This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Verbindungsabbrüche - Dienstunabhängig

Hallo Community!
wir haben eine ASG120 mit Softwareversion 8.202 im hochverfügbarkeitsbetrieb (zwei ASG120er).

Eine Kollegin, die häufig Homeoffice macht, hat festgestellt das es immer wieder einen Verbindungsabbruch gibt. Allerdings lässt sich der CISCO VPN Client sofort wieder verbinden und alles geht ganz normal weiter.

...mit immer wieder meine ich nach einer relativ langen Zeit (1 - 2 Stunden), allerdings unabhängig von Wochentagen, Tages- oder Nachtzeiten. Bei meinem eigenen Privat-PC passiert das Gleiche.

Weiterhin hat ein externer Mitarbeiter (der einzige mit Jabberclient von außen) berichtet, dass sein Spark und Psi (Jabberclients) nach einer langen Zeit die Verbindung verlieren.

---> Meine Vermutung ist, dass es an der Astaro liegt.
---> Meine Frage: Gibt es eine Einstellung/Funktion in der Astaro die eine dauerhafte Verbindung nach gewisser Zeit trennt?

This thread was automatically locked due to age.

0 BAlfson over 12 years ago

(Sorry, I can't get my German-speaking brain to work [:(])

This was discussed earlier this month in the VPN forum: https://community.sophos.com/products/unified-threat-management/astaroorg/f/58/t/54186

Apparently, the problem is that IPsec tries to negotiate a new Security Association (SA) after one hour. If the IPsec daemon can't get a response to a ping, it assumes that the client isn't there, and then closes the connection. What happens if you select 'Firewall is Ping visible' and 'Ping from Firewall' on the 'ICMP' tab?

If that doesn't fix the problem, please post the 20+ lines from the IPsec log before the "connection terminated" message.

MfG - Bob (Bitte, auf Deutsch weiterhin!)

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

0 Scorp1337 over 12 years ago in reply to BAlfson

Hi BAlfson!
danke für die Antwort. Ich habe es jetzt getestet. Inzwischen kann ich auch sagen, dass der Cisco VPN Client folgende Message bringt, sowie wie lang die Verbindung aufrecht erhalten wird:

Connection terminated by Peer .

Reason 433: (Reason not specified by Peer)

Duration: 02:09:42

Außerdem hier der IPsec Log... hab mal ein wenig maskiert...
Die Einstellungen mit dem ICMP habe ich natürlcih vorher gesetzt.

2011:10:26-11:11:56 721astaro-1 pluto[6746]: | state hash entry 6

2011:10:26-11:11:56 721astaro-1 pluto[6746]: "D_REF_mzzgsRmeni_19"[11] 111.222.333.444:52827: deleting connection "D_REF_mzzgsRmeni_19"[11] instance with peer 111.222.333.444 {isakmp=#0/ipsec=#0}

2011:10:26-11:11:56 721astaro-1 pluto[6746]: | creating state object #22136 at 0x95a62e0

2011:10:26-11:11:56 721astaro-1 pluto[6746]: | instantiated "D_REF_mzzgsRmeni_19" for 111.222.333.444

2011:10:26-11:11:56 721astaro-1 pluto[6746]: | inserting event EVENT_SA_REPLACE, timeout in 3930 seconds for #6693

2011:10:26-11:11:56 721astaro-1 pluto[6746]: | ICOOKIE:  07 3a 94 f7  7d fc 71 ea

2011:10:26-11:11:56 721astaro-1 pluto[6746]: | RCOOKIE:  08 ac 62 b3  9d 28 98 72

2011:10:26-11:11:56 721astaro-1 pluto[6746]: | peer:  95 ac 8e bb

2011:10:26-11:11:56 721astaro-1 pluto[6746]: | state hash entry 6

2011:10:26-11:11:56 721astaro-1 pluto[6746]: | next event EVENT_SA_EXPIRE in 3 seconds for #6694

2011:10:26-11:11:59 721astaro-2 pluto[15806]: | 

2011:10:26-11:11:59 721astaro-2 pluto[15806]: | *time to handle event

2011:10:26-11:11:59 721astaro-2 pluto[15806]: | event after this is EVENT_SA_SYNC_UPDATE in 12 seconds

2011:10:26-11:11:59 721astaro-2 pluto[15806]: "D_REF_mzzgsRmeni_18"[19] 111.222.333.444:52827 #6694: IPsec SA expired (LATEST!)

2011:10:26-11:11:59 721astaro-1 pluto[6746]: | executing down-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='down-client' PLUTO_CONNECTION='D_REF_mzzgsRmeni_18' PLUTO_NEXT_HOP='111.222.333.444' PLUTO_INTERFACE='eth1' PLUTO_REQID='75573' PLUTO_ME='555.666.777.888' PLUTO_MY_ID='721astaro.domain.de' PLUTO_MY_CLIENT='0.0.0.0/0' PLUTO_MY_CLIENT_NET='0.0.0.0' PLUTO_MY_CLIENT_MASK='0.0.0.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='111.222.333.444' PLUTO_PEER_ID='C=de, L=StadtStadt, O=domain, CN=Max Mustermann, E=Max.Mustermann@domain.de' PLUTO_PEER_CLIENT='10.242.5.2/32' PLUTO_PEER_CLIENT_NET='10.242.5.2' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=de, L=StadtStadt, O=domain, CN=domain VPN CA, E=it@domain.de' /usr/libexec/ipsec/updown classic

2011:10:26-11:11:59 721astaro-2 pluto[15806]: | ICOOKIE:  07 3a 94 f7  7d fc 71 ea

2011:10:26-11:11:59 721astaro-2 pluto[15806]: | RCOOKIE:  08 ac 62 b3  9d 28 98 72

2011:10:26-11:11:59 721astaro-2 pluto[15806]: | peer:  95 ac 8e bb

2011:10:26-11:11:59 721astaro-2 pluto[15806]: | state hash entry 6

2011:10:26-11:11:59 721astaro-2 pluto[15806]: | executing down-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='down-client' PLUTO_CONNECTION='D_REF_mzzgsRmeni_18' PLUTO_NEXT_HOP='111.222.333.444' PLUTO_INTERFACE='eth1' PLUTO_REQID='43085' PLUTO_ME='555.666.777.888' PLUTO_MY_ID='721astaro.domain.de' PLUTO_MY_CLIENT='0.0.0.0/0' PLUTO_MY_CLIENT_NET='0.0.0.0' PLUTO_MY_CLIENT_MASK='0.0.0.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='111.222.333.444' PLUTO_PEER_ID='C=de, L=StadtStadt, O=domain, CN=Max Mustermann, E=Max.Mustermann@domain.de' PLUTO_PEER_CLIENT='10.242.5.2/32' PLUTO_PEER_CLIENT_NET='10.242.5.2' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=de, L=StadtStadt, O=domain, CN=domain VPN CA, E=it@domain.de' PLUTO_XAUTH_ID='Max.Mustermann' /usr/libexec/ipsec/updown classic

2011:10:26-11:11:59 721astaro-1 pluto[6746]: id="2202" severity="info" sys="SecureNet" sub="vpn" event="Connection terminated" username="C=de, L=StadtStadt, O=domain, CN=Max Mustermann, E=Max.Mustermann@domain.de" variant="ipsec" srcip="111.222.333.444" virtual_ip="10.242.5.2"

0 BAlfson over 12 years ago

Wenn Debug activiert ist, muss man viel mehr als 20 Seile sehen - da sehe ich eigentlich nur drei [;)]

2011:10:26-11:11:56 721astaro-1 pluto[6746]: "D_REF_mzzgsRmeni_19"[11] 111.222.333.444:52827: deleting connection "D_REF_mzzgsRmeni_19"[11] instance with peer 111.222.333.444 {isakmp=#0/ipsec=#0}

2011:10:26-11:11:59 721astaro-2 pluto[15806]: "D_REF_mzzgsRmeni_18"[19] 111.222.333.444:52827 #6694: IPsec SA expired (LATEST!)

2011:10:26-11:11:59 721astaro-1 pluto[6746]: id="2202" severity="info" sys="SecureNet" sub="vpn" event="Connection terminated" username="C=de, L=StadtStadt, O=domain, CN=Max Mustermann, E=Max.Mustermann@domain.de" variant="ipsec" srcip="111.222.333.444" virtual_ip="10.242.5.2"

MfG - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA

0 Scorp1337 over 12 years ago in reply to BAlfson

Ich werd morgen früh nochmal testen und dann hier posten.

...von debug war keine Rede ;-)
Cancel
Vote Up 0 Vote Down

Cancel
0 Scorp1337 over 12 years ago in reply to BAlfson

Ich werd morgen früh nochmal testen und dann hier posten.

...von debug war keine Rede ;-)
Cancel
Vote Up 0 Vote Down

Cancel

0 Scorp1337 over 12 years ago in reply to Scorp1337

Hi!
heute ist die Fehlermeldung bzw. Beendigung der Connection mit einer anderen Meldung beendet worden:

Secure VPN Connection terminated locally by the Client.

Reason 412: The remote peer is no longer responding.

Duration: 01:00:11

Ich habe außerdem vor dem Verbinden in der ASG bei Fernzugriff > SSL > Erweitert den Haken bei Fehlersuche-Modus aktivieren gesetzt.

2011:10:27-09:31:52 721astaro-2 pluto[15806]: | 

2011:10:27-09:31:52 721astaro-2 pluto[15806]: | *received 92 bytes from 111.222.333.444:53766 on eth1

2011:10:27-09:31:52 721astaro-2 pluto[15806]: | ICOOKIE:  be 1a fb 7d  d9 a8 b9 4c

2011:10:27-09:31:52 721astaro-2 pluto[15806]: | RCOOKIE:  80 8f 96 f4  0c 12 00 b3

2011:10:27-09:31:52 721astaro-2 pluto[15806]: | peer:  95 ac 8e bb

2011:10:27-09:31:52 721astaro-2 pluto[15806]: | state hash entry 12

2011:10:27-09:31:52 721astaro-2 pluto[15806]: | state object #6719 found, in STATE_MODE_CFG_R1

2011:10:27-09:31:52 721astaro-2 pluto[15806]: | received DPD notification R_U_THERE_ACK with seqno = 25609

2011:10:27-09:31:52 721astaro-2 pluto[15806]: | next event EVENT_SA_EXPIRE in 10 seconds for #6720

2011:10:27-09:32:02 721astaro-1 pluto[6746]: | 

2011:10:27-09:32:02 721astaro-1 pluto[6746]: | *time to handle event

2011:10:27-09:32:02 721astaro-1 pluto[6746]: | event after this is EVENT_REINIT_SECRET in 704 seconds

2011:10:27-09:32:02 721astaro-1 pluto[6746]: "D_REF_mzzgsRmeni_18"[22] 111.222.333.444:53766 #6720: IPsec SA expired (LATEST!)

2011:10:27-09:32:02 721astaro-1 pluto[6746]: | executing down-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='down-client' PLUTO_CONNECTION='D_REF_mzzgsRmeni_18' PLUTO_NEXT_HOP='111.222.333.444' PLUTO_INTERFACE='eth1' PLUTO_REQID='83821' PLUTO_ME='213.144.8.92' PLUTO_MY_ID='721astaro.domain.tld' PLUTO_MY_CLIENT='0.0.0.0/0' PLUTO_MY_CLIENT_NET='0.0.0.0' PLUTO_MY_CLIENT_MASK='0.0.0.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='111.222.333.444' PLUTO_PEER_ID='C=de, L=stadtstadt, O=Firma, CN=max mustermann, E=max.mustermann@domain.tld' PLUTO_PEER_CLIENT='10.242.5.2/32' PLUTO_PEER_CLIENT_NET='10.242.5.2' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=de, L=stadtstadt, O=Firma, CN=Firma VPN CA, E=it@domain.tld' /usr/libexec/ipsec/updown classic

2011:10:27-09:32:02 721astaro-2 pluto[15806]: | 

2011:10:27-09:32:02 721astaro-2 pluto[15806]: | *time to handle event

2011:10:27-09:32:02 721astaro-2 pluto[15806]: | event after this is EVENT_SA_SYNC_UPDATE in 2 seconds

2011:10:27-09:32:02 721astaro-2 pluto[15806]: "D_REF_mzzgsRmeni_18"[22] 111.222.333.444:53766 #6720: IPsec SA expired (LATEST!)

2011:10:27-09:32:02 721astaro-1 pluto[6746]: id="2202" severity="info" sys="SecureNet" sub="vpn" event="Connection terminated" username="C=de, L=stadtstadt, O=Firma, CN=max mustermann, E=max.mustermann@domain.tld" variant="ipsec" srcip="111.222.333.444" virtual_ip="10.242.5.2"

2011:10:27-09:32:02 721astaro-2 pluto[15806]: | ICOOKIE:  be 1a fb 7d  d9 a8 b9 4c

2011:10:27-09:32:02 721astaro-2 pluto[15806]: | RCOOKIE:  80 8f 96 f4  0c 12 00 b3

2011:10:27-09:32:02 721astaro-2 pluto[15806]: | peer:  95 ac 8e bb

2011:10:27-09:32:02 721astaro-2 pluto[15806]: | state hash entry 12

2011:10:27-09:32:02 721astaro-2 pluto[15806]: | executing down-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='down-client' PLUTO_CONNECTION='D_REF_mzzgsRmeni_18' PLUTO_NEXT_HOP='111.222.333.444' PLUTO_INTERFACE='eth1' PLUTO_REQID='43125' PLUTO_ME='213.144.8.92' PLUTO_MY_ID='721astaro.domain.tld' PLUTO_MY_CLIENT='0.0.0.0/0' PLUTO_MY_CLIENT_NET='0.0.0.0' PLUTO_MY_CLIENT_MASK='0.0.0.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='111.222.333.444' PLUTO_PEER_ID='C=de, L=stadtstadt, O=Firma, CN=max mustermann, E=max.mustermann@domain.tld' PLUTO_PEER_CLIENT='10.242.5.2/32' PLUTO_PEER_CLIENT_NET='10.242.5.2' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=de, L=stadtstadt, O=Firma, CN=Firma VPN CA, E=it@domain.tld' PLUTO_XAUTH_ID='max.mustermann' /usr/libexec/ipsec/updown classic

2011:10:27-09:32:03 721astaro-2 pluto[15806]: id="2202" severity="info" sys="SecureNet" sub="vpn" event="Connection terminated" username="max.mustermann" variant="ipsec" srcip="111.222.333.444" virtual_ip="10.242.5.2"

2011:10:27-09:32:04 721astaro-1 pluto[6746]: updown: called /usr/bin/ras_update.plx ipsec disconnect vpnid C=de, L=stadtstadt, O=Firma, CN=max mustermann, E=max.mustermann@domain.tld 10.242.5.2 REF_mzzgsRmeni (0)

0 BAlfson over 12 years ago

Bitte, keinen Haken machen/lassen, und dann versuche noch einmal.

MfG - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 12 years ago

Inzwischen habe ich Folgendes in KIL gefunden:
ID14692 8.000 Terminating Cisco Remote access connections after end of phase 2 lifetime
------------------------------------------------------------------------
Description:
Workaround:   Increase the lifetimes for IKE and IPsec on the ASG. Since
              Cisco VPN uses a fixed policy you need to edit it on the
              command line via confd-client. It's at
              OBJS:ipsec->policy->REF_IPsecPolicyCisco. Values to be
              increased are ike_sa_lifetime and ipsec_sa_lifetime.
              Maximum value accepted by pluto is 86400.

MfG -Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

0 Scorp1337 over 12 years ago in reply to BAlfson

Was ist ein(e) KIL? (issuetracker/docu?)

Habe die zwei übrig gebliebenen Haken entfernt, nachdem ich deinen Screenshot gesehen habe. Hier wieder die Logs:

2011:10:31-11:31:38 721astaro-2 pluto[24756]: "D_REF_mzzgsRmeni_18"[5] 111.222.333.444.555:56990 #52: max number of retransmissions (2) reached STATE_QUICK_I1

2011:10:31-11:31:44 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_19"[4] 111.222.333.444.555:56990: deleting connection "D_REF_mzzgsRmeni_19"[4] instance with peer 111.222.333.444.555 {isakmp=#0/ipsec=#0}

2011:10:31-11:31:44 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_19"[4] 111.222.333.444.555:56990: deleting connection "D_REF_mzzgsRmeni_19"[4] instance with peer 111.222.333.444.555 {isakmp=#0/ipsec=#0}

2011:10:31-11:31:44 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_7"[4] 666.777.888.999:2232: deleting connection "D_REF_mzzgsRmeni_7"[4] instance with peer 666.777.888.999 {isakmp=#0/ipsec=#0}

2011:10:31-11:31:45 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_7"[4] 666.777.888.999:2232: deleting connection "D_REF_mzzgsRmeni_7"[4] instance with peer 666.777.888.999 {isakmp=#0/ipsec=#0}

2011:10:31-11:31:59 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_19"[4] 111.222.333.444.555:56990: deleting connection "D_REF_mzzgsRmeni_19"[4] instance with peer 111.222.333.444.555 {isakmp=#0/ipsec=#0}

2011:10:31-11:31:59 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_19"[4] 111.222.333.444.555:56990: deleting connection "D_REF_mzzgsRmeni_19"[4] instance with peer 111.222.333.444.555 {isakmp=#0/ipsec=#0}

2011:10:31-11:31:59 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_7"[4] 666.777.888.999:2232: deleting connection "D_REF_mzzgsRmeni_7"[4] instance with peer 666.777.888.999 {isakmp=#0/ipsec=#0}

2011:10:31-11:31:59 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_7"[4] 666.777.888.999:2232: deleting connection "D_REF_mzzgsRmeni_7"[4] instance with peer 666.777.888.999 {isakmp=#0/ipsec=#0}

2011:10:31-11:32:14 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_19"[4] 111.222.333.444.555:56990: deleting connection "D_REF_mzzgsRmeni_19"[4] instance with peer 111.222.333.444.555 {isakmp=#0/ipsec=#0}

2011:10:31-11:32:14 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_19"[4] 111.222.333.444.555:56990: deleting connection "D_REF_mzzgsRmeni_19"[4] instance with peer 111.222.333.444.555 {isakmp=#0/ipsec=#0}

2011:10:31-11:32:14 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_7"[4] 666.777.888.999:2232: deleting connection "D_REF_mzzgsRmeni_7"[4] instance with peer 666.777.888.999 {isakmp=#0/ipsec=#0}

2011:10:31-11:32:14 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_7"[4] 666.777.888.999:2232: deleting connection "D_REF_mzzgsRmeni_7"[4] instance with peer 666.777.888.999 {isakmp=#0/ipsec=#0}

2011:10:31-11:32:29 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_19"[4] 111.222.333.444.555:56990: deleting connection "D_REF_mzzgsRmeni_19"[4] instance with peer 111.222.333.444.555 {isakmp=#0/ipsec=#0}

2011:10:31-11:32:29 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_19"[4] 111.222.333.444.555:56990: deleting connection "D_REF_mzzgsRmeni_19"[4] instance with peer 111.222.333.444.555 {isakmp=#0/ipsec=#0}

2011:10:31-11:32:29 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_7"[4] 666.777.888.999:2232: deleting connection "D_REF_mzzgsRmeni_7"[4] instance with peer 666.777.888.999 {isakmp=#0/ipsec=#0}

2011:10:31-11:32:29 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_7"[4] 666.777.888.999:2232: deleting connection "D_REF_mzzgsRmeni_7"[4] instance with peer 666.777.888.999 {isakmp=#0/ipsec=#0}

2011:10:31-11:32:38 721astaro-1 pluto[30033]: "D_REF_mzzgsRmeni_18"[5] 111.222.333.444.555:56990 #47: IPsec SA expired (LATEST!)

2011:10:31-11:32:38 721astaro-2 pluto[24756]: "D_REF_mzzgsRmeni_18"[5] 111.222.333.444.555:56990 #47: IPsec SA expired (LATEST!)

2011:10:31-11:32:38 721astaro-1 pluto[30033]: id="2202" severity="info" sys="SecureNet" sub="vpn" event="Connection terminated" username="C=de, L=Stadt, O=Firma, CN=max Mustermann, E=max.Mustermann@domain.de" variant="ipsec" srcip="111.222.333.444.555" virtual_ip="10.242.5.2"

2011:10:31-11:32:38 721astaro-2 pluto[24756]: id="2202" severity="info" sys="SecureNet" sub="vpn" event="Connection terminated" username="max.Mustermann" variant="ipsec" srcip="111.222.333.444.555" virtual_ip="10.242.5.2"

Ansonsten weiss ich ehrlich gesagt nicht ganz was ich machen soll...
Habe zwar nach einem confd client gegoogelt, aber es schein kein Tool zu sein, welches auf meiner Windowsmaschine laufen würde... !?!?

0 BAlfson over 12 years ago

KIL = Known Issues List
(Sorry, I can't get my German-speaking brain working right now. [:(])

Your logs confirm that the problem is the one in the KIL. This fix requires working as root on the command line and so is something that you should ask your reseller to submit a ticket to Astaro Support.

MfG - Bob (Bitte, auf Deutsch weiterhin!)

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel