(racoon 905) Problems Renegotiating

Hi,

After a lot of headscratching and work I have finally managed to setup the KAME implementation IPSEC that comes standard in FreeBSD5.3 to work under the following conditions (ESP Tunnel mode, using certificates):

FREEBSD-5.3_Stable(GateA)---NAT(A)-------------NAT(B)---WindowsXP(GateB)
Server                               Internet


The problem I have is as follows: pinging from Windows towards an IP behind the FreeBSD gateway, if for some reason communication on the tunnel fails (either by itself or by resetting the WindowsXP IPSEC service manually), renegotiation of IPSEC occurs. Upto this point everything seems regular to me, however in my case renegotiation seems to occur for only one of the two directions (The spi changes only for traffic from Windows towards FreeBSD, the traffic is decrypted and routed directly. The return trip of the ping from FreeBSD to Windows however continues using the spi from before the interruption and the packets encrypted by FreeBSD arrive at the WindowsXP machine which is unable to decrypt them.). Traffic only resumes after a long time when a complete renegotiation occurs. 

My question is, is this normal? or is it a known problem and are there any ways I can fix this? I have attached a trace below with IPs obfuscated, to demonstrate what happens.

Any help is much appreciated. Any one got ideas?

Regards

Rekkie 


13:05:37.713795 IP 192.168.31.4 > 117.149.95.18: ESP(spi=0xa5808a13,seq=0x71)
13:05:38.705306 IP 117.149.95.18 > 192.168.31.4: ESP(spi=0x0e69b2c7,seq=0x74)
13:05:38.705507 IP 192.168.31.4 > 192.168.1.9: icmp 40: echo request seq 26385
13:05:38.705922 IP 192.168.1.9 > 192.168.31.4: icmp 40: echo reply seq 26385
13:05:38.706046 IP 192.168.31.4 > 117.149.95.18: ESP(spi=0xa5808a13,seq=0x72)
13:05:39.420791 IP 117.149.95.18.500 > 192.168.31.4.500: isakmp: phase 2/others I inf[E]
13:05:39.447770 IP 117.149.95.18.500 > 192.168.31.4.500: isakmp: phase 2/others I inf[E]
13:05:41.613700 arp who-has 192.168.31.4 tell 192.168.41.1
13:05:41.613803 arp reply 192.168.31.4 is-at 00:0c:29:78:4f:eb
13:05:45.108441 IP 117.149.95.18.500 > 192.168.31.4.500: isakmp: phase 1 I ident
13:05:45.151976 IP 192.168.31.4.500 > 117.149.95.18.500: isakmp: phase 1 R ident
13:05:45.428547 IP 117.149.95.18.500 > 192.168.31.4.500: isakmp: phase 1 I ident
13:05:45.442153 IP 192.168.31.4.500 > 117.149.95.18.500: isakmp: phase 1 R ident
13:05:45.658898 IP 117.149.95.18.500 > 192.168.31.4.500: isakmp: phase 1 I ident[E]
13:05:46.788837 IP 117.149.95.18.500 > 192.168.31.4.500: isakmp: phase 1 I ident[E]
13:05:48.132992 IP 192.168.31.4.500 > 117.149.95.18.500: isakmp: phase 1 R ident[E]
13:05:48.225319 IP 117.149.95.18.500 > 192.168.31.4.500: isakmp: phase 2/others I oakley-quick[E]
13:05:48.762997 IP 192.168.31.4.500 > 117.149.95.18.500: isakmp: phase 1 R ident[E]
13:05:48.771740 IP 117.149.95.18.500 > 192.168.31.4.500: isakmp: phase 2/others I oakley-quick[E]
13:05:50.734127 IP 117.149.95.18.500 > 192.168.31.4.500: isakmp: phase 2/others I oakley-quick[E]
13:05:50.839937 IP 192.168.31.4.500 > 117.149.95.18.500: isakmp: phase 2/others R oakley-quick[E]
13:05:51.011951 IP 117.149.95.18 > 192.168.31.4: ESP(spi=0x0dd44b10,seq=0x1)
13:05:51.016012 IP 117.149.95.18.500 > 192.168.31.4.500: isakmp: phase 2/others I oakley-quick[E]
13:05:51.048858 IP 192.168.31.4.500 > 117.149.95.18.500: isakmp: phase 2/others R oakley-quick[E]
13:05:51.135244 IP 117.149.95.18 > 192.168.31.4: ESP(spi=0x0dd44b10,seq=0x2)
13:05:51.169083 IP 117.149.95.18.500 > 192.168.31.4.500: isakmp: phase 2/others I oakley-quick[E]
13:05:56.617255 IP 117.149.95.18 > 192.168.31.4: ESP(spi=0x0dd44b10,seq=0x3)
13:05:56.617455 IP 192.168.31.4 > 192.168.1.9: icmp 40: echo request seq 28689
13:05:56.617884 IP 192.168.1.9 > 192.168.31.4: icmp 40: echo reply seq 28689
13:05:56.618005 IP 192.168.31.4 > 117.149.95.18: ESP(spi=0xa5808a13,seq=0x73)
13:06:02.148751 IP 117.149.95.18 > 192.168.31.4: ESP(spi=0x0dd44b10,seq=0x4)

_______________________________________________
Join Excite! - http://www.excite.com
The most personalized portal on the Web!