ISAKMP errors from the log

Stefano_Branca · ‎01-12-2021

Hi,

I have a cisco RV130 VPN firewall with an IPSEC tunnel active and workig, but looking into the logs, it's full of these messages:

805 2021-01-12 12:37:28 PM debug pluto[4854]: |
806 2021-01-12 12:37:28 PM debug pluto[4854]: | payload malformed after IV
807 2021-01-12 12:37:28 PM warning pluto[4854]: packet from 2.44.139.93:80: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
808 2021-01-12 12:37:22 PM warning pluto[4854]: packet from 2.44.139.93:80: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
809 2021-01-12 12:37:22 PM warning pluto[4854]: packet from 2.44.139.93:80: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
810 2021-01-12 12:37:22 PM warning pluto[4854]: packet from 2.44.139.93:80: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
811 2021-01-12 12:37:22 PM warning pluto[4854]: packet from 2.44.139.93:80: sending notification PAYLOAD_MALFORMED to 2.44.139.93:80
812 2021-01-12 12:37:22 PM debug pluto[4854]: |
813 2021-01-12 12:37:22 PM debug pluto[4854]: | payload malformed after IV
814 2021-01-12 12:37:22 PM warning pluto[4854]: packet from 2.44.139.93:80: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
815 2021-01-12 12:37:16 PM warning pluto[4854]: packet from 2.44.139.93:80: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
816 2021-01-12 12:37:16 PM warning pluto[4854]: packet from 2.44.139.93:80: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
817 2021-01-12 12:37:16 PM warning pluto[4854]: packet from 2.44.139.93:80: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
818 2021-01-12 12:37:16 PM warning pluto[4854]: packet from 2.44.139.93:80: sending notification PAYLOAD_MALFORMED to 2.44.139.93:80
819 2021-01-12 12:37:16 PM debug pluto[4854]: |
820 2021-01-12 12:37:16 PM debug pluto[4854]: | payload malformed after IV
821 2021-01-12 12:37:16 PM warning pluto[4854]: packet from 2.44.139.93:80: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
822 2021-01-12 12:37:10 PM warning pluto[4854]: packet from 2.44.139.93:80: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
823 2021-01-12 12:37:10 PM warning pluto[4854]: packet from 2.44.139.93:80: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
824 2021-01-12 12:37:10 PM warning pluto[4854]: packet from 2.44.139.93:80: sending notification PAYLOAD_MALFORMED to 2.44.139.93:80
825 2021-01-12 12:37:10 PM debug pluto[4854]: |

Is this related to a specific issue ? There's no relations between the configured remote IP and the IP's I got from the log.
Attached, there's the VPN config

marce1000 · ‎01-12-2021

- Could be a resource related bug , albeit cosmetic or not -> Use the latest firmware on the RV.

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

JN-Digital · ‎03-03-2021

I am also having this appear on a previously working setup. WRV210 with 4 active Site-to-site

I also want to point out that NONE of these IP's are the other sites. Could this be a hack attempt?

9701 [Wed 13:23:01] packet from 45.5.37.209:25840: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9702 [Wed 13:23:01] packet from 45.5.37.209:25840: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9703 [Wed 13:23:01] packet from 45.5.37.228:46029: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9704 [Wed 13:23:01] packet from 45.5.37.209:25840: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9705 [Wed 13:23:01] packet from 45.5.37.135:9864: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9706 [Wed 13:23:02] packet from 45.5.37.229:64955: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9707 [Wed 13:23:02] packet from 45.5.37.229:64955: sending notification PAYLOAD_MALFORMED to 45.5.37.229:64955
9708 [Wed 13:23:02] packet from 131.161.106.6:43581: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9709 [Wed 13:23:02] packet from 45.5.37.164:42070: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9710 [Wed 13:23:02] packet from 45.5.37.164:42070: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9711 [Wed 13:23:02] packet from 45.5.37.181:55624: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9712 [Wed 13:23:02] packet from 45.5.37.164:42070: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9713 [Wed 13:23:02] packet from 131.161.106.84:55767: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9714 [Wed 13:23:02] packet from 45.5.37.181:55624: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9715 [Wed 13:23:02] packet from 131.161.106.84:55767: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9716 [Wed 13:23:02] packet from 131.161.106.84:55767: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9717 [Wed 13:23:02] packet from 45.5.37.183:4769: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9718 [Wed 13:23:02] packet from 45.5.37.226:13139: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9719 [Wed 13:23:03] packet from 45.5.37.184:21065: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9720 [Wed 13:23:03] packet from 45.5.37.184:21065: sending notification PAYLOAD_MALFORMED to 45.5.37.184:21065
9721 [Wed 13:23:03] packet from 131.161.106.6:43581: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9722 [Wed 13:23:03] packet from 45.5.37.255:22225: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9723 [Wed 13:23:03] packet from 45.5.37.255:22225: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9724 [Wed 13:23:03] packet from 45.5.37.255:22225: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9725 [Wed 13:23:03] packet from 131.161.106.35:22672: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9726 [Wed 13:23:03] packet from 45.5.37.136:35822: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9727 [Wed 13:23:04] packet from 45.5.37.136:35822: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9728 [Wed 13:23:04] packet from 45.5.37.136:35822: sending notification PAYLOAD_MALFORMED to 45.5.37.136:35822
9729 [Wed 13:23:04] packet from 45.5.37.138:24411: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9730 [Wed 13:23:04] packet from 45.5.37.181:55624: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9731 [Wed 13:23:04] packet from 131.161.106.35:22672: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9732 [Wed 13:23:04] packet from 131.161.106.122:45895: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9733 [Wed 13:23:04] packet from 45.5.37.139:28471: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9734 [Wed 13:23:04] packet from 45.5.37.210:54337: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9735 [Wed 13:23:04] packet from 45.5.37.210:54337: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9736 [Wed 13:23:04] packet from 45.5.37.210:54337: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9737 [Wed 13:23:04] packet from 45.5.37.227:41088: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9738 [Wed 13:23:05] packet from 131.161.106.35:22672: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9739 [Wed 13:23:05] packet from 131.161.106.35:22672: sending notification PAYLOAD_MALFORMED to 131.161.106.35:22672
9740 [Wed 13:23:05] packet from 45.5.37.227:41088: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9741 [Wed 13:23:05] packet from 45.5.37.229:64955: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9742 [Wed 13:23:05] packet from 45.5.37.136:35822: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9743 [Wed 13:23:05] packet from 131.161.106.113:45944: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9744 [Wed 13:23:05] packet from 131.161.106.113:45944: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9745 [Wed 13:23:05] packet from 131.161.106.113:45944: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9746 [Wed 13:23:05] packet from 45.5.37.165:36289: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9747 [Wed 13:23:05] packet from 45.5.37.165:36289: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9748 [Wed 13:23:05] packet from 45.5.37.230:24350: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9749 [Wed 13:23:05] packet from 45.5.37.165:36289: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9750 [Wed 13:23:06] packet from 45.5.37.182:50067: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
9751 [Wed 13:23:06] packet from 45.5.37.182:50067: sending notification PAYLOAD_MALFORMED to 45.5.37.182:50067

piotrpepe · ‎03-04-2021

the same problem

need help on cisco RV130

1 2021-03-04 10:59:03 AM warning pluto[1960]: packet from 111.177.21.199:14300: sending notification PAYLOAD_MALFORMED to 111.177.21.199:14300
2 2021-03-04 10:59:03 AM debug pluto[1960]: |
3 2021-03-04 10:59:03 AM debug pluto[1960]: | payload malformed after IV
4 2021-03-04 10:59:03 AM warning pluto[1960]: packet from 111.177.21.199:14300: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
5 2021-03-04 10:59:02 AM warning pluto[1960]: packet from 111.177.21.199:14300: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
6 2021-03-04 10:59:02 AM warning pluto[1960]: packet from 42.157.224.166:14300: sending notification PAYLOAD_MALFORMED to 42.157.224.166:14300
7 2021-03-04 10:59:02 AM debug pluto[1960]: |
8 2021-03-04 10:59:02 AM debug pluto[1960]: | payload malformed after IV
9 2021-03-04 10:59:02 AM warning pluto[1960]: packet from 42.157.224.166:14300: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
10 2021-03-04 10:59:01 AM warning pluto[1960]: packet from 42.157.224.166:14300: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
11 2021-03-04 10:59:01 AM warning pluto[1960]: packet from 111.177.21.199:14300: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
12 2021-03-04 10:59:01 AM warning pluto[1960]: packet from 42.157.224.166:14300: sending notification PAYLOAD_MALFORMED to 42.157.224.166:14300
13 2021-03-04 10:59:01 AM debug pluto[1960]: |
14 2021-03-04 10:59:01 AM debug pluto[1960]: | payload malformed after IV
15 2021-03-04 10:59:01 AM warning pluto[1960]: packet from 42.157.224.166:14300: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
16 2021-03-04 10:59:00 AM warning pluto[1960]: packet from 111.177.21.199:14300: sending notification PAYLOAD_MALFORMED to 111.177.21.199:14300
17 2021-03-04 10:59:00 AM debug pluto[1960]: |
18 2021-03-04 10:59:00 AM debug pluto[1960]: | payload malformed after IV
19 2021-03-04 10:59:00 AM warning pluto[1960]: packet from 111.177.21.199:14300: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)
20 2021-03-04 10:58:59 AM warning pluto[1960]: packet from 111.177.21.199:14300: not enough room in input packet for ISAKMP Message (remain=17, sd->size=28)