Проблема соединение IPSEC создается, работает, но после обрыва dsl для биллинга, не переподключается именно ipsec. Прошивка 1_24_26032001. Срочно нужно решение проблемы.

На втором конце dir-330, как main ipsec.

Дополню свой вопрос, ipsec поднимается только после удаления соединения и создания нового. (2640U).

Какой тип подключения на WAN?
Можно ли кусок лога модема в момент переподключения внешнего интерфейса?

На dir-330 fixedip (512kbit), на 2640u ppoe (8mbit). По логу конкретнее в какой режим его включить чтобы показал, в debug&error - пусто.

Это с dir-330 лог:

Apr 21 11:32:25 IPSec IPSec Starting Pluto (Openswan Version 1.0.10)
Apr 21 11:32:25 IPSec IPSec including X.509 patch with traffic selectors (Version 0.9.42)
Apr 21 11:32:25 IPSec IPSec including NAT-Traversal patch (Version 0.6) [disabled]
Apr 21 11:32:25 IPSec IPSec ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Apr 21 11:32:25 IPSec IPSec ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0)
Apr 21 11:32:25 IPSec IPSec ike_alg_register_enc(): Activating OAKLEY_CAST_CBC: Ok (ret=0)
Apr 21 11:32:25 IPSec IPSec ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0)
Apr 21 11:32:25 IPSec IPSec ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)
Apr 21 11:32:25 IPSec IPSec ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)
Apr 21 11:32:25 IPSec IPSec ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)
Apr 21 11:32:25 IPSec IPSec ike_alg_register_enc(): Activating OAKLEY_SSH_PRIVATE_65289: Ok (ret=0)
Apr 21 11:32:25 IPSec IPSec Could not change to directory '/tmp/ipsec.d/cacerts'
Apr 21 11:32:25 IPSec IPSec Could not change to directory '/tmp/ipsec.d/crls'
Apr 21 11:32:25 IPSec IPSec OpenPGP certificate file '/tmp/pgpcert.pgp' not found
pr 21 11:32:34 System Activity DHCP_Server Sending OFFER of 192.168.5.6
Apr 21 11:32:34 System Activity DHCP_Server Sending ACK to 192.168.5.6
Apr 21 11:32:35 IPSec IPSec added connection description "conn_polkan"
Apr 21 11:32:36 IPSec IPSec listening for IKE messages
Apr 21 11:32:36 IPSec IPSec adding interface ipsec1/br0 192.168.5.1
Apr 21 11:45:55 IPSec IPSec "conn_polkan" #1: max number of retransmissions (20) reached STATE_AGGR_I1
Apr 21 11:45:55 IPSec IPSec "conn_polkan" #1: starting keying attempt 2 of an unlimited number
Apr 21 11:45:55 IPSec IPSec "conn_polkan" #4: initiating Aggressive Mode #4 to replace #1, connection "conn_polkan"
Apr 21 11:59:05 IPSec IPSec "conn_polkan" #4: max number of retransmissions (20) reached STATE_AGGR_I1
Apr 21 11:59:05 IPSec IPSec "conn_polkan" #4: starting keying attempt 3 of an unlimited number

Включите уровень логирования "debugging" на модеме, режим "local" и дождитесь отключения по билингу.

Apr 21 12:07:17 syslog emerg BCM96345 started: BusyBox v1.00 (2010.03.26-02:09+0000)
Apr 21 12:07:17 user debug syslog: klogd &
Apr 21 12:07:17 user notice kernel: klogd started: BusyBox v1.00 (2010.03.26-02:09+0000)
Apr 21 12:08:15 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:08:55 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:09:35 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:10:15 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:10:55 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:11:36 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:12:16 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:12:26 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:12:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:12:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:13:26 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:14:06 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:14:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:15:26 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:16:06 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:16:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:17:26 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:18:06 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:18:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:19:26 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:20:06 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:20:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:21:26 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:22:06 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:22:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:23:25 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:24:06 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:24:49 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:25:26 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:25:36 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:25:56 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:26:36 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:27:16 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:28:36 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:29:15 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:29:55 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:30:35 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:31:15 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:31:55 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:32:35 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:33:15 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:33:55 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:34:35 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:35:16 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:35:56 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:36:36 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:37:16 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:37:56 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:38:36 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:38:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:39:06 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:39:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:40:26 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:41:06 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:41:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:42:26 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:43:06 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:43:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:44:26 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:45:06 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:45:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:46:26 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:47:06 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:47:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:48:26 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:49:06 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:49:46 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:50:26 daemon info racoon: ERROR: not acceptable Aggressive mode

Apr 21 12:57:59 daemon info racoon: INFO: caught signal 15
Apr 21 12:57:59 daemon info racoon: INFO: initiate new phase 2 negotiation: 94.233.12.190[500]<=>92.39.108.42[500]
Apr 21 12:58:00 user debug syslog: racoon -f /var/racoon.conf
Apr 21 12:58:00 daemon info racoon: INFO: @(#)ipsec-tools 0.5.1 (http://ipsec-tools.sourceforge.net)
Apr 21 12:58:00 daemon info racoon: INFO: @(#)This product linked OpenSSL 0.9.7f 22 Mar 2005 (http://www.openssl.org/)
Apr 21 12:58:00 daemon info racoon: INFO: unsupported PF_KEY message REGISTER
Apr 21 12:58:00 daemon info racoon: INFO: unsupported PF_KEY message REGISTER
Apr 21 12:58:00 daemon info racoon: INFO: unsupported PF_KEY message REGISTER
Apr 21 12:58:00 daemon info racoon: ERROR: failed to bind to address 127.0.0.1[500] (Address already in use).
Apr 21 12:58:00 daemon info racoon: ERROR: failed to bind to address 192.168.0.1[500] (Address already in use).
Apr 21 12:58:00 daemon info racoon: ERROR: failed to bind to address 94.233.12.190[500] (Address already in use).
Apr 21 12:58:00 daemon info racoon: ERROR: no address could be bound.
Apr 21 12:58:00 user debug syslog: setkey -f /var/setkey.conf
Apr 21 12:58:00 daemon info racoon: INFO: unsupported PF_KEY message REGISTER
Apr 21 12:58:01 daemon info racoon: INFO: racoon shutdown
Apr 21 12:58:05 user debug syslog: racoon -f /var/racoon.conf
Apr 21 12:58:06 daemon info racoon: INFO: @(#)ipsec-tools 0.5.1 (http://ipsec-tools.sourceforge.net)
Apr 21 12:58:06 daemon info racoon: INFO: @(#)This product linked OpenSSL 0.9.7f 22 Mar 2005 (http://www.openssl.org/)
Apr 21 12:58:06 daemon info racoon: INFO: 127.0.0.1[500] used as isakmp port (fd=12)
Apr 21 12:58:06 daemon info racoon: INFO: 127.0.0.1[500] used for NAT-T
Apr 21 12:58:06 daemon info racoon: INFO: 192.168.0.1[500] used as isakmp port (fd=13)
Apr 21 12:58:06 daemon info racoon: INFO: 192.168.0.1[500] used for NAT-T
Apr 21 12:58:06 daemon info racoon: INFO: 94.233.12.190[500] used as isakmp port (fd=14)
Apr 21 12:58:06 daemon info racoon: INFO: 94.233.12.190[500] used for NAT-T
Apr 21 12:58:06 user debug syslog: setkey -f /var/setkey.conf
Apr 21 12:58:06 daemon info racoon: INFO: unsupported PF_KEY message REGISTER
Apr 21 12:58:09 daemon info racoon: INFO: IPsec-SA request for 92.39.108.42 queued due to no phase1 found.
Apr 21 12:58:09 daemon info racoon: INFO: initiate new phase 1 negotiation: 94.233.12.190[500]<=>92.39.108.42[500]
Apr 21 12:58:09 daemon info racoon: INFO: begin Identity Protection mode.
Apr 21 12:58:09 daemon info racoon: INFO: received Vendor ID: DPD
Apr 21 12:58:10 daemon info racoon: INFO: ISAKMP-SA established 94.233.12.190[500]-92.39.108.42[500] spi:1f0cb4d7c70a599b:5ff7fa0a30daa5e7
Apr 21 12:58:10 daemon info racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, d3adf42f62520d18:6434d2da320bb50c:c7ff2090
Apr 21 12:58:11 daemon info racoon: INFO: initiate new phase 2 negotiation: 94.233.12.190[500]<=>92.39.108.42[500]
Apr 21 12:58:11 daemon info racoon: INFO: IPsec-SA established: ESP/Tunnel 92.39.108.42[0]->94.233.12.190[0] spi=157115104(0x95d62e0)
Apr 21 12:58:11 daemon info racoon: INFO: IPsec-SA established: ESP/Tunnel 94.233.12.190[0]->92.39.108.42[0] spi=1142295257(0x44160ad9)
Apr 21 12:58:17 daemon info racoon: ERROR: not acceptable Aggressive mode
Apr 21 12:58:30 daemon info racoon: ERROR: can't start the quick mode, there is no ISAKMP-SA, d3adf42f62520d18:6434d2da320bb50c:c7ff2090

Меня это уже задрало, ответьте что это за х... при этом 2640 перестает видиться снаружи..... хотя в локалке где он стоит и инет и локалка работают....


Apr 21 15:03:29 IPSec IPSec "conn_polkan" #15: received Delete SA payload: deleting ISAKMP State #15
Apr 21 15:03:29 IPSec IPSec packet from 94.233.12.190:500: received and ignored informational message
Apr 21 15:03:29 IPSec IPSec ERROR: asynchronous network error report on eth0 for message to 94.233.12.190 port 500, complainant 94.233.12.190: Connection refused [errno 146, origin ICMP type 3 code 3 (not authenticated)]
Apr 21 15:16:35 IPSec IPSec "conn_polkan" #24: max number of retransmissions (20) reached STATE_AGGR_I1
Apr 21 15:16:35 IPSec IPSec "conn_polkan" #24: starting keying attempt 18 of an unlimited number
Apr 21 15:16:35 IPSec IPSec "conn_polkan" #25: initiating Aggressive Mode #25 to replace #24, connection "conn_polkan"
Apr 21 15:29:00 IPSec IPSec "conn_polkan" #16: IPsec SA expired (LATEST!)
Apr 21 15:29:45 IPSec IPSec "conn_polkan" #25: max number of retransmissions (20) reached STATE_AGGR_I1
Apr 21 15:29:45 IPSec IPSec "conn_polkan" #25: starting keying attempt 19 of an unlimited number
Apr 21 15:29:45 IPSec IPSec "conn_polkan" #26: initiating Aggressive Mode #26 to replace #25, connection "conn_polkan"
Apr 21 15:42:55 IPSec IPSec "conn_polkan" #26: max number of retransmissions (20) reached STATE_AGGR_I1
Apr 21 15:42:55 IPSec IPSec "conn_polkan" #26: starting keying attempt 20 of an unlimited number
Apr 21 15:42:55 IPSec IPSec "conn_polkan" #27: initiating Aggressive Mode #27 to replace #26, connection "conn_polkan"
Apr 21 15:56:05 IPSec IPSec "conn_polkan" #27: max number of retransmissions (20) reached STATE_AGGR_I1
Apr 21 15:56:05 IPSec IPSec "conn_polkan" #27: starting keying attempt 21 of an unlimited number
Apr 21 15:56:05 IPSec IPSec "conn_polkan" #28: initiating Aggressive Mode #28 to replace #27, connection "conn_polkan"

Хотелось бы комментариев и предложений, после разрыва сессии провом, ipsec не поднимается.

Прояснилось, 2640 не принимает ipsec после любого разрыва пусть то adsl disconnect или отключение удаленного коммутатора. Лечиться только enable\disable IPSEC Connect. ПРОШУ Вас поправть данную особенность это железяки....

Apr 22 15:55:05 daemon info racoon: INFO: IPsec-SA established: ESP/Tunnel 92.39.108.42[0]->94.233.12.190[0] spi=54538701(0x34031cd)
Apr 22 15:55:05 daemon info racoon: INFO: IPsec-SA established: ESP/Tunnel 94.233.12.190[0]->92.39.108.42[0] spi=4070157253(0xf299abc5)
Apr 22 15:55:21 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 15:56:01 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 15:56:41 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 15:57:22 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 15:58:01 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 15:58:41 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 15:59:21 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:00:01 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:00:11 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:00:31 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:01:11 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:01:51 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:02:31 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:02:59 syslog info -- MARK --
Apr 22 16:03:11 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:03:51 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:04:32 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:05:13 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:05:52 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:06:32 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:07:12 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:07:52 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:08:32 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:09:12 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:09:53 user debug kernel: net/ipv4/netfilter/./broadcom/ip_nat_ipsec.c:ipsec_nat_help Out of table entries
Apr 22 16:10:32 daemon info racoon: ERROR: not acceptable Aggressive mode