While doing some failover tests in our lab I stumbled upon a strange behavior which should not really happen:
After plugging out an uplink interface of the HA master, the slave automatically became master and the cluster answered to pings within seconds. But I couldn't connect using IPSec. A look at the logs showed the following lines:
16:16:03 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4460: parsing ModeCfg request
16:16:03 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4460: peer requested virtual IP %any
16:16:03 vpn-2 pluto[6639]: acquired existing lease for address 10.10.10.1 in pool 'VPN_COMPANY1'
16:16:03 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4460: assigning virtual IP 10.10.10.1 to peer
16:16:03 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4460: sending ModeCfg reply
16:16:03 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4460: sent ModeCfg reply, established
16:16:03 vpn-1 pluto[6688]: "D_IPSec_COMPANY1"[5] 192.168.1.11: deleting connection "D_IPSec_COMPANY1" instance with peer 192.168.1.11 {isakmp=#0/ipsec=#0}
16:16:03 vpn-1 pluto[6688]: "D_IPSec_COMPANY1"[5] 192.168.1.11: deleting connection "D_IPSec_COMPANY1" instance with peer 192.168.1.11 {isakmp=#0/ipsec=#0}
16:16:04 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4461: responding to Quick Mode
16:16:04 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4461: ERROR: netlink XFRM_MSG_NEWPOLICY response for flow tun.0@192.168.1.11 included errno 17: File exists
16:16:14 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4461: ERROR: netlink response for Add SA esp.ee62f688@10.20.30.40 included errno 3: No such process
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4461: ERROR: netlink response for Add SA esp.187f480@192.168.1.11 included errno 17: File exists
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4460: received Delete SA payload: deleting ISAKMP State #4460
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: received Vendor ID payload [RFC 3947]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: ignoring Vendor ID payload [16f6ca16e4a4066d83821a0f0aeaa862]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: received Vendor ID payload [XAUTH]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: ignoring Vendor ID payload [Cisco-Unity]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: ignoring Vendor ID payload [FRAGMENTATION 80000000]
16:16:34 vpn-2 pluto[6639]: packet from 192.168.1.11:500: received Vendor ID payload [Dead Peer Detection]
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: responding to Main Mode from unknown peer 192.168.1.11
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: NAT-Traversal: Result using RFC 3947: no NAT detected
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: Peer ID is ID_USER_FQDN: 'myuser@mydomain.tld'
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: crl not found
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: certificate status unknown
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: we have a cert and are sending it
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: sent MR3, ISAKMP SA established
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: sending XAUTH request
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: parsing XAUTH reply
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: extended authentication was successful
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: sending XAUTH status
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: parsing XAUTH ack
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: received XAUTH ack, established
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: parsing ModeCfg request
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: peer requested virtual IP %any
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: assigning virtual IP 10.10.10.1 to peer
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: sending ModeCfg reply
16:16:34 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4462: sent ModeCfg reply, established
16:16:35 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4463: responding to Quick Mode
16:16:35 vpn-2 pluto[6639]: "D_IPSec_COMPANY1"[5] 192.168.1.11 #4463: ERROR: netlink XFRM_MSG_NEWPOLICY response for flow tun.0@192.168.1.11 included errno 17: File exists
The following lines should probably not show up:
ERROR: netlink XFRM_MSG_NEWPOLICY response for flow tun.0@192.168.1.11 included errno 17: File exists
ERROR: netlink response for Add SA esp.ee62f688@10.20.30.40 included errno 3: No such process
ERROR: netlink response for Add SA esp.187f480@192.168.1.11 included errno 17: File exists
When I tried to disconnect and connect again the error message "included errno 17: File exists" kept showing up in the logs. After a restart, everything was back to normal.
So I tried to reproduce it and the exact same thing happened! I know that the VPN tunnels are not supposed to get disconnected after failover and in my case, something seems to be quite broken.
Does anyone know what happened and how I can prevent such a scenario from happening again?
I'm using 8.103 on two ASG 220.
Cheers,
Manuel
This thread was automatically locked due to age.
