Quantcast
Channel: All ScreenOS Firewalls (NOT SRX) posts
Viewing all articles
Browse latest Browse all 2577

Re: No VPN Traffic Flows for 3 Minutes after Phase 2 ReKey

$
0
0

There are no errors or anything else suspicious in the event log during the time traffic is not flowing. According to the event log, the VPN looks like it should be working perfectly.  Here is the SA info from both sides during the time traffic is not flowing. ID1 is the one in question:

ns5gtFL-> get sa
total configured sa: 2
HEX ID    Gateway         Port Algorithm     SPI      Life:sec kb Sta   PID vsys
00000001< 23.114.xxx.xxx    500 esp:3des/sha1 ec768bb9 86370 unlim A/-     4 0
00000001> 23.114.xxx.xxx    500 esp:3des/sha1 c5ed3171 86370 unlim A/-     3 0
00000002< 71.195.xxx.xxx 10952 esp:3des/sha1 ec768bb8  3343 unlim A/-     5 0
00000002> 71.195.xxx.xxx 10952 esp:3des/sha1 81d6040f  3343 unlim A/-     6 0
ns5gtFL-> get sa id 00000001
index 0, name Madera VPN, peer gateway ip 23.114.xxx.xxx. vsys<Root>
auto key. policy node, tunnel mode, policy id in:<4> out:<3> vpngrp:<-1>. sa_list_nxt:<-1>.
tunnel id 1, peer id 0, NSRP Local.     site-to-site. Local interface is untrust <104.4.xxx.xxx>.
  esp, group 2, 3des encryption, sha1 authentication
  autokey, IN active, OUT active
  monitor<0>, latency: 0, availability: 0
  DF bit: clear
  app_sa_flags: 0x2063
  proxy id: local 10.0.1.0/255.255.255.0, remote 10.0.0.0/255.255.255.0, proto 0, port 0
  ike activity timestamp: 1064862367
  st_ref_cnt: 0
nat-traversal map not available
incoming: SPI ec768bb9, flag 00004000, tunnel info 40000001, pipeline
  life 86400 sec, 86356 remain, 0 kb, 0 bytes remain
  anti-replay off, idle timeout value <0>, idled 44 seconds
  next pak sequence number: 0x0
incoming secondary: SPI ec768bb5, flag 0000c000, tunnel info 40000001, pipeline
  life 86400 sec, 1141 remain, 0 kb, 0 bytes remain
  anti-replay off, idle timeout value <0>, idled 46 seconds
  next pak sequence number: 0x0
outgoing: SPI c5ed3171, flag 00000000, tunnel info 40000001, pipeline
  life 86400 sec, 86356 remain, 0 kb, 0 bytes remain
--- more ---
  anti-replay off, idle timeout value <0>, idled 2 seconds
  next pak sequence number: 0x2e

 

ns5gt-> get sa
total configured sa: 8
HEX ID    Gateway         Port Algorithm     SPI      Life:sec kb Sta   PID vsys
00000007< 71.195.xxx.xxx 10952 esp:3des/sha1 c5ed3170  2923 unlim A/-    18 0
00000007> 71.195.xxx.xxx 10952 esp:3des/sha1 6b7c05af  2923 unlim A/-    19 0
00000006< 0.0.0.0          500 esp:3des/sha1 00000000 expir unlim I/I    15 0
00000006> 0.0.0.0          500 esp:3des/sha1 00000000 expir unlim I/I    16 0
00000005< 0.0.0.0          500 esp:3des/sha1 00000000 expir unlim I/I    13 0
00000005> 0.0.0.0          500 esp:3des/sha1 00000000 expir unlim I/I    14 0
00000004< 0.0.0.0          500 esp:3des/sha1 00000000 expir unlim I/I    11 0
00000004> 0.0.0.0          500 esp:3des/sha1 00000000 expir unlim I/I    12 0
00000003< 0.0.0.0          500 esp:3des/sha1 00000000 expir unlim I/I     9 0
00000003> 0.0.0.0          500 esp:3des/sha1 00000000 expir unlim I/I    10 0
00000002< 0.0.0.0          500 esp:3des/sha1 00000000 expir unlim I/I     7 0
00000002> 0.0.0.0          500 esp:3des/sha1 00000000 expir unlim I/I     8 0
00000008< 108.223.xxx.xxx 10952 esp:3des/sha1 c5ed3167 expir unlim I/I    26 0
00000008> 108.223.xxx.xxx 10952 esp:3des/sha1 35640f1c expir unlim I/I    25 0
00000001< 104.4.xxx.xxx     500 esp:3des/sha1 c5ed3171 86314 unlim A/-     6 0
00000001> 104.4.xxx.xxx     500 esp:3des/sha1 ec768bb9 86314 unlim A/-     5 0
ns5gt-> get sa id 00000001
index 7, name Florida VPN, peer gateway ip 104.4.xxx.xxx. vsys<Root>
auto key. policy node, tunnel mode, policy id in:<6> out:<5> vpngrp:<-1>. sa_list_nxt:<-1>.
tunnel id 1, peer id 0, NSRP Local.     site-to-site. Local interface is untrust <23.114.xxx.xxx>.
  esp, group 2, 3des encryption, sha1 authentication
  autokey, IN active, OUT active
  monitor<0>, latency: 0, availability: 0
  DF bit: clear
  app_sa_flags: 0x2063
  proxy id: local 10.0.0.0/255.255.255.0, remote 10.0.1.0/255.255.255.0, proto 0, port 0
  ike activity timestamp: 1066227779
  st_ref_cnt: 0
nat-traversal map not available
incoming: SPI c5ed3171, flag 00004000, tunnel info 40000001, pipeline
  life 86400 sec, 86294 remain, 0 kb, 0 bytes remain
  anti-replay off, idle timeout value <0>, idled 106 seconds
  next pak sequence number: 0x0
outgoing: SPI ec768bb9, flag 00000000, tunnel info 40000001, pipeline
  life 86400 sec, 86294 remain, 0 kb, 0 bytes remain
  anti-replay off, idle timeout value <0>, idled 2 seconds
  next pak sequence number: 0x82

 


Viewing all articles
Browse latest Browse all 2577

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>