-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Stefan Sczekalla-Waldschmidt wrote:
>>Do you actually see the SAs being synced over? This should >>happen as soon as the connection gets established. ipsecctl >>-v -s all should show the same result on both cluster members >>and the Remote Host. > > Done that - sa where equal on both machines ... > >>>The ipsec-tunnel from LocalLAN to RemoteLAN is running well until I >>>break up e.g. the ( "WAN" ) Connection on Host (M) Carp1 to >>>the Remote Host. >> >>How do you break it? > > we where pulling the Plug at the NIC ... > >>>HOST(B) gets "Carp"-Master as expected, SA's seems to get >>>synced too but the tunnel fails to "failover" and the RemoteHost >>>complains about dropped messages "due to notification type invalid_cookie". >> >>I suppose carp is preempting. > > yes, we'd set the switch in sysctl.conf > >>Use ipsecctl -v -s all again to check the sadb on all hosts. >>I've seen occasions where a new tunnel got created during >>failover and the outgoing packets still used the "old" >>tunnel, while incoming packets were sent over the "new" >>tunnel by the remote host. > > Looked like. What is the best way to go on if the above mentioned > happens ? Looked like what? Do you see two SA pairs after failover? Tcpdump will show you the SPI that each packet is using: "tcpdump -vv host RemoteHost and esp" (check syntax first) Hmm, I don't have access to my lab right now. I remember fixing it somehow, but have to look it up first. Did you configure anything to happen automatically (e.g. restart isakmpd or run ipsecctl/ipsecadm etc.) in case of a failover? This might create the second tunnel. Who initiates the tunnel and how? (again, tcpdump will help you) krgds /markus ps: taking it back to misc@, since I suppose that's what it's for. iD8DBQFDT4ku8BX/d8pVi/cRAiPNAKCROuN7v9UAuCVzrm/RXyhdUtu3nQCgj4+q 2Vu7A88BfAgqsLgO3eP0C4Y= =VVyi -----END PGP SIGNATURE-----
