After an upgrade to 6.7 on amd64 this weekend, iked keeps reconnecting every 8 minutes, but only for one tunnel, to a Watchguard firewall. The tunnel has been functioning properly for 5 years. Other tunnels to OpenBSD devices do not reconnect every 8 minutes. I confirmed there a no dropped packets by pf. Here is part of the log (anonymized) :
Jun 8 12:10:22 hv-fw-inf-02 iked[50153]: ikev2_init_ike_sa: initiating "TUNNELNAME" Jun 8 12:10:22 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: send IKE_SA_INIT req 0 peer 192.0.2.199:500 local 192.0.2.2:500, 334 bytes Jun 8 12:10:22 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: recv IKE_SA_INIT res 0 peer 192.0.2.199:500 local 192.0.2.2:500, 296 bytes, policy 'TUNNELNAME' Jun 8 12:10:22 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: send IKE_AUTH req 1 peer 192.0.2.199:500 local 192.0.2.2:500, 252 bytes Jun 8 12:10:22 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: recv IKE_AUTH res 1 peer 192.0.2.199:500 local 192.0.2.2:500, 204 bytes, policy 'TUNNELNAME' Jun 8 12:10:22 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: ikev2_childsa_enable: loaded SPIs: 0x4cd06a6a, 0xa749d359 Jun 8 12:10:22 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: ikev2_childsa_enable: loaded flows: ESP-10.0.1.0/24=10.0.100.0/24(0), ESP-10.0.1.0/24=10.0.150.0/24(0), ESP-192.0.2.2/32=192.0.2.199/32(0) Jun 8 12:10:22 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: established peer 192.0.2.199:500[IPV4/192.0.2.199] local 192.0.2.2:500[IPV4/192.0.2.2] policy 'TUNNELNAME' as initiator Jun 8 12:15:24 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: retransmit 1 INFORMATIONAL req 2 peer 192.0.2.199:500 local 192.0.2.2:500 Jun 8 12:15:28 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: retransmit 2 INFORMATIONAL req 2 peer 192.0.2.199:500 local 192.0.2.2:500 Jun 8 12:15:36 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: retransmit 3 INFORMATIONAL req 2 peer 192.0.2.199:500 local 192.0.2.2:500 Jun 8 12:15:52 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: retransmit 4 INFORMATIONAL req 2 peer 192.0.2.199:500 local 192.0.2.2:500 Jun 8 12:16:24 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: retransmit 5 INFORMATIONAL req 2 peer 192.0.2.199:500 local 192.0.2.2:500 Jun 8 12:17:28 hv-fw-inf-02 iked[50153]: spi=0x73cd01a5c65aa870: sa_free: retransmit limit reached Jun 8 12:18:22 hv-fw-inf-02 iked[50153]: ikev2_init_ike_sa: initiating "TUNNELNAME" Jun 8 12:18:22 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: send IKE_SA_INIT req 0 peer 192.0.2.199:500 local 192.0.2.2:500, 334 bytes Jun 8 12:18:22 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: recv IKE_SA_INIT res 0 peer 192.0.2.199:500 local 192.0.2.2:500, 296 bytes, policy 'TUNNELNAME' Jun 8 12:18:22 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: send IKE_AUTH req 1 peer 192.0.2.199:500 local 192.0.2.2:500, 252 bytes Jun 8 12:18:22 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: recv IKE_AUTH res 1 peer 192.0.2.199:500 local 192.0.2.2:500, 204 bytes, policy 'TUNNELNAME' Jun 8 12:18:22 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: ikev2_childsa_enable: loaded SPIs: 0x4cd06a6b, 0xf20c662c Jun 8 12:18:22 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: ikev2_childsa_enable: loaded flows: ESP-10.0.1.0/24=10.0.100.0/24(0), ESP-10.0.1.0/24=10.0.150.0/24(0), ESP-192.0.2.2/32=192.0.2.199/32(0) Jun 8 12:18:22 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: established peer 192.0.2.199:500[IPV4/192.0.2.199] local 192.0.2.2:500[IPV4/192.0.2.2] policy 'TUNNELNAME' as initiator Jun 8 12:23:24 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: retransmit 1 INFORMATIONAL req 2 peer 192.0.2.199:500 local 192.0.2.2:500 Jun 8 12:23:28 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: retransmit 2 INFORMATIONAL req 2 peer 192.0.2.199:500 local 192.0.2.2:500 Jun 8 12:23:37 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: retransmit 3 INFORMATIONAL req 2 peer 192.0.2.199:500 local 192.0.2.2:500 Jun 8 12:23:53 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: retransmit 4 INFORMATIONAL req 2 peer 192.0.2.199:500 local 192.0.2.2:500 Jun 8 12:24:25 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: retransmit 5 INFORMATIONAL req 2 peer 192.0.2.199:500 local 192.0.2.2:500 Jun 8 12:25:29 hv-fw-inf-02 iked[50153]: spi=0xa84faba012c73dce: sa_free: retransmit limit reached And here is the configuration of the tunnel : ikev2 "TUNNELNAME" active esp \ from 10.0.1.0/24 to 10.0.100.0/24 \ from 10.0.1.0/24 to 10.0.150.0/24 \ from 192.0.2.2/32 to 192.0.2.199/32 \ local 192.0.2.2 peer 192.0.2.199 \ ikesa auth hmac-sha1 enc aes-128 group grp5 \ childsa auth hmac-sha1 enc aes-128 group grp5 \ srcid 192.0.2.2 dstid 192.0.2.199 \ ikelifetime 28800 \ psk THISISTHEPSK Other tunnels have basically the same configuration, only omitting ikesa, childsa and ikelifetime parameters. I don't have control over the Watchguard firewall. Any idea what could cause this? OpenBSD 6.7 (GENERIC.MP) #2: Thu Jun 4 09:55:08 MDT 2020 r...@syspatch-67-amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP Sébastien Leclerc