BR>a= ccess-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.102.130.0 255= .255.255.128<BR>pager lines 24<BR>mtu outside 500<BR>mtu inside 1500<BR>i= p address outside 81.91.235.147 255.255.255.192<BR>ip address inside 10.1= 02.155.135 255.255.255.128<BR>ip audit info action alarm<BR>ip audit atta= ck action alarm<BR>pdm history enable<BR>arp timeout 14400<BR>nat (inside) 0 10.102.156.0 255.255.252.0= 0 0<BR>route outside 0.0.0.0 0.0.0.0 81.91.235.129 1<BR>route inside 10.= 102.156.0 255.255.252.0 10.102.155.129 1<BR>timeout xlate 3:00:00<BR>time= out conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00= <BR>ip audit attack action alarm<BR>pdm history enable<BR>arp timeout 144= 00<BR>nat (inside) 0 10.102.156.0 255.255.252.0 0 0<BR>route outside 0.0.= 0.0 0.0.0.0 81.91.235.129 1<BR>route inside 10.102.156.0 255.255.252.0 10= .102.155.129 1<BR>timeout xlate 3:00:00<BR>timeout conn 1:00:00 half-clos= ed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00<BR>timeout h323 0:05:00 m= gcp 0:05:00 sip 0:30:00 sip_media 0:02:00<BR>timeout sip-disconnect 0:02:= 00 sip-invite 0:03:00<BR>timeout uauth 0:05:00 absolute<BR>aaa-server TAC= ACS+ protocol tacacs+<BR>aaa-server TACACS+ max-failed-attempts 3<BR>aaa-= server TACACS+ deadtime 10<BR>aaa-server RADIUS protocol radius<BR>aaa-se= rver RADIUS max-failed-attempts 3<BR>aaa-server RADIUS deadtime 10<BR>aaa-server LOCAL protocol local<BR= >no snmp-server location<BR>no snmp-server contact<BR>snmp-server communi= ty public<BR>no snmp-server enable traps<BR>floodguard enable<BR>sysopt c= onnection permit-ipsec<BR>crypto ipsec transform-set strong esp-3des esp-= sha-hmac<BR>crypto dynamic-map dynmap 30 set transform-set strong<BR>cryp= to map toX 20 ipsec-isakmp<BR>crypto map toX 20 match address acl_vpn<BR>= crypto map toX 20 set peer 196.200.82.35<BR>crypto map toX 20 set transfo= rm-set strong<BR>crypto map toX 30 ipsec-isakmp<BR>crypto map toX 30 matc= h address acl_blgo<BR>crypto ipsec transform-set strong esp-3des esp-sha-= hmac<BR>crypto dynamic-map dynmap 30 set transform-set strong<BR>crypto m= ap toX 20 ipsec-isakmp<BR>crypto map toX 20 match address acl_vpn<BR>cryp= to map toX 20 set peer 196.200.82.35<BR>crypto map toX 20 set transform-s= et strong<BR>crypto map toX 30 ipsec-isakmp<BR>crypto map toX 30 match ad= dress acl_blgo<BR>crypto map toX 30 set peer 194.78.211.130<BR>crypto map toX 30 set transform-set strong<BR>cry= pto map toX 9990 ipsec-isakmp dynamic dynmap<BR>crypto map toX interface = outside<BR>isakmp enable outside<BR>isakmp key ******** address 196.200.8= 2.35 netmask 255.255.255.255<BR>isakmp key ******** address 194.78.211.13= 0 netmask 255.255.255.255<BR>isakmp identity address<BR>isakmp policy 9 a= uthentication pre-share<BR>isakmp policy 9 encryption 3des<BR>isakmp poli= cy 9 hash sha<BR>isakmp policy 9 group 1<BR>isakmp policy 9 lifetime 8640= 0<BR>isakmp policy 19 authentication pre-share<BR>isakmp policy 19 encryp= tion 3des<BR>isakmp policy 19 hash sha<BR>isakmp policy 19 group 2<BR>isa= kmp policy 19 lifetime 86400<BR>telnet timeout 5<BR>ssh 194.7.174.162 255= .255.255.255 outside<BR>ssh 194.7.174.163 255.255.255.255 outside<BR>ssh = 10.102.156.0 255.255.252.0 inside<BR>ssh 10.102.155.0 255.255.255.0 insid= e<BR>ssh timeout 5<BR>console timeout 0<BR>terminal width 80<BR>Cryptochecksum:7458b1b938134f7d52ed82d4e2003210<BR><BR>Regrds,<BR>= <BR> Kindy<BR> <BR><BR> &nb= sp; <BR>------------------= ---------------<BR> Faites de Yahoo! votre page d'accueil sur le web= pour retrouver directement vos services pr=E9f=E9r=E9s : v=E9rifiez vos = nouveaux mails, lancez vos recherches et suivez l'actualit=E9 en temps r=E9= el. Cliquez ici.<BR><BR><BR><BR><BR> &= nbsp; <BR>---------------------= ------------<BR> Faites de Yahoo! votre page d'accueil sur le web po= ur retrouver directement vos services pr=E9f=E9r=E9s : v=E9rifiez vos nou= veaux mails, lancez vos recherches et suivez l'actualit=E9 en temps r=E9e= l. Cliquez ici.<BR><BR></FONT></div></BLOCKQUOTE><BR><p> <hr size=3D"1">=20 <b>Yahoo! Mail r=E9invente le mail !</b> D=E9couvrez le <a href=3D"http:/= /fr.rd.yahoo.com/evt=3D40577/*http://fr.promotions.yahoo.com/mail/nouveau= mail.html=20 ">nouveau Yahoo! Mail</a> et son interface r=E9volutionnaire. --0-155198888-1147274727=:27639-- --===============0012002819== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ VPN mailing list [email protected] http://lists.shmoo.com/mailman/listinfo/vpn --===============0012002819==--