[Comm] вопрос по ipsec (связь теряется)

[Vitaly Gorshkov]

Ситуация:
1) комп
   AltMAster 2.4 + Backports + updates

ipsec.conf
config setup
        interfaces="ipsec1=ppp0"
        klipsdebug=none
        plutodebug=none
        plutoload=%search
        plutostart=%search
conn %default
        keyingtries=0
        disablearrivalcheck=no
        auth=esp
        authby=rsasig
        compress=yes
        pfs=yes
        ah=hmac-md5-96
        esp=3des-md5-96
        ike=3des-md5-modp1536,3des-md5-modp1024,3des-sha-modp1536,3des-sha-modp1024
conn ru-prag-perehod
    auth=esp
    esp=3des-md5
    type=tunnel
    authby=secret
    left=x.x.x.x
    leftnexthop=x.x.x.x
    leftsubnet=192.168.2.0/24
    right=x.x.x.x
    rightnexthop=x.x.x.x
    rightsubnet=172.16.0.0/24
    spi=0x300
    auto=start


# rpm -qa|grep swan
openswan-1.0.9-alt0.M24.1

------------------------------------------------
2) комп
Slackware
# uname -r
2.4.26
FreeSwan

ipsec.conf
config setup
         interfaces="ipsec1=eth0"
         klipsdebug=none
         plutodebug=none


conn %default
        keyingtries=0
        disablearrivalcheck=no
        auth=esp
        authby=rsasig
        compress=yes
        pfs=yes

conn prag-ru-perehod
        auth=esp
        type=tunnel
        authby=secret
        left=x.x.x.x
        leftnexthop=x.x.x.x
        leftsubnet=192.168.2.0/24
        right=x.x.x.x
        rightnexthop=x.x.x.x
        rightsubnet=172.16.0.0/24
        spi=0x300
        #auto=add
        auto=start
---------------------------------------------------

Периодически (раз в день), связь теряется - машины в другой сети не
пингуется,
лечится ipsec setup

----------------------------------------------------------------

вот отличия ipsec auto -status

а)когда висит соединение:
..
000 "ru-prag-perehod":   newest ISAKMP SA: #1; newest IPsec SA: #2; eroute owner: #2
..
000 #2: "ru-prag-perehod" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 27930s; newest IPSEC; eroute owner
000 #2: "ru-prag-perehod" esp.78c3b689 на x.x.x.x esp.9983ff97 на x.x.x.x comp.22da на x.x.x.x comp.a164 на x.x.x.x tun.1002 на x.x.x.x tun.1001 на x.x.x.x
000 #1: "ru-prag-perehod" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2993s; newest ISAKMP

б) ipsec setup restart
ipsec auto --status
...
000 "ru-prag-perehod":   newest ISAKMP SA: #32; newest IPsec SA: #26; eroute owner: #26
..
000 #31: "ru-prag-perehod" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 456s
000 #26: "ru-prag-perehod" STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 12653s; newest IPSEC; eroute owner
000 #26: "ru-prag-perehod" esp.78c3b65e на x.x.x.x esp.63daaf5c на x.x.x.x comp.22af на x.x.x.x comp.e4a1 на x.x.x.x tun.1008 на x.x.x.x tun.1007 на x.x.x.x
000 #32: "ru-prag-perehod" STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 3288s; newest ISAKMP






-- 
С уважением,
 Vitaly                          mailto:vita55555 на mail.ru
icq: 138491970