From owner-freebsd-security Fri May 24 20:16:30 2002 Delivered-To: freebsd-security@freebsd.org Received: from papa.tanu.org (kame195.kame.net [203.178.141.195]) by hub.freebsd.org (Postfix) with ESMTP id 7708237B408 for ; Fri, 24 May 2002 20:16:27 -0700 (PDT) Received: from localhost ([3ffe:501:4819:cafe:260:1dff:fe21:f766]) by papa.tanu.org (8.11.6/8.11.6) with ESMTP id g4P3GML41844; Sat, 25 May 2002 12:16:22 +0900 (JST) (envelope-from sakane@kame.net) To: jerry_murdock@yahoo.com Cc: FreeBSD-Security@FreeBSD.ORG Subject: Re: Racoon SA Hard/Soft Lifetimes In-Reply-To: Your message of "Wed, 15 May 2002 21:02:14 -0700 (PDT)" <20020516040214.97098.qmail@web14606.mail.yahoo.com> References: <20020516040214.97098.qmail@web14606.mail.yahoo.com> X-Mailer: Cue version 0.6 (011026-1440/sakane) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Message-Id: <20020525122004P.sakane@kame.net> Date: Sat, 25 May 2002 12:20:04 +0900 From: Shoichi Sakane X-Dispatcher: imput version 20000228(IM140) Lines: 12 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org > I've successfully got a 2day old -Stable build to talk IPSEC/IKE with a > Sonicwall, but things fall apart when the SAs hit the soft lifetime limit. > > A new SA is successfully negotiated with the Sonicwall when the soft lifetime > runs out, but the Sonicwall then ignores anything coming into it on the "old" > SA(which FBSD uses until the hard lifetime runs out). if your system has "net.key.preferred_oldsa" system wide value, you can configure the kernel using new SA immediately. try like the following, # sysctl -w net.key.preferred_oldsa=0 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message