Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Ipsec vpn tunnels got disconnected randomly but when we restart raccon all tunnel will come up again with out any issue.I would like to know a permanent fix for this.

These are the logs:

racoon: ERROR: phase2 negotiation failed due to send error. 4ca6a54e16755b0b:5e5f8815483f5a75:0000abbe
racoon: [Off]: INFO: initiate new phase 2 negotiation: x.x.x.x[500]<=>x.x.x.x[500]
racoon: ERROR: failed to start post getspi.
racoon: ERROR: phase2 negotiation failed due to send error. 4ca6a54e16755b0b:5e5f8815483f5a75:0000d553
racoon: [Off]: INFO: initiate new phase 2 negotiation: x.x.x.x[500]<=>x.x.x.x[500]
racoon: ERROR: failed to start post getspi.
share|improve this question

1 Answer 1

up vote 1 down vote accepted

Looks like what happens when you have a misconfigured PPTP server and a client disconnects. PPTP server should never use a real assigned IP as its server IP.

share|improve this answer
    
> Thank your for your reply.I believe pptp is configured correctly.The same configuration worked perfectly only my old pfsesne(1.2.3).One day before i have disabled nat-t and unchecked Prefer older IPsec SAs but still the VPN went down where there is not activity(normally at night). –  dddddd Apr 5 '13 at 10:31
    
Here is the logs: racoon: ERROR: failed to begin ipsec sa negotication. racoon: ERROR: phase1 negotiation failed due to send error. 8121c0917ca543ac:0000000000000000 racoon: INFO: begin Aggressive mode. racoon: [Off]: INFO: initiate new phase 1 negotiation: x.x.x.x[500]<=>x.x.x.x2[500] racoon: [Off]: INFO: IPsec-SA request for x.x.x.x2 queued due to no phase1 found. racoon: ERROR: failed to begin ipsec sa negotication. –  dddddd Apr 5 '13 at 10:36
    
Today i have tired selecting Prefer older IPsec SAs and disabling nat-t.the tunnels are still up(NOT SURE HOW LONG).I noticed one error in the log but the tunnels are up here is the log: racoon: [x.x.x.x2] ERROR: notification INVALID-SPI received in informational exchange. –  dddddd Apr 5 '13 at 10:39
    
What's your "Server IP" in the PPTP server? If it's an IP assigned to your firewall anywhere, that's wrong. I'm guessing it's your WAN IP, which it should never be. That's the IP inside the tunnel. –  Chris Buechler Apr 10 '13 at 10:16
    
That didn't actually start breaking IPsec until the newer base components in 2.x release versions. It's always been a wrong config, just one that worked by chance. –  Chris Buechler Apr 10 '13 at 10:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.