<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:#2F5496;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#2F5496">Hi Team,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">I am relatively new to IPSEC configurations. Appreciate any help that you can provide in the below issue. Let me know if you need any more details from my end.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">We had an IPSEC tunnel setup between our RHEL server in AWS and LPAR’s in co-location. The connectivity is fine, but we are seeing intermittent connectivity issues and we need to refresh LPAR’s every time to
get the issues resolved.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Please suggest if any time out setting needs to be included as part of the configuration file.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">Below is the IPSEC configuration that I am using<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="color:#2F5496"># grep -v "#" /etc/ipsec.conf<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="color:#2F5496">config setup<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> protostack=netkey<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> logfile=/var/log/pluto.log<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> dumpdir=/var/run/pluto/<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"> nat_traversal=yes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">include /etc/ipsec.d/*.conf<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="color:#2F5496">error logs I am seeing in pluto.log<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:14: "T_XX.XX.XX.XX" #111298: max number of retransmissions (8) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKEv1 message<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:14: "T_XX.XX.XX.XX" #111298: starting keying attempt 1637 of an unlimited number<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:14: "T_XX.XX.XX.XX" #111392: initiating Main Mode to replace #111298<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:14: deleting other state #111298 (STATE_MAIN_I1) "T_XX.XX.XX.XX"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:14: "T_XX.XX.XX.XX" #111392: ignoring informational payload NO_PROPOSAL_CHOSEN, msgid=00000000, length=16<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:14: "T_XX.XX.XX.XX" #111392: received and ignored informational message<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:15: "T_XX.XX.XX.XX" #111392: ignoring informational payload NO_PROPOSAL_CHOSEN, msgid=00000000, length=16<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:15: "T_XX.XX.XX.XX" #111392: received and ignored informational message<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:15: "T_XX.XX.XX.XX" #111392: ignoring informational payload NO_PROPOSAL_CHOSEN, msgid=00000000, length=16<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:15: "T_XX.XX.XX.XX" #111392: received and ignored informational message<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:16: "T_XX.XX.XX.XX" #111300: max number of retransmissions (8) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKEv1 message<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:16: "T_XX.XX.XX.XX" #111300: starting keying attempt 615 of an unlimited number<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:16: "T_XX.XX.XX.XX" #111394: initiating Main Mode to replace #111300<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:16: deleting other state #111300 (STATE_MAIN_I1) "T_XX.XX.XX.XX"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 10:26:16: "T_XX.XX.XX.XX" #111394: ignoring informational payload NO_PROPO<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 07:23:39: "T_XX.XX.XX.XX" #96258: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2 tunnel mode {ESP=>0x23c8bf21 <0xdfa30f1d xfrm=3DES_0-HMAC_SHA1 NATOA=none NATD=none DPD=passive}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496">May 11 07:23:39: "T_XX.XX.XX.XX" #96258: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x23c8bf21 <0xdfa30f1d xfrm=3DES_0-HMAC_SHA1 NATOA=none NATD=none DPD=passive}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#2F5496"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#3B3838">Thanks & Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#3B3838">Sandeep Vegiraju<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#767171">Infrastructure Consulting,
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#767171">Infrastructure Services – Accenture Operations<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#767171">(M) +1-678-790-6631<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by
you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of
internal compliance with Accenture policy. <br>
______________________________________________________________________________________<br>
<br>
www.accenture.com<br>
</font>
</body>
</html>