FW: Stale IKE SA on FW-1Aug 24 2006 05:51PM Meidinger Chris (chris meidinger badenIT de) (1 replies)
Hi List,
has anyone ever had an IKE SA that just wouldn't die on a Checkpoint?
The Firewall in question is a (fairly new) R61 clustered on Nokia hardware.
Normally the #vpn tu command should allow SA's to be deleted either singly or collectively.
I have a stale IKE SA between this gateway and another (externally managed) gateway that refuses to die. The SA is more than twice as old as the reneg time, and is just sitting there blocking negotiation of a new one. If I delete it with #vpn tu absolutely nothing changes and the SA is still showing in the list.
Have any of you ever seen this before? Does anyone have an idea what I can do?
I have already tried:
- making changes in encryption in the community settings and publishing the policy
- deleting the object for the remote gateway and the related rules, publishing and then recreating them
- every possible #vpn tu command, including deleting ALL IKE+IPSec SA's
- banging my head on the wall
I was even considering booting the firewall, but the SA should be synched on both so I assume that will be pretty useless as the other node will have the SA as well.
Thanks in advance for any suggestions, I wasn't able to find *anything* on google about this type of problem.
Chris Meidinger
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>FW: Stale IKE SA on FW-1</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Hi List,<BR>
<BR>
has anyone ever had an IKE SA that just wouldn't die on a Checkpoint?<BR>
<BR>
The Firewall in question is a (fairly new) R61 clustered on Nokia hardware.<BR>
<BR>
Normally the #vpn tu command should allow SA's to be deleted either singly or collectively.<BR>
<BR>
I have a stale IKE SA between this gateway and another (externally managed) gateway that refuses to die. The SA is more than twice as old as the reneg time, and is just sitting there blocking negotiation of a new one. If I delete it with #vpn tu absolutely nothing changes and the SA is still showing in the list.<BR>
<BR>
Have any of you ever seen this before? Does anyone have an idea what I can do?<BR>
<BR>
I have already tried:<BR>
<BR>
- making changes in encryption in the community settings and publishing the policy<BR>
- deleting the object for the remote gateway and the related rules, publishing and then recreating them<BR>
- every possible #vpn tu command, including deleting ALL IKE+IPSec SA's<BR>
- banging my head on the wall<BR>
<BR>
I was even considering booting the firewall, but the SA should be synched on both so I assume that will be pretty useless as the other node will have the SA as well.<BR>
<BR>
Thanks in advance for any suggestions, I wasn't able to find *anything* on google about this type of problem.<BR>
<BR>
Chris Meidinger<BR>
</FONT>
</P>
has anyone ever had an IKE SA that just wouldn't die on a Checkpoint?
The Firewall in question is a (fairly new) R61 clustered on Nokia hardware.
Normally the #vpn tu command should allow SA's to be deleted either singly or collectively.
I have a stale IKE SA between this gateway and another (externally managed) gateway that refuses to die. The SA is more than twice as old as the reneg time, and is just sitting there blocking negotiation of a new one. If I delete it with #vpn tu absolutely nothing changes and the SA is still showing in the list.
Have any of you ever seen this before? Does anyone have an idea what I can do?
I have already tried:
- making changes in encryption in the community settings and publishing the policy
- deleting the object for the remote gateway and the related rules, publishing and then recreating them
- every possible #vpn tu command, including deleting ALL IKE+IPSec SA's
- banging my head on the wall
I was even considering booting the firewall, but the SA should be synched on both so I assume that will be pretty useless as the other node will have the SA as well.
Thanks in advance for any suggestions, I wasn't able to find *anything* on google about this type of problem.
Chris Meidinger
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>FW: Stale IKE SA on FW-1</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Hi List,<BR>
<BR>
has anyone ever had an IKE SA that just wouldn't die on a Checkpoint?<BR>
<BR>
The Firewall in question is a (fairly new) R61 clustered on Nokia hardware.<BR>
<BR>
Normally the #vpn tu command should allow SA's to be deleted either singly or collectively.<BR>
<BR>
I have a stale IKE SA between this gateway and another (externally managed) gateway that refuses to die. The SA is more than twice as old as the reneg time, and is just sitting there blocking negotiation of a new one. If I delete it with #vpn tu absolutely nothing changes and the SA is still showing in the list.<BR>
<BR>
Have any of you ever seen this before? Does anyone have an idea what I can do?<BR>
<BR>
I have already tried:<BR>
<BR>
- making changes in encryption in the community settings and publishing the policy<BR>
- deleting the object for the remote gateway and the related rules, publishing and then recreating them<BR>
- every possible #vpn tu command, including deleting ALL IKE+IPSec SA's<BR>
- banging my head on the wall<BR>
<BR>
I was even considering booting the firewall, but the SA should be synched on both so I assume that will be pretty useless as the other node will have the SA as well.<BR>
<BR>
Thanks in advance for any suggestions, I wasn't able to find *anything* on google about this type of problem.<BR>
<BR>
Chris Meidinger<BR>
</FONT>
</P>
</BODY>
</HTML>
[ reply ]