I have various isakmpd clients behind NAT, connecting to a central isakmpd box. They have two tunnels to the same central box for different networks; occasionally one of them stops functioning correctly.
I managed to catch one today before the user rebooted it and noticed something odd so I thought I'd write it up, partly so others know about the problem, and partly to clarify it in my head. First I'll describe the setup. The central site is on a single machine: no sasyncd, no pfsync. Endpoints are all behind NAT so it's all 'ike dynamic esp' with DPD. Client boxes setup tunnels between their own 192.168.46.xx/28 network and both of 192.168.40.0/21 and $SOME_NET/24. There are also bypass flows for 192.168.46.xx/28 so local traffic isn't handled by ipsec. So in normal use things look like this: FLOWS: flow esp in from 192.168.40.0/21 to 192.168.46.64/27 peer $CENTRAL_BOX srcid foo dstid $CENTRAL_BOX/32 type use flow esp out from 192.168.46.64/27 to 192.168.40.0/21 peer $CENTRAL_BOX srcid foo dstid $CENTRAL_BOX/32 type require flow esp in from $SOME_NET/24 to 192.168.46.64/27 peer $CENTRAL_BOX srcid foo dstid $CENTRAL_BOX/32 type use flow esp out from 192.168.46.64/27 to $SOME_NET/24 peer $CENTRAL_BOX srcid foo dstid $CENTRAL_BOX/32 type require flow esp in from 192.168.46.64/27 to 192.168.46.64/27 type bypass flow esp out from 192.168.46.64/27 to 192.168.46.64/27 type bypass SAD: esp tunnel from 192.168.1.33 to $CENTRAL_BOX spi 0x45182c71 auth hmac-sha1 enc aes esp tunnel from 192.168.1.33 to $CENTRAL_BOX spi 0x478235ac auth hmac-sha1 enc aes esp tunnel from $CENTRAL_BOX to 192.168.1.33 spi 0x48d960e9 auth hmac-sha1 enc aes esp tunnel from $CENTRAL_BOX to 192.168.1.33 spi 0x606a6c9e auth hmac-sha1 enc aes When the 192.168.40.0/21 tunnel stopped working on this box, there were the usual SAs/flows, but also two additional SAs listed. These are present both on the NATted endpoint and the central site: esp tunnel from $CENTRAL_BOX to 192.168.1.33 spi 0x04003c27 auth hmac-sha1 enc aes esp tunnel from $CENTRAL_BOX to 192.168.1.33 spi 0x533787fc auth hmac-sha1 enc aes esp tunnel from 192.168.1.33 to $CENTRAL_BOX spi 0x664d3a34 auth hmac-sha1 enc aes esp tunnel from $CENTRAL_BOX to 192.168.1.33 spi 0x7eb09787 auth hmac-sha1 enc aes esp tunnel from 192.168.1.33 to $CENTRAL_BOX spi 0xc6f132bf auth hmac-sha1 enc aes esp tunnel from 192.168.1.33 to $CENTRAL_BOX spi 0xccc434bc auth hmac-sha1 enc aes Traffic sent from machines inside 192.168.40.0/21 (central network) to 192.168.46.65 (client network) was showing up on enc0 on the central box with spi 0x04003c27, and not showing up on enc0 on the client box. When the 192.168.4x.xx tunnel was failing, the central site was sending traffic on the 0x04003c27 SA. >From looking at this I've worked out that I should collect an isakmpd.result and see what SAs are showing up there (and I'll write something to detect the extra SAs showing up). If anyone has ideas on further things to collect next time it happens please let me know...
