From owner-freebsd-questions@FreeBSD.ORG Fri Aug 29 12:16:29 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EB51416A4BF for ; Fri, 29 Aug 2003 12:16:28 -0700 (PDT) Received: from aslan.camp.com (portal.camp.com [206.124.12.62]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1CC0543FF3 for ; Fri, 29 Aug 2003 12:16:28 -0700 (PDT) (envelope-from steve@camp.com) Received: from aslan.camp.com (localhost [127.0.0.1]) by aslan.camp.com (8.12.9/8.12.9) with ESMTP id h7TJAdgI015399; Fri, 29 Aug 2003 13:10:39 -0600 (MDT) Received: (from steve@localhost) by aslan.camp.com (8.12.9/8.12.9/Submit) id h7TJAdaW015398; Fri, 29 Aug 2003 13:10:39 -0600 (MDT) Date: Fri, 29 Aug 2003 13:10:39 -0600 (MDT) From: Steve Camp Message-Id: <200308291910.h7TJAdaW015398@aslan.camp.com> To: freebsd-questions@freebsd.org Subject: HELP! "key_acquire2: invalid sequence number is passed" -- IPSEC VPN down... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Aug 2003 19:16:29 -0000 Hi, I need some help. I am running a VPN between a FreeBSD 4.3 box and another FreeBSD 4.7 box. I am using the IPSEC / Racoon setup that comes with FreeBSD. I have not compiled anything: I inherited sysadmin duties for these boxen from another fellow. They had been working just fine when I first "acquired" them. Since that time, my customer has had two moves when they physically consolidated their two offices into one new office. At that time, the VPN was torn down, as there was only one box. Now they have opened a new "branch" office (actually a "home" office) and have tasked me with re-establishing the VPN to this separate location. I took the second box and re-located it. The only changes made were to the /etc/hosts (new host name(s) and IP addresses), /etc/resolv.conf (new dns servers), and some tweaks to /etc/rc.conf, and IP re-configurations in the /usr/local/etc/rc.d/ipsec.sh startup script. The IPSEC VPN has been up and down, but frustratingly mostly down since this latest "move". However, the VPN *was* working, and working well just two days ago. Today I checked, and it is again down, and the "primary" company server is logging lots and lots of these messages: Aug 28 18:07:00 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 28 18:10:00 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 28 18:13:00 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 28 18:16:30 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 28 18:19:00 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 28 18:22:00 servername /kernel: key_acquire2: invalid sequence number is passed. . . . Aug 29 11:46:36 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 29 11:49:18 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 29 11:50:00 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 29 11:50:47 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 29 11:54:52 servername /kernel: key_acquire2: invalid sequence number is passed. etc etc Any pointers / links / help etc welcome in trying to figure this problem out. Has anyone experienced this problem before? How to resolve / fix it? Could this behaviour be caused by an ISP restricting certain kinds of traffic? More specifically, the last time I checked a few days ago, I was able to ping the public IP address of the remote (e.g. home office) box, but now I get ICMP error messages about ICMP Communication Administratively Prohibited from gateway machine.isp.net (xxx.xx.xxx.xxx) Pointers to any other apropos Usenet newsgroups, mailing lists, support websites appreciated. -- Steve Camp steve@camp.com Aug 28 18:19:00 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 28 18:22:00 servername /kernel: key_acquire2: invalid sequence number is passed. . . . Aug 29 11:46:36 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 29 11:49:18 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 29 11:50:00 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 29 11:50:47 servername /kernel: key_acquire2: invalid sequence number is passed. Aug 29 11:54:52 servername /kernel: key_acquire2: invalid sequence number is passed. etc etc Any pointers / links / help etc welcome in trying to figure this problem out. Has anyone experienced this problem before? How to resolve / fix it? Could this behaviour be caused by an ISP restricting certain kinds of traffic? More specifically, the last time I checked a few days ago, I was able to ping the public IP address of the remote (e.g. home office) box, but now I get ICMP error messages about: ICMP Communication Administratively Prohibited from gateway machine.isp.net (xxx.xx.xxx.xxx) While I have posted this query to the comp.dcom.vpn, and comp.unix.*bsd*.misc newsgroups, any pointers to any other apropos Usenet newsgroups, mailing lists, support websites appreciated. -- Steve Camp steve@camp.com