Hi,
I've created a gateway-to-gateway IPSec tunnel with another company with
whom we exchange data. They're using a Cisco and we're using ISA 2004. The
tunnel works for the most part, but once every 17-18 hours the tunnel will
go down for exactly one hour. This morning, for example, the tunnel was down
from 7:11am-8:11am. Here are the contents from the IPSec log on the ISA
machine. These log entries were made immediately prior to the tunnel going
down. Any ideas?
3-14: 07:11:40:224:6e8
3-14: 07:11:40:224:6e8 Receive: (get) SA = 0x00000000 from
65.213.17.228.500
3-14: 07:11:40:224:6e8 ISAKMP Header: (V1.0), len = 148
3-14: 07:11:40:224:6e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:11:40:224:6e8 R-COOKIE 0000000000000000
3-14: 07:11:40:224:6e8 exchange: Oakley Main Mode
3-14: 07:11:40:224:6e8 flags: 0
3-14: 07:11:40:224:6e8 next payload: SA
3-14: 07:11:40:224:6e8 message ID: 00000000
3-14: 07:11:40:224:6e8 Filter to match: Src 65.213.17.228 Dst 38.96.8.162
3-14: 07:11:40:224:6e8 MM PolicyName: ISA Server Comstock MM Policy
3-14: 07:11:40:224:6e8 MMPolicy dwFlags 0 SoftSAExpireTime 28800
3-14: 07:11:40:224:6e8 MMOffer[0] LifetimeSec 86400 QMLimit 0 DHGroup 2
3-14: 07:11:40:224:6e8 MMOffer[0] Encrypt: Triple DES CBC Hash: MD5
3-14: 07:11:40:224:6e8 Auth[0]:PresharedKey KeyLen 26
3-14: 07:11:40:224:6e8 Responding with new SA 1194c0
3-14: 07:11:40:224:6e8 processing payload SA
3-14: 07:11:40:224:6e8 Received Phase 1 Transform 1
3-14: 07:11:40:224:6e8 Oakley Group 2
3-14: 07:11:40:224:6e8 Encryption Alg Triple DES CBC(5)
3-14: 07:11:40:224:6e8 Hash Alg MD5(1)
3-14: 07:11:40:224:6e8 Auth Method Preshared Key(1)
3-14: 07:11:40:224:6e8 Life type in Seconds
3-14: 07:11:40:224:6e8 Life duration of 86400
3-14: 07:11:40:224:6e8 Phase 1 SA accepted: transform=1
3-14: 07:11:40:224:6e8 SA - Oakley proposal accepted
3-14: 07:11:40:224:6e8 processing payload VENDOR ID
3-14: 07:11:40:224:6e8 Received VendorId draft-ietf-ipsec-nat-t-ike-02
3-14: 07:11:40:224:6e8 processing payload VENDOR ID
3-14: 07:11:40:224:6e8 processing payload VENDOR ID
3-14: 07:11:40:224:6e8 Received VendorId FRAGMENTATION
3-14: 07:11:40:224:6e8 ClearFragList
3-14: 07:11:40:224:6e8 constructing ISAKMP Header
3-14: 07:11:40:224:6e8 constructing SA (ISAKMP)
3-14: 07:11:40:224:6e8 Constructing Vendor MS NT5 ISAKMPOAKLEY
3-14: 07:11:40:224:6e8 Constructing Vendor FRAGMENTATION
3-14: 07:11:40:224:6e8 Constructing Vendor draft-ietf-ipsec-nat-t-ike-02
3-14: 07:11:40:224:6e8
3-14: 07:11:40:224:6e8 Sending: SA = 0x001194C0 to 65.213.17.228:Type 2.500
3-14: 07:11:40:224:6e8 ISAKMP Header: (V1.0), len = 148
3-14: 07:11:40:224:6e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:11:40:224:6e8 R-COOKIE c836ceb6ff11058e
3-14: 07:11:40:224:6e8 exchange: Oakley Main Mode
3-14: 07:11:40:224:6e8 flags: 0
3-14: 07:11:40:224:6e8 next payload: SA
3-14: 07:11:40:224:6e8 message ID: 00000000
3-14: 07:11:40:224:6e8 Ports S:f401 D:f401
3-14: 07:11:40:302:6e8
3-14: 07:11:40:302:6e8 Receive: (get) SA = 0x001194c0 from
65.213.17.228.500
3-14: 07:11:40:302:6e8 ISAKMP Header: (V1.0), len = 296
3-14: 07:11:40:302:6e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:11:40:302:6e8 R-COOKIE c836ceb6ff11058e
3-14: 07:11:40:302:6e8 exchange: Oakley Main Mode
3-14: 07:11:40:302:6e8 flags: 0
3-14: 07:11:40:302:6e8 next payload: KE
3-14: 07:11:40:302:6e8 message ID: 00000000
3-14: 07:11:40:302:6e8 processing payload KE
3-14: 07:11:40:381:6e8 processing payload NONCE
3-14: 07:11:40:381:6e8 processing payload VENDOR ID
3-14: 07:11:40:381:6e8 processing payload VENDOR ID
3-14: 07:11:40:381:6e8 processing payload VENDOR ID
3-14: 07:11:40:381:6e8 processing payload VENDOR ID
3-14: 07:11:40:381:6e8 processing payload NATDISC
3-14: 07:11:40:381:6e8 Processing NatHash
3-14: 07:11:40:381:6e8 Nat hash e6c97ee01617bb817131238e68208e88
3-14: 07:11:40:381:6e8
3-14: 07:11:40:381:6e8 SA StateMask2 e
3-14: 07:11:40:381:6e8 processing payload NATDISC
3-14: 07:11:40:381:6e8 Processing NatHash
3-14: 07:11:40:381:6e8 Nat hash 5c15317e190402d696db8f7cfd8690c3
3-14: 07:11:40:381:6e8
3-14: 07:11:40:381:6e8 SA StateMask2 8e
3-14: 07:11:40:381:6e8 ClearFragList
3-14: 07:11:40:381:6e8 constructing ISAKMP Header
3-14: 07:11:40:381:6e8 constructing KE
3-14: 07:11:40:381:6e8 constructing NONCE (ISAKMP)
3-14: 07:11:40:381:6e8 Constructing NatDisc
3-14: 07:11:40:381:6e8
3-14: 07:11:40:381:6e8 Sending: SA = 0x001194C0 to 65.213.17.228:Type 2.500
3-14: 07:11:40:381:6e8 ISAKMP Header: (V1.0), len = 224
3-14: 07:11:40:381:6e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:11:40:381:6e8 R-COOKIE c836ceb6ff11058e
3-14: 07:11:40:381:6e8 exchange: Oakley Main Mode
3-14: 07:11:40:381:6e8 flags: 0
3-14: 07:11:40:381:6e8 next payload: KE
3-14: 07:11:40:381:6e8 message ID: 00000000
3-14: 07:11:40:381:6e8 Ports S:f401 D:f401
3-14: 07:11:40:459:6e8
3-14: 07:11:40:459:6e8 Receive: (get) SA = 0x001194c0 from
65.213.17.228.500
3-14: 07:11:40:459:6e8 ISAKMP Header: (V1.0), len = 84
3-14: 07:11:40:459:6e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:11:40:459:6e8 R-COOKIE c836ceb6ff11058e
3-14: 07:11:40:459:6e8 exchange: Oakley Main Mode
3-14: 07:11:40:459:6e8 flags: 1 ( encrypted )
3-14: 07:11:40:459:6e8 next payload: ID
3-14: 07:11:40:459:6e8 message ID: 00000000
3-14: 07:11:40:459:6e8 processing payload ID
3-14: 07:11:40:459:6e8 processing payload HASH
3-14: 07:11:40:459:6e8 AUTH: Phase I authentication accepted
3-14: 07:11:40:459:6e8 processing payload VENDOR ID
3-14: 07:11:40:459:6e8 ClearFragList
3-14: 07:11:40:459:6e8 constructing ISAKMP Header
3-14: 07:11:40:459:6e8 constructing ID
3-14: 07:11:40:459:6e8 MM ID Type 1
3-14: 07:11:40:459:6e8 MM ID 266008a2
3-14: 07:11:40:459:6e8 constructing HASH
3-14: 07:11:40:459:6e8 MM established. SA: 001194C0
3-14: 07:11:40:459:6e8
3-14: 07:11:40:459:6e8 Sending: SA = 0x001194C0 to 65.213.17.228:Type 2.500
3-14: 07:11:40:459:6e8 ISAKMP Header: (V1.0), len = 60
3-14: 07:11:40:459:6e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:11:40:459:6e8 R-COOKIE c836ceb6ff11058e
3-14: 07:11:40:459:6e8 exchange: Oakley Main Mode
3-14: 07:11:40:459:6e8 flags: 1 ( encrypted )
3-14: 07:11:40:459:6e8 next payload: ID
3-14: 07:11:40:459:6e8 message ID: 00000000
3-14: 07:11:40:459:6e8 Ports S:f401 D:f401
3-14: 07:11:40:974:5e8 retransmit: sa = 001194C0 centry 00000000 , count =
1
3-14: 07:11:40:974:5e8
3-14: 07:11:40:974:5e8 Sending: SA = 0x001194C0 to 65.213.17.228:Type 2.500
3-14: 07:11:40:974:5e8 ISAKMP Header: (V1.0), len = 60
3-14: 07:11:40:974:5e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:11:40:974:5e8 R-COOKIE c836ceb6ff11058e
3-14: 07:11:40:974:5e8 exchange: Oakley Main Mode
3-14: 07:11:40:974:5e8 flags: 1 ( encrypted )
3-14: 07:11:40:974:5e8 next payload: ID
3-14: 07:11:40:974:5e8 message ID: 00000000
3-14: 07:11:40:974:5e8 Ports S:f401 D:f401
3-14: 07:11:42:974:5e8 retransmit: sa = 001194C0 centry 00000000 , count =
2
3-14: 07:11:42:974:5e8
3-14: 07:11:42:974:5e8 Sending: SA = 0x001194C0 to 65.213.17.228:Type 2.500
3-14: 07:11:42:974:5e8 ISAKMP Header: (V1.0), len = 60
3-14: 07:11:42:974:5e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:11:42:974:5e8 R-COOKIE c836ceb6ff11058e
3-14: 07:11:42:974:5e8 exchange: Oakley Main Mode
3-14: 07:11:42:974:5e8 flags: 1 ( encrypted )
3-14: 07:11:42:974:5e8 next payload: ID
3-14: 07:11:42:974:5e8 message ID: 00000000
3-14: 07:11:42:974:5e8 Ports S:f401 D:f401
3-14: 07:11:46:974:5e8 retransmit: sa = 001194C0 centry 00000000 , count =
3
3-14: 07:11:46:974:5e8
3-14: 07:11:46:974:5e8 Sending: SA = 0x001194C0 to 65.213.17.228:Type 2.500
3-14: 07:11:46:974:5e8 ISAKMP Header: (V1.0), len = 60
3-14: 07:11:46:974:5e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:11:46:974:5e8 R-COOKIE c836ceb6ff11058e
3-14: 07:11:46:974:5e8 exchange: Oakley Main Mode
3-14: 07:11:46:974:5e8 flags: 1 ( encrypted )
3-14: 07:11:46:974:5e8 next payload: ID
3-14: 07:11:46:974:5e8 message ID: 00000000
3-14: 07:11:46:974:5e8 Ports S:f401 D:f401
3-14: 07:11:54:974:5e8 retransmit: sa = 001194C0 centry 00000000 , count =
4
3-14: 07:11:54:974:5e8
3-14: 07:11:54:974:5e8 Sending: SA = 0x001194C0 to 65.213.17.228:Type 2.500
3-14: 07:11:54:974:5e8 ISAKMP Header: (V1.0), len = 60
3-14: 07:11:54:974:5e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:11:54:974:5e8 R-COOKIE c836ceb6ff11058e
3-14: 07:11:54:974:5e8 exchange: Oakley Main Mode
3-14: 07:11:54:974:5e8 flags: 1 ( encrypted )
3-14: 07:11:54:974:5e8 next payload: ID
3-14: 07:11:54:974:5e8 message ID: 00000000
3-14: 07:11:54:974:5e8 Ports S:f401 D:f401
3-14: 07:12:10:974:5e8 retransmit: sa = 001194C0 centry 00000000 , count =
5
3-14: 07:12:10:974:5e8
3-14: 07:12:10:974:5e8 Sending: SA = 0x001194C0 to 65.213.17.228:Type 2.500
3-14: 07:12:10:974:5e8 ISAKMP Header: (V1.0), len = 60
3-14: 07:12:10:974:5e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:12:10:974:5e8 R-COOKIE c836ceb6ff11058e
3-14: 07:12:10:974:5e8 exchange: Oakley Main Mode
3-14: 07:12:10:974:5e8 flags: 1 ( encrypted )
3-14: 07:12:10:974:5e8 next payload: ID
3-14: 07:12:10:974:5e8 message ID: 00000000
3-14: 07:12:10:974:5e8 Ports S:f401 D:f401
3-14: 07:12:12:302:6e8
3-14: 07:12:12:302:6e8 Receive: (get) SA = 0x00119158 from
65.213.17.228.500
3-14: 07:12:12:302:6e8 ISAKMP Header: (V1.0), len = 76
3-14: 07:12:12:302:6e8 I-COOKIE 2357b60db8c3426e
3-14: 07:12:12:302:6e8 R-COOKIE b096b6fa7e773d64
3-14: 07:12:12:302:6e8 exchange: ISAKMP Informational Exchange
3-14: 07:12:12:302:6e8 flags: 1 ( encrypted )
3-14: 07:12:12:302:6e8 next payload: HASH
3-14: 07:12:12:302:6e8 message ID: 65f27cba
3-14: 07:12:12:302:6e8 processing HASH (Notify/Delete)
3-14: 07:12:12:302:6e8 processing payload DELETE
3-14: 07:12:12:302:6e8 SA Dead. sa:00119158 status:35ef
3-14: 07:12:12:302:6e8 isadb_set_status sa:00119158 centry:00000000 status
35ef
3-14: 07:12:42:974:5e8 retransmit exhausted: sa = 001194C0 centry 00000000,
count = 6
3-14: 07:12:42:974:5e8 SA Dead. sa:001194C0 status:35ed
3-14: 07:12:42:974:5e8 isadb_set_status sa:001194C0 centry:00000000 status
35ed
3-14: 07:12:42:974:5e8 constructing ISAKMP Header
3-14: 07:12:42:974:5e8 constructing HASH (null)
3-14: 07:12:42:974:5e8 constructing DELETE. MM 001194C0
3-14: 07:12:42:974:5e8 constructing HASH (Notify/Delete)
3-14: 07:12:42:974:5e8 Not setting retransmit to downlevel client. SA
001194C0 Centry 00000000
3-14: 07:12:42:974:5e8
3-14: 07:12:42:974:5e8 Sending: SA = 0x001194C0 to 65.213.17.228:Type 1.500
3-14: 07:12:42:974:5e8 ISAKMP Header: (V1.0), len = 76
3-14: 07:12:42:974:5e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:12:42:974:5e8 R-COOKIE c836ceb6ff11058e
3-14: 07:12:42:974:5e8 exchange: ISAKMP Informational Exchange
3-14: 07:12:42:974:5e8 flags: 1 ( encrypted )
3-14: 07:12:42:974:5e8 next payload: HASH
3-14: 07:12:42:974:5e8 message ID: 2df50f2f
3-14: 07:12:42:974:5e8 Ports S:f401 D:f401
3-14: 07:12:43:37:6e8
3-14: 07:12:43:37:6e8 Receive: (get) SA = 0x001194c0 from 65.213.17.228.500
3-14: 07:12:43:37:6e8 ISAKMP Header: (V1.0), len = 68
3-14: 07:12:43:37:6e8 I-COOKIE 9275915ddd7fde5e
3-14: 07:12:43:37:6e8 R-COOKIE c836ceb6ff11058e
3-14: 07:12:43:37:6e8 exchange: ISAKMP Informational Exchange
3-14: 07:12:43:37:6e8 flags: 1 ( encrypted )
3-14: 07:12:43:37:6e8 next payload: HASH
3-14: 07:12:43:37:6e8 message ID: 47a97e76
3-14: 07:12:43:37:6e8 processing HASH (Notify/Delete)
3-14: 07:12:43:37:6e8 processing payload DELETE
3-14: 07:12:43:37:6e8 Asked to delete phase2 SPI we don't own: 976313612
proto=3
3-14: 07:13:18:396:6e8 ClearFragList