Messages

1

German - Deutsch / IPsec Tunnel wird jede Minute neu aufgebaut

« on: July 21, 2021, 02:32:11 pm »

Hallo,

meine opnsense hat drei IPsec Tunnel zu je drei FritzBoxen aufgebaut. Diese Verbindungen liefen über Wochen völlig stabil. Nun habe ich das Problem, dass jeder Tunnel zeitgleich nach genau einer Minute neu aufgebaut wird. Dadurch sind die Tunnel für ein paar Sekunden offline, was mein Monitoring völlig aus dem Gleichgewicht bringt.

Die FritzBoxen sowie die Opnsense laufen mit je der aktuellen Firmware. Hat jemand eine Idee an was das liegen kann? Lifetime der Tunnel stehen je auf 16h.

Hier ein Auszug aus dem IPsec log:

Code: [Select]

Jul 21 14:22:03 cerberus charon[91598]: 04[ENC] <con1|2> generating QUICK_MODE request 3864627175 [ HASH ]
Jul 21 14:22:03 cerberus charon[91598]: 04[NET] <con1|2> sending packet: from 213.23.40.246[500] to 84.152.225.1[500] (108 bytes)
Jul 21 14:22:03 cerberus charon[91598]: 04[ENC] <con1|2> generating QUICK_MODE request 2331971970 [ HASH SA No KE ID ID ]
Jul 21 14:22:03 cerberus charon[91598]: 04[NET] <con1|2> sending packet: from 213.23.40.246[500] to 84.152.225.1[500] (556 bytes)
Jul 21 14:22:07 cerberus charon[91598]: 04[IKE] <con1|2> sending retransmit 1 of request message ID 2331971970, seq 3
Jul 21 14:22:07 cerberus charon[91598]: 04[NET] <con1|2> sending packet: from 213.23.40.246[500] to 84.152.225.1[500] (556 bytes)
Jul 21 14:22:08 cerberus charon[91598]: 04[NET] <con1|2> received packet: from 84.152.225.1[500] to 213.23.40.246[500] (492 bytes)
Jul 21 14:22:08 cerberus charon[91598]: 04[ENC] <con1|2> parsed QUICK_MODE response 2331971970 [ HASH SA No KE ID ID N((24576)) ]
Jul 21 14:22:08 cerberus charon[91598]: 04[CFG] <con1|2> selected proposal: ESP:AES_CBC_256/HMAC_SHA2_512_256/MODP_2048/NO_EXT_SEQ
Jul 21 14:22:08 cerberus charon[91598]: 04[IKE] <con1|2> detected rekeying of CHILD_SA con1{2}
Jul 21 14:22:08 cerberus charon[91598]: 04[IKE] <con1|2> CHILD_SA con1{3} established with SPIs ccf671c6_i 27126c2a_o and TS 192.168.101.0/24 === 192.168.100.0/24
Jul 21 14:22:08 cerberus charon[91598]: 04[ENC] <con1|2> generating QUICK_MODE request 2331971970 [ HASH ]
Jul 21 14:22:08 cerberus charon[91598]: 04[NET] <con1|2> sending packet: from 213.23.40.246[500] to 84.152.225.1[500] (108 bytes)
Jul 21 14:22:33 cerberus charon[91598]: 00[DMN] SIGINT received, shutting down
Jul 21 14:22:33 cerberus charon[91598]: 00[IKE] <con1|2> closing CHILD_SA con1{2} with SPIs c73d9e1e_i (9296 bytes) 144a0c3c_o (22964 bytes) and TS 192.168.101.0/24 === 192.168.100.0/24
Jul 21 14:22:33 cerberus charon[91598]: 00[IKE] <con1|2> sending DELETE for ESP CHILD_SA with SPI c73d9e1e
Jul 21 14:22:33 cerberus charon[91598]: 00[ENC] <con1|2> generating INFORMATIONAL_V1 request 3883786550 [ HASH D ]
Jul 21 14:22:33 cerberus charon[91598]: 00[NET] <con1|2> sending packet: from 213.23.40.246[500] to 84.152.225.1[500] (124 bytes)
Jul 21 14:22:33 cerberus charon[91598]: 00[IKE] <con1|2> closing CHILD_SA con1{3} with SPIs ccf671c6_i (124013 bytes) 27126c2a_o (206136 bytes) and TS 192.168.101.0/24 === 192.168.100.0/24
Jul 21 14:22:33 cerberus charon[91598]: 00[IKE] <con1|2> sending DELETE for ESP CHILD_SA with SPI ccf671c6
Jul 21 14:22:33 cerberus charon[91598]: 00[ENC] <con1|2> generating INFORMATIONAL_V1 request 250027183 [ HASH D ]
Jul 21 14:22:33 cerberus charon[91598]: 00[NET] <con1|2> sending packet: from 213.23.40.246[500] to 84.152.225.1[500] (124 bytes)
Jul 21 14:22:33 cerberus charon[91598]: 00[IKE] <con1|2> deleting IKE_SA con1[2] between 213.23.40.246[mail.tet.com.de]...84.152.225.1[burj.dd-dns.de]

Danke
 Sven