(racoon 923) Re: Problems talking with Checkpoint-NG

Satoshi Inoue wrote:

>On Wed, 30 Mar 2005 11:16:00 +0000 (UTC)
>[email protected] (Hamie) wrote:
>
>  
>
>>I'm trying to get an ipsec tunnel working between a Linux box 
>>(Gentoo - amd64) and a Checkpoint-NG firewall (Nokia platform)
>>    
>>
>...
>
>  
>
[deleted]

>>2005-03-30 10:12:32: ERROR: ignore information because the message 
>>                            has no hash payload.
>>    
>>
>
>I think you should examine this packet too.
>IKE phase 1 retransmission? well, that's my guess...
>  
>


Well. Phase-I and Phase-II now complete fine... But the timeouts are  
alittle more problematical. It all works fine & traffic flows fine until 
the timeout. Then I get

2005-03-31 11:10:08: INFO: respond new phase 2 negotiation: 
192.168.254.254[0]<=>163.166.150.105[0]
2005-03-31 11:10:08: ERROR: invalid value of DOI 0x00000038.
2005-03-31 11:10:08: ERROR: failed to update spi.
2005-03-31 11:10:08: ERROR: failed to start post getspi.
2005-03-31 11:10:10: INFO: respond new phase 2 negotiation: 
192.168.254.254[0]<=>163.166.150.105[0]
2005-03-31 11:10:10: ERROR: invalid value of DOI 0x00000038.
2005-03-31 11:10:10: ERROR: failed to update spi.
2005-03-31 11:10:10: ERROR: failed to start post getspi.
2005-03-31 11:10:12: INFO: respond new phase 2 negotiation: 
192.168.254.254[0]<=>163.166.150.105[0]
2005-03-31 11:10:12: ERROR: invalid value of DOI 0x00000038.
2005-03-31 11:10:12: ERROR: failed to update spi.
2005-03-31 11:10:12: ERROR: failed to start post getspi.
2005-03-31 11:10:14: INFO: respond new phase 2 negotiation: 
192.168.254.254[0]<=>163.166.150.105[0]
2005-03-31 11:10:14: ERROR: invalid value of DOI 0x00000038.
2005-03-31 11:10:14: ERROR: failed to update spi.
2005-03-31 11:10:14: ERROR: failed to start post getspi.


Soon after which it starts generating

2005-03-31 11:19:51: INFO: IPsec-SA expired: ESP/Tunnel 
163.166.150.105->192.168.254.254 spi=259085451(0xf71548b)
2005-03-31 11:19:53: INFO: IPsec-SA expired: ESP/Tunnel 
163.166.150.105->192.168.254.254 spi=176992032(0xa8caf20)
2005-03-31 11:19:54: INFO: IPsec-SA expired: ESP/Tunnel 
163.166.150.105->192.168.254.254 spi=137777934(0x836530e)
2005-03-31 11:19:55: INFO: IPsec-SA expired: ESP/Tunnel 
163.166.150.105->192.168.254.254 spi=122592821(0x74e9e35)
2005-03-31 11:19:59: INFO: IPsec-SA expired: ESP/Tunnel 
163.166.150.105->192.168.254.254 spi=260181705(0xf820ec9)


In the meantime traffic still flows for at least a while afterwards... 
Not sure how long it will take to actually stop... (Although you can 
specify timeouts for IPSec in two places on checkpoint, maybe the other 
(gateway object) is still set to 3600 seconds).

Anyway... Anyone know why CKP & racoon differ on what the DOI should be? 
The only setting I can find in racoon.conf is doi which it says isn't 
seeded & only has one possible parameter... I've tried with & without 
it. No effect. CKP doesn't seem to have any way to specify a DOI at 
all... (Not that I've found anyway).

Reading the RFC & trying to understand WHY the DOI is different, could 
this be due to a mismatch between loaded (Linux modules) encryption 
algorithms & those specified in racoon.conf? (I've tried to get them the 
same, but it changed nothing so far).


I also noticed a problem logged last year in this mailing list talking 
to checkpoint... With it failing after a  while... Could it be the same 
problem?

TIA

Hamish.