Date: Fri, 27 Jan 2006 11:36:46 +0200 From: Oleg Tarasov <subscriber@osk.com.ua> To: VANHULLEBUS Yvan <vanhu_bsd@zeninc.net> Cc: freebsd-net@freebsd.org Subject: Re: Duplicate SAD entries lead to ESP tunnel malfunction Message-ID: <603364524.20060127113646@osk.com.ua> In-Reply-To: <20060127084457.GA21360@zen.inc> References: <83462512.20060126181018@osk.com.ua> <43D92848.2050005@elischer.org> <20060127084457.GA21360@zen.inc>
next in thread | previous in thread | raw e-mail | index | archive | help
Hello, VANHULLEBUS Yvan <vanhu_bsd@zeninc.net> wrote: > net.key.prefered_oldsa, or net.key.preferred_oldsa (changed since > 4.X). > It is 1 by default, and it should be set to 0 to help better > interoperability with lots of peers..... This seems quite like correct solution. I analyzed behavior of the interface and saw upcoming ping requests (obviously) AND outgoing ping echoes, but remote host didn't get them. Obviously incoming packets were decrypted using one of SAs (the new one) but outgoing packets were encrypted using old SA which is not present on remote host due to some problems (like forced reboot, connection problems etc). Normally in this case remote host must report of unknown spi, but rather it lacks this function or it just ignores these packets. As it is a hardware router I am unaware of its behavior. I will test this solution for some time but I am sure this will help. Thanx for really great help - all these troubles are on my production box and every minute of malfunction returns to me with #not good# words of my boss :/ -- Best regards, Oleg Tarasov mailto:subscriber@osk.com.ua
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?603364524.20060127113646>