Problemas VPN Router WRV210

roringenieria · ‎03-20-2012

Buenos Dias Compañeros.

Tengo el siguiente problema:

Tengo tres sedes fisicas las cuales estan conectada de la siguiente manera:

En la sede principal tengo un RV-042, la cual esta conectada con otra sede A, la cual tambien tiene un RV-042 y estan conectadas mediante una VPN Gateway to Gateway, esta conexion me ha funcionado perfectamente y nunca se me ha caido la conexion. La conexion VPN que me presenta problemas es la que conecto la sede principal con el RV-042 a otra sede B, la cual tiene un router WRV210, esta conexion se me cae entre una y dos veces a la semana y debo de iniciar la conexion manualmente, pienso que el problema esta en el WRV210, ya que la otra conexion con el RV-042 de la sede A, nunca me ha fallado.

El log que me saca el WRV210 cuando se cae la conexion es el siguiente:

<TD style="WIDTH: 958pt; HEIGHT: 15pt" height=20 width=1277 mcestyle="width: 958pt; height: 15pt;">001 Starting Pluto (Openswan Version 2.4.5dr3 X.509-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID OEr\134[u@aflB_)</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">002 Setting NAT-Traversal port-4500 floating to on</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">003 port floating activation criteria nat_t=1/port_fload=1</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">004 including NAT-Traversal patch (Version 0.6c)</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">005 ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">006 starting up 1 cryptographic helpers</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">007 started helper pid=375 (fd:4)</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">008 Using KLIPS IPsec interface code on 2.4.26-uc0</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">009 Changing to directory '/etc/ipsec.d/cacerts'</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">010 Changing to directory '/etc/ipsec.d/aacerts'</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">011 Changing to directory '/etc/ipsec.d/ocspcerts'</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">012 Changing to directory '/etc/ipsec.d/crls'</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">013 Warning: empty directory</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">014 added connection description "TunnelA"</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">015 listening for IKE messages</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">016 adding interface ipsec0/ppp0 XXX.XXX.XXX.XXX:500</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">017 adding interface ipsec0/ppp0 XXX.XXX.XXX.XXX:4500</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">018 loading secrets from "/etc/ipsec.secrets"</TD></TR>

<TD style="HEIGHT: 15pt" height=20 mcestyle="height: 15pt;">019 "TunnelA": cannot initiate connection without knowing peer IP address (kind=CK_TEMPLATE)

He estado consultado en varios foros sobre este problema en el WRV210:

019 "TunnelA": cannot initiate connection without knowing peer IP address (kind=CK_TEMPLATE),

pero aun no he encontrado respuesta alguna sobre este problema.

A continuacion adjunto la configuración de la VPN, por seguridad borre la direccion ip puerta de enlace segura remota de la sede principal y la clave compartida.

roringenieria · ‎03-20-2012

Nuevamente adjunto el log ya que en el mensaje inicial no se ve de forma adecuada.:

001   [Tue 06:16:45] Starting Pluto (Openswan Version 2.4.5dr3 X.509-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID OEr\134[u@aflB_)
002   [Tue 06:16:45] Setting NAT-Traversal port-4500 floating to on
003   [Tue 06:16:45]     port floating activation criteria nat_t=1/port_fload=1
004   [Tue 06:16:45]    including NAT-Traversal patch (Version 0.6c)
005   [Tue 06:16:45] ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
006   [Tue 06:16:45] starting up 1 cryptographic helpers
007   [Tue 06:16:45] started helper pid=375 (fd:4)
008   [Tue 06:16:45] Using KLIPS IPsec interface code on 2.4.26-uc0
009   [Tue 06:16:45] Changing to directory '/etc/ipsec.d/cacerts'
010   [Tue 06:16:45] Changing to directory '/etc/ipsec.d/aacerts'
011   [Tue 06:16:45] Changing to directory '/etc/ipsec.d/ocspcerts'
012   [Tue 06:16:45] Changing to directory '/etc/ipsec.d/crls'
013   [Tue 06:16:45]    Warning: empty directory
014   [Tue 06:16:53] added connection description "TunnelA"
015   [Tue 06:16:54] listening for IKE messages
016   [Tue 06:16:54] adding interface ipsec0/ppp0 190.249.161.188:500
017   [Tue 06:16:54] adding interface ipsec0/ppp0 190.249.161.188:4500
018   [Tue 06:16:54] loading secrets from "/etc/ipsec.secrets"
019   [Tue 06:16:56] "TunnelA": cannot initiate connection without knowing peer IP address (kind=CK_TEMPLATE)

jasbryan · ‎03-21-2012

Daniel,

I take it you're trying to setup site to site tunnel between two location? If this is correct then you need to make sure both tunnel configuration are identical. Right now something is missing on one side or the other.

Jasbryan

roringenieria · ‎03-21-2012

Hola Jasbryan.

La conexion VPN entre la sede principal y la sede B, ya esta configurada y tienen exactamente los mimso parametros ambos routers tanto el rv-042 como el wrv210, el problema es que constatemente se cae la conexion entre ambos router 1 o 2 veces al dia. Revisando el log del wrv210 sale la siguiente informacion que no se a que se refiere:

001 [Tue 06:16:45] Starting Pluto (Openswan Version 2.4.5dr3 X.509-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID OEr\134[u@aflB_)

002 [Tue 06:16:45] Setting NAT-Traversal port-4500 floating to on

003 [Tue 06:16:45] port floating activation criteria nat_t=1/port_fload=1

004 [Tue 06:16:45] including NAT-Traversal patch (Version 0.6c)

005 [Tue 06:16:45] ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)

006 [Tue 06:16:45] starting up 1 cryptographic helpers

007 [Tue 06:16:45] started helper pid=375 (fd:4)

008 [Tue 06:16:45] Using KLIPS IPsec interface code on 2.4.26-uc0

009 [Tue 06:16:45] Changing to directory '/etc/ipsec.d/cacerts'

010 [Tue 06:16:45] Changing to directory '/etc/ipsec.d/aacerts'

011 [Tue 06:16:45] Changing to directory '/etc/ipsec.d/ocspcerts'

012 [Tue 06:16:45] Changing to directory '/etc/ipsec.d/crls'

013 [Tue 06:16:45] Warning: empty directory

014 [Tue 06:16:53] added connection description "TunnelA"

015 [Tue 06:16:54] listening for IKE messages

016 [Tue 06:16:54] adding interface ipsec0/ppp0 190.249.161.188:500

017 [Tue 06:16:54] adding interface ipsec0/ppp0 190.249.161.188:4500

018 [Tue 06:16:54] loading secrets from "/etc/ipsec.secrets"

019 [Tue 06:16:56] "TunnelA": cannot initiate connection without knowing peer IP address (kind=CK_TEMPLATE)