881 VPN fails after 24hrs/IKE key lifetime

Hi all,
This is my first post on the support forms and I only just got my CCNA, so please bear with me and don't shoot me if I pose a slightly newbish perspective on things. Thanks in advance.
We've got a central office (actually quite small) where several IPSec connections connect to. Two of these connections are Cisco 881 routers. One of them works fine, the other craps out after 24 hours (coincidentally also the IKE key lifetime). When I mean "craps out", it means the VPN worked fine from the get go, until 24 hours later. Only a reload will bring back the VPN tunnel. I've verified my PFS and DPD configurations are solid, because these kind of symptoms would most likely occur when these configurations aren't in order.
The two 881 configurations are quite similar. The only differences between the two are some details in the PPPoE configurations and (quite obviously) the IP address space for the two sites. Both operate on the premise of a point to point connection (no multipoint stuff going on here).
I have examined all I can. It took me two weeks to make sure I exhausted all my options before I post my issue here.
Here is a brief list of things I've done.
- Checked configuration of central router (which is a Mikrotik RB800 btw)
- Verified that the central router is not the cause of the VPN not coming back. Rebooted it as a last resort; VPN stays down. Rebooted 881, VPN comes back.
- I've downgraded the 881 firmware image from version 152.4.M2 to 151.4.M4 (the succesful 881 was running the 151.4.M4 image, and I found some Ipsec issues in the caveat for version 152.4.M2), but to no avail.
- I've tried to clear several crypto components hoping to restore key exchanging, also to no avail. Only a reload will suffice.
I've included the 881's config:
Building configuration...Current configuration : 7795 bytes
! Last configuration change at 15:37:50 Paris Tue May 28 2013 by admin
version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname <<removed>>
boot-start-marker
boot system flash c880data-universalk9-mz.151-4.M4.bin
boot-end-marker
logging buffered 102400
enable secret 4 <<removed>>
no aaa new-model
memory-size iomem 10
clock timezone Paris 1 0
clock summer-time Paris date Mar 30 2003 2:00 Oct 26 2003 3:00
crypto pki token default removal timeout 0
!no ip source-route
ip dhcp excluded-address 192.168.4.1 192.168.4.9
ip dhcp excluded-address 192.168.4.199 192.168.4.254
ip dhcp pool Main
network 192.168.4.0 255.255.255.0
dns-server 192.168.4.250 8.8.4.4
default-router 192.168.4.250
lease infinite
ip cef
ip domain lookup source-interface Dialer1
ip domain name <<removed>>
ip name-server 8.8.4.4
ip name-server 192.168.58.199
no ipv6 cef
password encryption aes!
object-group network SUBNET_DUITSLAND
description Hele subnet IC Duitsland
192.168.4.0 255.255.255.0
object-group network SUBNET_IC_ARNHEM
description Hele subnet IC Arnhem
192.168.58.0 255.255.255.0
object-group network WAN_IC_ARNHEM
description Het WAN IP adres van IC Arnhem
host <<removed>>
vtp mode transparent
username <<removed>> privilege 15 view root secret 4 <<removed>>
class-map type inspect match-all sdm-cls-VPNOutsideToInside-1
match access-group 102
class-map type inspect match-all sdm-cls-VPNOutsideToInside-2
match access-group 105
class-map type inspect match-all ccp-cls--1
match access-group name Outgoing
class-map type inspect match-all ccp-cls--2
match access-group name Incoming
policy-map type inspect ccp-policy-ccp-cls--1
class type inspect ccp-cls--1
pass
class class-default
drop
policy-map type inspect ccp-policy-ccp-cls--2
class type inspect ccp-cls--2
pass
class type inspect sdm-cls-VPNOutsideToInside-1
inspect
class type inspect sdm-cls-VPNOutsideToInside-2
inspect
class class-default
drop
zone security Inside
zone security Outside
zone-pair security sdm-zp-Inside-Outside source Inside destination Outside
service-policy type inspect ccp-policy-ccp-cls--1
zone-pair security sdm-zp-Outside-Inside source Outside destination Inside
service-policy type inspect ccp-policy-ccp-cls--2
crypto logging ezvpn
crypto isakmp policy 1
encr aes 256
authentication pre-share
group 5
crypto isakmp key <<removed>> address <<removed>>
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 10 periodic
crypto ipsec security-association lifetime seconds 28800
crypto ipsec transform-set ESP-AES256-SHA esp-aes esp-sha-hmac
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to CO
set peer <<removed>>
set transform-set ESP-AES256-SHA
set pfs group5
match address 104
interface FastEthernet0
no ip address
interface FastEthernet1
no ip address
interface FastEthernet2
no ip address
interface FastEthernet3
no ip address
interface FastEthernet4
description DeutscheTelekom$ETH-WAN$
no ip address
duplex auto
speed auto
pppoe-client dial-pool-number 1
interface Vlan1
description $FW_INSIDE$
ip address 192.168.4.250 255.255.255.0
ip mask-reply
ip nat inside
ip virtual-reassembly in
zone-member security Inside
ip tcp adjust-mss 1412
interface Dialer1
description $FW_OUTSIDE$
mtu 1492
ip address negotiated
ip nat outside
ip virtual-reassembly in
zone-member security Outside
encapsulation ppp
no ip route-cache
dialer pool 1
dialer-group 1
ppp authentication pap callin
ppp chap hostname <<removed>>
ppp chap password 7 <<removed>>
ppp pap sent-username <<removed>> password 7 <<removed>>
ppp ipcp dns request
ppp ipcp address accept
crypto map SDM_CMAP_1
ip forward-protocol nd
no ip http server
ip http access-class 2
ip http authentication local
ip http secure-server
ip nat inside source route-map SDM_RMAP_1 interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1 permanent
ip access-list extended Incoming
remark CCP_ACL Category=128
permit ip any object-group SUBNET_DUITSLAND
ip access-list extended Outgoing
remark CCP_ACL Category=128
permit ip object-group SUBNET_DUITSLAND any
ip access-list extended SDM_HTTPS
remark CCP_ACL Category=1
permit tcp any any eq 443
ip access-list extended SDM_SHELL
remark CCP_ACL Category=1
permit tcp any any eq cmd
ip access-list extended SDM_SSH
remark CCP_ACL Category=1
permit tcp any any eq 22
no logging trap
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.4.0 0.0.0.255
access-list 2 permit <<removed>>
access-list 2 remark Auto generated by SDM Management Access feature
access-list 2 remark CCP_ACL Category=1
access-list 2 permit 192.168.4.0 0.0.0.255
access-list 2 permit 192.168.58.0 0.0.0.255
access-list 101 remark Auto generated by SDM Management Access feature
access-list 101 remark CCP_ACL Category=1
access-list 101 permit ip 192.168.4.0 0.0.0.255 any
access-list 101 permit ip host <<removed>> any
access-list 101 permit ip 192.168.58.0 0.0.0.255 any
access-list 102 remark CCP_ACL Category=0
access-list 102 permit ip 192.168.58.0 0.0.0.255 192.168.4.0 0.0.0.255
access-list 103 remark CCP_ACL Category=2
access-list 103 remark IPSec Rule
access-list 103 deny ip 192.168.4.0 0.0.0.255 192.168.58.0 0.0.0.255
access-list 103 permit ip 192.168.4.0 0.0.0.255 any
access-list 104 remark CCP_ACL Category=4
access-list 104 remark IPSec Rule
access-list 104 permit ip 192.168.4.0 0.0.0.255 192.168.58.0 0.0.0.255
access-list 105 remark CCP_ACL Category=0
access-list 105 permit ip 192.168.58.0 0.0.0.255 192.168.4.0 0.0.0.255
dialer-list 1 protocol ip permit
route-map SDM_RMAP_1 permit 1
match ip address 103
line con 0
line aux 0
line vty 0 4
access-class 101 in
privilege level 15
password 7 <<removed>>
login local
transport input ssh
ntp update-calendar
ntp server de.pool.ntp.org prefer
end
Also, I have some ISAKMP debug output (when the VPN fails, I can still reach the router via the internet):
.May 29 08:31:22.848: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:31:28.848: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:31:30.016: ISAKMP: set new node 0 to QM_IDLE
.May 29 08:31:30.016: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local <<remote office WAN IP>>, remote <<central office WAN IP>>)
.May 29 08:31:30.016: ISAKMP: Error while processing SA request: Failed to initialize SA
.May 29 08:31:30.016: ISAKMP: Error while processing KMI message 0, error 2.
.May 29 08:31:30.016: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
.May 29 08:31:30.016: ISAKMP (0): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1
.May 29 08:31:30.016: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
.May 29 08:31:30.016: ISAKMP:(0): sending packet to <<central office WAN IP>> my_port 500 peer_port 500 (I) MM_NO_STATE
.May 29 08:31:30.016: ISAKMP:(0):Sending an IKE IPv4 Packet.
.May 29 08:31:34.848: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:31:40.016: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
.May 29 08:31:40.016: ISAKMP (0): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1
.May 29 08:31:40.016: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
.May 29 08:31:40.016: ISAKMP:(0): sending packet to <<central office WAN IP>> my_port 500 peer_port 500 (I) MM_NO_STATE
.May 29 08:31:40.016: ISAKMP:(0):Sending an IKE IPv4 Packet.
.May 29 08:31:40.844: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:31:46.380: ISAKMP:(0):purging node 297623767
.May 29 08:31:46.380: ISAKMP:(0):purging node -1266458641
.May 29 08:31:46.452: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:31:49.848: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=<<remote office WAN IP>>, prot=50, spi=0xCF8BD5F3(3482047987), srcaddr=<<central office WAN IP>>, input interface=Dialer1
.May 29 08:31:50.016: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
.May 29 08:31:50.016: ISAKMP (0): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1
.May 29 08:31:50.016: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
.May 29 08:31:50.016: ISAKMP:(0): sending packet to <<central office WAN IP>> my_port 500 peer_port 500 (I) MM_NO_STATE
.May 29 08:31:50.016: ISAKMP:(0):Sending an IKE IPv4 Packet.
.May 29 08:31:52.845: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:31:56.381: ISAKMP:(0):purging SA., sa=874CF15C, delme=874CF15C
.May 29 08:31:58.849: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:32:00.017: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
.May 29 08:32:00.017: ISAKMP:(0):peer does not do paranoid keepalives..May 29 08:32:00.017: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer <<central office WAN IP>>)
.May 29 08:32:00.017: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer <<central office WAN IP>>)
.May 29 08:32:00.017: ISAKMP: Unlocking peer struct 0x874792E0 for isadb_mark_sa_deleted(), count 0
.May 29 08:32:00.017: ISAKMP: Deleting peer node by peer_reap for <<central office WAN IP>>: 874792E0
.May 29 08:32:00.017: ISAKMP:(0):deleting node -118750948 error FALSE reason "IKE deleted"
.May 29 08:32:00.017: ISAKMP:(0):deleting node -1193365643 error FALSE reason "IKE deleted"
.May 29 08:32:00.017: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
.May 29 08:32:00.017: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_DEST_SA.May 29 08:32:02.037: ISAKMP:(0): SA request profile is (NULL)
.May 29 08:32:02.037: ISAKMP: Created a peer struct for <<central office WAN IP>>, peer port 500
.May 29 08:32:02.037: ISAKMP: New peer created peer = 0x875BF6B8 peer_handle = 0x8000000A
.May 29 08:32:02.037: ISAKMP: Locking peer struct 0x875BF6B8, refcount 1 for isakmp_initiator
.May 29 08:32:02.037: ISAKMP: local port 500, remote port 500
.May 29 08:32:02.037: ISAKMP: set new node 0 to QM_IDLE
.May 29 08:32:02.037: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 85C6B420
.May 29 08:32:02.037: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
.May 29 08:32:02.037: ISAKMP:(0):found peer pre-shared key matching <<central office WAN IP>>
.May 29 08:32:02.037: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
.May 29 08:32:02.041: ISAKMP:(0): constructed NAT-T vendor-07 ID
.May 29 08:32:02.041: ISAKMP:(0): constructed NAT-T vendor-03 ID
.May 29 08:32:02.041: ISAKMP:(0): constructed NAT-T vendor-02 ID
.May 29 08:32:02.041: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
.May 29 08:32:02.041: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1.May 29 08:32:02.041: ISAKMP:(0): beginning Main Mode exchange
.May 29 08:32:02.041: ISAKMP:(0): sending packet to <<central office WAN IP>> my_port 500 peer_port 500 (I) MM_NO_STATE
.May 29 08:32:02.041: ISAKMP:(0):Sending an IKE IPv4 Packet.
.May 29 08:32:04.849: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:32:10.845: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:32:12.041: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
.May 29 08:32:12.041: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
.May 29 08:32:12.041: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
.May 29 08:32:12.041: ISAKMP:(0): sending packet to <<central office WAN IP>> my_port 500 peer_port 500 (I) MM_NO_STATE
.May 29 08:32:12.041: ISAKMP:(0):Sending an IKE IPv4 Packet.
.May 29 08:32:16.845: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:32:22.041: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
.May 29 08:32:22.041: ISAKMP (0): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1
.May 29 08:32:22.041: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
.May 29 08:32:22.041: ISAKMP:(0): sending packet to <<central office WAN IP>> my_port 500 peer_port 500 (I) MM_NO_STATE
.May 29 08:32:22.041: ISAKMP:(0):Sending an IKE IPv4 Packet.
.May 29 08:32:22.449: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:32:28.846: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:32:32.038: ISAKMP: set new node 0 to QM_IDLE
.May 29 08:32:32.038: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local <<remote office WAN IP>>, remote <<central office WAN IP>>)
.May 29 08:32:32.038: ISAKMP: Error while processing SA request: Failed to initialize SA
.May 29 08:32:32.038: ISAKMP: Error while processing KMI message 0, error 2.
.May 29 08:32:32.042: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
.May 29 08:32:32.042: ISAKMP (0): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1
.May 29 08:32:32.042: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
.May 29 08:32:32.042: ISAKMP:(0): sending packet to <<central office WAN IP>> my_port 500 peer_port 500 (I) MM_NO_STATE
.May 29 08:32:32.042: ISAKMP:(0):Sending an IKE IPv4 Packet.
.May 29 08:32:34.846: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:32:40.846: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:32:42.042: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
.May 29 08:32:42.042: ISAKMP (0): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1
.May 29 08:32:42.042: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
.May 29 08:32:42.042: ISAKMP:(0): sending packet to <<central office WAN IP>> my_port 500 peer_port 500 (I) MM_NO_STATE
.May 29 08:32:42.042: ISAKMP:(0):Sending an IKE IPv4 Packet.
.May 29 08:32:46.846: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:32:50.018: ISAKMP:(0):purging node -118750948
.May 29 08:32:50.018: ISAKMP:(0):purging node -1193365643
.May 29 08:32:51.346: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=<<remote office WAN IP>>, prot=50, spi=0xCF8BD5F3(3482047987), srcaddr=<<central office WAN IP>>, input interface=Dialer1
.May 29 08:32:52.042: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
.May 29 08:32:52.042: ISAKMP (0): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1
.May 29 08:32:52.042: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
.May 29 08:32:52.042: ISAKMP:(0): sending packet to <<central office WAN IP>> my_port 500 peer_port 500 (I) MM_NO_STATE
.May 29 08:32:52.042: ISAKMP:(0):Sending an IKE IPv4 Packet.
.May 29 08:32:52.846: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:32:58.847: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>
.May 29 08:33:00.019: ISAKMP:(0):purging SA., sa=875BE8B8, delme=875BE8B8
.May 29 08:33:02.043: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
.May 29 08:33:02.043: ISAKMP:(0):peer does not do paranoid keepalives..May 29 08:33:02.043: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer <<central office WAN IP>>)
.May 29 08:33:02.043: ISAKMP:(0):deleting SA reason "Death by retransmission P1" state (I) MM_NO_STATE (peer <<central office WAN IP>>)
.May 29 08:33:02.043: ISAKMP: Unlocking peer struct 0x875BF6B8 for isadb_mark_sa_deleted(), count 0
.May 29 08:33:02.043: ISAKMP: Deleting peer node by peer_reap for <<central office WAN IP>>: 875BF6B8
.May 29 08:33:02.043: ISAKMP:(0):deleting node 1839947115 error FALSE reason "IKE deleted"
.May 29 08:33:02.043: ISAKMP:(0):deleting node -1221586275 error FALSE reason "IKE deleted"
.May 29 08:33:02.043: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
.May 29 08:33:02.043: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_DEST_SA.May 29 08:33:02.455: ISAKMP:(0): SA request profile is (NULL)
.May 29 08:33:02.455: ISAKMP: Created a peer struct for <<central office WAN IP>>, peer port 500
.May 29 08:33:02.455: ISAKMP: New peer created peer = 0x874792E0 peer_handle = 0x8000000B
.May 29 08:33:02.455: ISAKMP: Locking peer struct 0x874792E0, refcount 1 for isakmp_initiator
.May 29 08:33:02.455: ISAKMP: local port 500, remote port 500
.May 29 08:33:02.455: ISAKMP: set new node 0 to QM_IDLE
.May 29 08:33:02.455: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 87060E68
.May 29 08:33:02.455: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
.May 29 08:33:02.455: ISAKMP:(0):found peer pre-shared key matching <<central office WAN IP>>
.May 29 08:33:02.455: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
.May 29 08:33:02.455: ISAKMP:(0): constructed NAT-T vendor-07 ID
.May 29 08:33:02.455: ISAKMP:(0): constructed NAT-T vendor-03 ID
.May 29 08:33:02.455: ISAKMP:(0): constructed NAT-T vendor-02 ID
.May 29 08:33:02.455: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
.May 29 08:33:02.455: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1.May 29 08:33:02.455: ISAKMP:(0): beginning Main Mode exchange
.May 29 08:33:02.455: ISAKMP:(0): sending packet to <<central office WAN IP>> my_port 500 peer_port 500 (I) MM_NO_STATE
.May 29 08:33:02.455: ISAKMP:(0):Sending an IKE IPv4 Packet.
.May 29 08:33:04.847: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>ndebug crypto isakmp
.May 29 08:33:10.847: ISAKMP:(0): ignoring request to send delete notify (sa not authenticated) src <<remote office WAN IP>> dst <<central office WAN IP>>o debug crypto isakmp
Crypto ISAKMP debugging is off
IC-Deutschland#
.May 29 08:33:12.455: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
.May 29 08:33:12.455: ISAKMP (0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
.May 29 08:33:12.455: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
.May 29 08:33:12.455: ISAKMP:(0): sending packet to <<central office WAN IP>> my_port 500 peer_port 500 (I) MM_NO_STATE
.May 29 08:33:12.455: ISAKMP:(0):Sending an IKE IPv4 Packet.
Can anyone shed some light as what could be going on?
Much obliged!

Unfortunately I do not have a support contract for our hardware. I wouldn't even know how to get one.
However, we do pay top dollar for the equipment and it seems one it's components doesn't work as advertised. So if no support is given I will have to try warrenty instead. This does mean I have to replace the unit with a competitor brand which isn't something I'm keen to do because I want to use Cisco as our main brand. This issue effectively nukes my entire plan.
Given our work load, CPU power isn't an issue. The encryption level is set to this level because I'm paranoid. Which I reckon is a good thing when it comes to network security (correct me if I'm wrong). Do you suspect these settings could be of any influence in this particular case?
If I remember correctly I used the "debug crypto isakmp" or "debug crypto isakmp errors" and "debug crypto ipsec" (also perhaps with the "error" suffix), I'm not sure.

Similar Messages

Extended network fails after 24hrs

Hi,
This has been bothering me for a while now. Hope someone can help.
I have an Airport Extreme offering a wireless network in my home. I've set it to allow an extended network.
Recently I purchased an Airport Express and set it up to extend the existing network.
This all works fine for a while, but after about a day the network falls over. My Mac says the network is still there, however I can't access the internet (w/ Safari) anymore.
When I reset the Extreme (i.e. power off/on), the network comes back on for another 24hrs at which time I have to reset the Extreme again... This can't be the intended design.
If I switch off the Express, there are no problems whatsoever. Its when I switch the Express on that the network "expires" after about 24hrs and requires a daily reset of the Extreme.
Also interesting to note is that I have a computer connected to the Extreme via UTP-cable and *that* doesn't suffer from any connectivity problems after 24hrs.
However, running the Airport Utility when the network is down -- either wirelessly or on the wired PC -- doesn't find the Extreme until I've reset it.
Any suggestions as to what might be the cause and what I could try before calling Apple would be greatly appreciated.
[UPDATE]: My problem looks a bit like this: http://is.gd/tqU7GJ I'm trying the solutions offered there and updating here as I I try out stuff. Don't let that stop you from offering extra/alternate options though ;-)
1. Set logging from 5 to 3 [23-Apr-2011 11:50]
Message was edited by: Mausy

Sofar (since May 11) nothing new. Everything working flawlessly. As far as I'm concerned it looks like the logging level on the Express did the trick.
For future reference, here are the (I think relevant) settings that currently seem to work best:
Airport Express:
* Wireless mode = Extend a wireless network
* Using DHCP
* AirTunes enabled
* Syslog level = 3
* Allow SNMP = off
* IPv6 mode = Link-local only
Airport Extreme:
* Wireless mode = Create a wireless network
* Radio mode and channel selection = Automatic (using wide channels)
* Guest network enabled
* DHCP reservation enabled for the Express
* DHCP lease time: 1 day
* NAT enabled @ 10.0.1.253
* Syslog level = 5 (hmm...)
* IPv6 Mode = Link-local only

Vpn fails after upgrade to 10.8.5

After upgrading from SL to Mountain Lion the Apple vpn client connections fail. They were connecting fine before the upgrade. They also work fine from other computers (Windows) on my network to the same addresses, so the remote side is functioning, and there have been no changes on the remote side.
The error message is "The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your Administrator." The Console messages indicate the server does in fact respond, but there is a problem with Phase 1 IKE. Message lines are pasted here with the IP addresses masked (the addresses are correct though).
10/12/13 5:33:39.340 PM configd[18]: SCNC: start, triggered by SystemUIServer, type L2TP, status 0
10/12/13 5:33:39.360 PM pppd[2104]: pppd 2.4.2 (Apple version 596.15.2) started by admin, uid 503
10/12/13 5:33:39.363 PM pppd[2104]: L2TP connecting to server '999.999.999.999' (999.999.999.999)...
10/12/13 5:33:39.363 PM pppd[2104]: IPSec connection started
10/12/13 5:33:39.379 PM racoon[2105]: Connecting.
10/12/13 5:33:39.380 PM racoon[2105]: IPSec Phase1 started (Initiated by me).
10/12/13 5:33:39.380 PM racoon[2105]: IKE Packet: transmit success. (Initiator, Main-Mode message 1).
10/12/13 5:33:39.465 PM racoon[2105]: IKE Packet: receive success. (Initiator, Main-Mode message 2).
10/12/13 5:33:39.469 PM racoon[2105]: IKE Packet: transmit success. (Initiator, Main-Mode message 3).
10/12/13 5:33:39.583 PM racoon[2105]: IKE Packet: receive success. (Initiator, Main-Mode message 4).
10/12/13 5:33:39.588 PM racoon[2105]: IKE Packet: transmit success. (Initiator, Main-Mode message 5).
10/12/13 5:33:42.671 PM racoon[2105]: IKE Packet: transmit success. (Phase1 Retransmit).
10/12/13 5:33:45.754 PM racoon[2105]: IKE Packet: transmit success. (Phase1 Retransmit).
10/12/13 5:33:45.760 PM racoon[2105]: Received retransmitted packet from 999.999.999.999[500].
10/12/13 5:33:48.839 PM racoon[2105]: IKE Packet: transmit success. (Phase1 Retransmit).
10/12/13 5:33:57.752 PM racoon[2105]: Received retransmitted packet from 999.999.999.999[500].
10/12/13 5:34:00.832 PM racoon[2105]: IKE Packet: transmit success. (Phase1 Retransmit).
10/12/13 5:34:09.465 PM pppd[2104]: IPSec connection failed
10/12/13 5:34:09.466 PM racoon[2105]: IPSec disconnecting from server 999.999.999.999
About the configuration -- the apple client is using preshared key with ppp user/password auth. The user/password and psk all work in other clients, have re-entered them many times, have deleted then recreated the connection in Network Preferences. Have restarted the racoon service, and even rebooted several times.
Googled around and found a number of reports of similar problem after upgrade to Lion or Mountain Lion, haven't found anything that works so far. Have disabled my antivirus, have rebooted network router, have changed access control in Keychain Access to allow access from all applications. Can't change the remote side configuration because of other users, need to find a way to solve this on my client side. I do have backups that would allow me to roll back to Snow Leopard, but does anyone have any other solution, would like to have a better alternative. Appreciate any/all suggestions, thanks.

Thanks again, good point. I wasn't doing this on first few tries but eventually realized I needed to clean up Keychain Access because of all the duplicates I created (orphans) so yes I did delete connection and corresponding keychains then recreate then change access. Along the way I noticed that every time I later applied a change to an existing connection setting I had to return to Keychain Access and change the access control settings again, they revert back to 'confirm' from 'all access' at each change. So even if it worked for me I realize it isn't a permanent fix.
And iCloud is 'inactive', so I guess Back to My Mac is disabled too, I don't know that app but assume so since it needs iCloud. Is there a better way to be sure it can't interfere? I do think I'm getting some phase 1 traffic out and back to the remote server evidenced by the console log, so seems the ports are not being blocked.

2k12 server VPN fails after migration

I migrated my DC to another server using VMware ESXi 5.5 to do maintenance on the old server, so this new server is only temporary. The issue I'm having after using the VMware converter standalone (I've also used Veeam) is the VPN - Routing
and Remote Access no longer will work. When I try connecting through the VPN it gets to the points to verifying username and password, but errors out and I get an error 628.
What would cause the VPN no longer to work and what logs should I look at? I did read that error 628 is a certificate issue, but I checked the certificate and it matches and isn't expired. I have also tried reconfiguring and uninstalling and reinstalling RRAS,
but the only difference is under RRAS > IPv4 > General > I now see Ethernet being the only thing new, but when I connect I get the same error 628.
What should I do?

Hi,
Error 628 means that the port was disconnected. This error may occur in a lot of cases.
To find the reason why the connection is disconnected, please check the event of the
RemoteAccess in the server.
Besides, what's type you configured on the RRAS to assign the IP address to remote client. Please make sure that there is valid IP address in the address pool. If the RRAS client can't assgin the address to the client, the connection will be terminated.
Best Regards.
Steven Lee Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Setup Airport Extreme for the home wireless - MacBook Air, Pro, and iPad connect just fine. Wireless will not work to Windows 7 and Vista machines - network seen, tries to connect, but fails after entering WPA key.

Can't get Windows Vista or Windows 7 laptops to access internet via Airport Extreme. Works fine with security on MacBook Air, MacBook Pro, and iPad. Brand new Airport, bought today. Windows machines worked fine with existing, relatively modern Cisco home router. The Windows machines see the wireless network, prompt for password, and then cannot connect. Have tried all sorts of things with Windows machines, deleted existing networks, etc. even tried guest login with no security on the Airport - no luck. Windows XP machine directly (wire) connected works fine. Magic Jack works OK. Light is green on the front.

Thank you very much for your help @Sunshyn2005!!!!! I think we're good to go now!

WRV200: IPSec Key Lifetime Stuck on 3600 (VPN)

Hi. I have a WRV200 router (version 1). I can successfully setup VPN tunnels to other VPN routers. However, I have a minor issue. Although the IPSec Key Lifetime is listed as being any number between 1200 and 86400, it will only let me select 3600.
I have verified this with the following firmware versions:
1.0.29 (2/14/07)
1.0.32.2 (5/2/07)
Using the web interface, it will let me change the number, but when I click "Save Settings", it goes back to 3600.
Has anyone else been able to set this field to any other value?
Is there a CLI interface that I can access to tweak the VPN settings?
Thanks,
Van

Get the beta firmware 1.0.38 from Linksys Tech Support. Firmware 1.0.38 is in my opinio the best firmware so far for WRV200.
Message Edited by VPN_user on 04-07-2008 12:27 AM

SOLVED Key board and mouse fail after last update

Both my wireless keyboard and mouse failed after I updated yesterday. I'm using KNOPPIX to post they both work with knoppix so its not a hardware problem.
KDE 4.1
Logitech keyboard and mouse
Last edited by normc (2008-11-08 00:05:37)

Thanks a lot
Just want to add that I had to edit grub at start up and add "single" at the end of the kernel line.
The reason is that switching to runlevel 3 didn't work for me.

Unit test fails after upgrading to Kodo 4.0.0 from 4.0.0-EA4

I have a group of 6 unit tests failing after upgrading to the new Kodo
4.0.0 (with BEA) from Kodo-4.0.0-EA4 (with Solarmetric). I'm getting
exceptions like the one at the bottom of this email. It seems to be an
interaction with the PostgreSQL driver, though I can't be sure. I
haven't changed my JDO configuration or the related classes in months
since I've been focusing on using the objects that have already been
defined. The .jdo, .jdoquery, and .java code are below the exception,
just in case there's something wrong in there. Does anyone have advice
as to how I might debug this?
Thanks,
Mark
Testsuite: edu.ucsc.whisper.test.integration.UserManagerQueryIntegrationTest
Tests run: 15, Failures: 0, Errors: 6, Time elapsed: 23.308 sec
Testcase:
testGetAllUsersWithFirstName(edu.ucsc.whisper.test.integration.UserManagerQueryIntegrationTest):
Caused an ERROR
The column index is out of range: 2, number of columns: 1.
<2|false|4.0.0> kodo.jdo.DataStoreException: The column index is out of
range: 2, number of columns: 1.
at
kodo.jdbc.sql.DBDictionary.newStoreException(DBDictionary.java:4092)
at kodo.jdbc.sql.SQLExceptions.getStore(SQLExceptions.java:82)
at kodo.jdbc.sql.SQLExceptions.getStore(SQLExceptions.java:66)
at kodo.jdbc.sql.SQLExceptions.getStore(SQLExceptions.java:46)
at
kodo.jdbc.kernel.SelectResultObjectProvider.handleCheckedException(SelectResultObjectProvider.java:176)
at
kodo.kernel.QueryImpl$PackingResultObjectProvider.handleCheckedException(QueryImpl.java:2460)
at
com.solarmetric.rop.EagerResultList.<init>(EagerResultList.java:32)
at kodo.kernel.QueryImpl.toResult(QueryImpl.java:1445)
at kodo.kernel.QueryImpl.execute(QueryImpl.java:1136)
at kodo.kernel.QueryImpl.execute(QueryImpl.java:901)
at kodo.kernel.QueryImpl.execute(QueryImpl.java:865)
at kodo.kernel.DelegatingQuery.execute(DelegatingQuery.java:787)
at kodo.jdo.QueryImpl.executeWithArray(QueryImpl.java:210)
at kodo.jdo.QueryImpl.execute(QueryImpl.java:137)
at
edu.ucsc.whisper.core.dao.JdoUserDao.findAllUsersWithFirstName(JdoUserDao.java:232)
at
edu.ucsc.whisper.core.manager.DefaultUserManager.getAllUsersWithFirstName(DefaultUserManager.java:252)
NestedThrowablesStackTrace:
org.postgresql.util.PSQLException: The column index is out of range: 2,
number of columns: 1.
at
org.postgresql.core.v3.SimpleParameterList.bind(SimpleParameterList.java:57)
at
org.postgresql.core.v3.SimpleParameterList.setLiteralParameter(SimpleParameterList.java:101)
at
org.postgresql.jdbc2.AbstractJdbc2Statement.bindLiteral(AbstractJdbc2Statement.java:2085)
at
org.postgresql.jdbc2.AbstractJdbc2Statement.setInt(AbstractJdbc2Statement.java:1133)
at
com.solarmetric.jdbc.DelegatingPreparedStatement.setInt(DelegatingPreparedStatement.java:390)
at
com.solarmetric.jdbc.PoolConnection$PoolPreparedStatement.setInt(PoolConnection.java:440)
at
com.solarmetric.jdbc.DelegatingPreparedStatement.setInt(DelegatingPreparedStatement.java:390)
at
com.solarmetric.jdbc.DelegatingPreparedStatement.setInt(DelegatingPreparedStatement.java:390)
at
com.solarmetric.jdbc.DelegatingPreparedStatement.setInt(DelegatingPreparedStatement.java:390)
at
com.solarmetric.jdbc.LoggingConnectionDecorator$LoggingConnection$LoggingPreparedStatement.setInt(LoggingConnectionDecorator.java:1
257)
at
com.solarmetric.jdbc.DelegatingPreparedStatement.setInt(DelegatingPreparedStatement.java:390)
at
com.solarmetric.jdbc.DelegatingPreparedStatement.setInt(DelegatingPreparedStatement.java:390)
at kodo.jdbc.sql.DBDictionary.setInt(DBDictionary.java:980)
at kodo.jdbc.sql.DBDictionary.setUnknown(DBDictionary.java:1299)
at kodo.jdbc.sql.SQLBuffer.setParameters(SQLBuffer.java:638)
at kodo.jdbc.sql.SQLBuffer.prepareStatement(SQLBuffer.java:539)
at kodo.jdbc.sql.SQLBuffer.prepareStatement(SQLBuffer.java:512)
at kodo.jdbc.sql.SelectImpl.execute(SelectImpl.java:332)
at kodo.jdbc.sql.SelectImpl.execute(SelectImpl.java:301)
at kodo.jdbc.sql.Union$UnionSelect.execute(Union.java:642)
at kodo.jdbc.sql.Union.execute(Union.java:326)
at kodo.jdbc.sql.Union.execute(Union.java:313)
at
kodo.jdbc.kernel.SelectResultObjectProvider.open(SelectResultObjectProvider.java:98)
at
kodo.kernel.QueryImpl$PackingResultObjectProvider.open(QueryImpl.java:2405)
at
com.solarmetric.rop.EagerResultList.<init>(EagerResultList.java:22)
at kodo.kernel.QueryImpl.toResult(QueryImpl.java:1445)
at kodo.kernel.QueryImpl.execute(QueryImpl.java:1136)
at kodo.kernel.QueryImpl.execute(QueryImpl.java:901)
at kodo.kernel.QueryImpl.execute(QueryImpl.java:865)
at kodo.kernel.DelegatingQuery.execute(DelegatingQuery.java:787)
at kodo.jdo.QueryImpl.executeWithArray(QueryImpl.java:210)
at kodo.jdo.QueryImpl.execute(QueryImpl.java:137)
at
edu.ucsc.whisper.core.dao.JdoUserDao.findAllUsersWithFirstName(JdoUserDao.java:232)
--- DefaultUser.java -------------------------------------------------
public class DefaultUser
implements User
/** The account username. */
private String username;
/** The account password. */
private String password;
/** A flag indicating whether or not the account is enabled. */
private boolean enabled;
/** The authorities granted to this account. */
private Set<Authority> authorities;
/** Information about the user, including their name and text that
describes them. */
private UserInfo userInfo;
/** The set of organizations where this user works. */
private Set<Organization> organizations;
--- DefaultUser.jdo --------------------------------------------------
<?xml version="1.0"?>
<!DOCTYPE jdo PUBLIC
"-//Sun Microsystems, Inc.//DTD Java Data Objects Metadata 2.0//EN"
"http://java.sun.com/dtd/jdo_2_0.dtd">
<jdo>
<package name="edu.ucsc.whisper.core">
<sequence name="user_id_seq"
factory-class="native(Sequence=user_id_seq)"/>
<class name="DefaultUser" detachable="true"
table="whisper_user" identity-type="datastore">
<datastore-identity sequence="user_id_seq" column="userId"/>
<field name="username">
<column name="username" length="80" jdbc-type="VARCHAR" />
</field>
<field name="password">
<column name="password" length="40" jdbc-type="CHAR" />
</field>
<field name="enabled">
<column name="enabled" />
</field>
<field name="userInfo" persistence-modifier="persistent"
default-fetch-group="true" dependent="true">
<extension vendor-name="jpox"
key="implementation-classes"
value="edu.ucsc.whisper.core.DefaultUserInfo" />
<extension vendor-name="kodo"
key="type"
value="edu.ucsc.whisper.core.DefaultUserInfo" />
</field>
<field name="authorities" persistence-modifier="persistent"
table="user_authorities"
default-fetch-group="true">
<collection
element-type="edu.ucsc.whisper.core.DefaultAuthority" />
<join column="userId" delete-action="cascade"/>
<element column="authorityId" delete-action="cascade"/>
</field>
<field name="organizations" persistence-modifier="persistent"
table="user_organizations" mapped-by="user"
default-fetch-group="true" dependent="true">
<collection
element-type="edu.ucsc.whisper.core.DefaultOrganization"
dependent-element="true"/>
<join column="userId"/>

</field>
</class>
</package>
</jdo>
--- DefaultUser.jdoquery ---------------------------------------------
<?xml version="1.0"?>
<!DOCTYPE jdo PUBLIC
"-//Sun Microsystems, Inc.//DTD Java Data Objects Metadata 2.0//EN"
"http://java.sun.com/dtd/jdo_2_0.dtd">
<jdo>
<package name="edu.ucsc.whisper.core">
<class name="DefaultUser">
<query name="UserByUsername"
language="javax.jdo.query.JDOQL"><![CDATA[
SELECT UNIQUE FROM edu.ucsc.whisper.core.DefaultUser
WHERE username==searchName
PARAMETERS java.lang.String searchName
]]></query>
<query name="DisabledUsers"
language="javax.jdo.query.JDOQL"><![CDATA[
SELECT FROM edu.ucsc.whisper.core.DefaultUser WHERE
enabled==false
]]></query>
<query name="EnabledUsers"
language="javax.jdo.query.JDOQL"><![CDATA[
SELECT FROM edu.ucsc.whisper.core.DefaultUser WHERE
enabled==true
]]></query>
<query name="CountUsers"
language="javax.jdo.query.JDOQL"><![CDATA[
SELECT count( this ) FROM edu.ucsc.whisper.core.DefaultUser
]]></query>
</class>
</package>
</jdo>

I'm sorry, I have no idea. I suggest sending a test case that
reproduces the problem to support.

The NLS operation failed because the registry key Control Panel\International\User Profile cannot be opened. Error code is 2. Error message: The system cannot find the file specified.

H,
Since upgrading Windows server 2008 R2 to Server 2012 Standard edition, we get this repetitious critical error in the event log:
Event 1001
Op Code NLS initialization
The NLS operation failed because the registry key Control Panel\International\User Profile cannot be opened. Error code is 2. Error message: The system cannot find the file specified.
We originally found that the regional date settings after changing them in regional settings (DD/MM/YYYY) and they did not inherit properly from the upgrade but they are ok now.
I've looked at HKCU\.Default\Control Panel\International and nothing looks obviously wrong. Country codes, time & date formats are correct.
How do we ascertain the cause of this error and the specific registry key that might be problematic?

Hi,
This could be caused by firewall rules or security softwares.
http://www.tomshardware.com/forum/242579-44-hkcu-control-panel-international-opened
And in addition, the fix is worth a try.
Nothing happens when you double-click "Region" in Control Panel
http://support.microsoft.com/kb/2958845
Please Note: Since the first web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

TIME dimension processing fails saying "..attribute key cannot be found.." in EPM 10

After upgrading from version 7.5 to EPM 10, when we ran a ‘Full Process’ on the TIME dimension, it ran into an error saying “Errors in the OLAP storage engine: The attribute key cannot be found when processing: Table: 'dbo_tblFactCapEx', Column: 'TIMEID', Value: '20090013'. The attribute is 'Time_TIMEID'. (1/13/2015 2:41:02 PM)”.
Full error message is attached herewith – ‘Time Dimension Error.txt’
After researching, we did discover that MONTHNUM needed to be converted to BASE_PERIOD. Re-processed which produced the same error.
Prior to migration to version 7.5, we ran a full process on TIME dimension there. It completed successfully, confirming the issue is only with version 10.
Confirmed we could see the TIMEID value of 20090013 in the following places:
Time Dimension in the appropriate TIMEID attribute column.
Confirmed mbrTIME table had base member ID with TIMEID attribute filled out correctly.
Data in tblFactFINANCE could be pulled using that TIMEID
We truncated all the records in all the fact tables associated to this TIME dimension.
Eventually, when none of the tables had any records, the TIME dimension then processed successfully.
We this began to suspect the issue may not really be related to bad records.
We conducted one more test to confirm this.
Using an input form in EPM 10, we manually entered data in one of the models (at this point none of the fact tables have any records)
Ran Full Optimize on that model with Compress Database and Index Defragmentation checked – This step failed with the error attached in ‘MatrixRateFullOptimize.txt’
Ran Full process on Time Dimension – Failed indicating issue with TimeID 2012001 (that’s my manual entry). Attached error report ‘TimeDim Error MatrixRate.txt’
At this point, the table only contains the manually entered records (no suspected bad records)
We then suspected there could have been an issue with the upgrade process.
So we reprocessed all the dimension and optimized all the models in version 7.5, made a new backup and restored it to version 10.
The issue still persisted!
At this point, we have tried all the possibilities we could think of. Each time the fact table is populated with records, the TIME dimension process fails indicating ‘the attribute key’ cannot be found.
There is probably something in the OLAP partition that is not able to link the dimension attributes to the cubes.
Additional Information:
Please find attached the existing Time Dimension – TimeDimensionMembers.xlxs
Version of Excel used: Excel 2007, SP3 MSO (12.0.6683.5000)
System Specs: Please see screenshot below.

Thank you all for responding! This issue is resolved.
Here’s what the issue was:
The time structure is TOTAL >> Years >> Quarters >> Months (e.g. T.ALL >> 2012.TOTAL >> 2012.Q1 >> 2012.P01)
As shown in the screenshot below, the LEVEL for ‘T.ALL’ member was set to YEAR, which is incorrect (we can’t have Year rolling up to a Year)
We changed the LEVEL to ‘TOTAL’ and this fixed the issue!!
If only it gave a better error message than the “..attribute key not found” message

VPN hangs after 45 minutes

I have a VPN setup using L2tp over ipsec. Using Leopard 10.5 it worked with no problem. With Snow Leopard it connects and works fine for about 45 minutes. Then it drops out. I then try to communicate with my wireless router with no success. I disconnect the VPN connection, wait 15 seconds and then reconnect. It then is OK for another 45 minutes. Should I reinstall Snow Leopard or rollback to 10.5? Any suggestions would be great.

I have this problem too. Most of the time, it fails after 48 minutes. Occasionally, it doesn't fail then, but will then fail at the 96 minute mark.

Best Practice for IKE keys

Folks,
I am configuring my first site-to-site vpn using IPsec and IKE; however, I wanted to know if I should watch out for anything and the best practices for IKE.
I have generated a phrase that is 30 characters long, but should I include “special characters” in my IKE key?

Rather than the key length and 'strength' I'd focus on keeping a copy documented / stored securely offline somewhere. Process and documentation are at least as important as the technology.
99% of your protection comes from using a VPN at all as opposed to the characters used in your PSK.
If it's an option (e.g ASA 8.4 at both ends) I'd recommend using IKEv2.

Win XP installation fails after successful Parallels installation...

Hi:
I've been trying for the last several hours to install my new copy of Windows XP under Parallels (which bought, installed, and updated to Build 3188 earlier).
Here's what happens: I get to the final step of the "OS Installation Assistant" in Parallels, where it says to insert the Windows XP CD into the CD-ROM drive. I do so, click "Finish," and after a few moments, my Macbook's SuperDrive spits out the Windows CD (yeah, I know... ).
That's it.
Oh, the one time I got the Windows installation process underway, the installation quit, giving me the following error message: "File symc8xx.sys is corrupted. Press any key to continue." This was followed by "Setup failed. Press any key to restart your computer."
*ANY* help you good folks can offer will be greatly appreciated.
Bill in CT

Since Parallels is not an Apple product, you have better luck posting your question on the Parallels discussion forums rather than an Apple forum that focuses on compatibility issues between Macs and Windows:
http://forums.parallels.com

IPhoto 11 - Edit tools fail after initial use of program

Running 10.6.8 (all updates complete) on new MacBook. Began editing newly imported photos - edit features failed after first 50 photos. I have tried...
* updated all Mac Software
* deleted user iPhoto preferences, emptied trash, reopened
* repaired iPhoto library, etc....
Has this happened to anyone else? Any suggestions for repair/recovery?

Try this: launch iPhoto with the Option key held down and create a new, test library. Import some photos and check to see if the same problem persists. If it does then a reinstall of iPhoto seems warranted. To do so you'll have to delete the current application and all files with "iPhoto" in the file name with either a .PKG or .BOM extension that reside in the HD/Library/Receipts folder and from the /var/db/receipts/ folder,
Click to view full size
Then install iPhoto from the disk it came on originally.
OT

Time machine fails after three successful attempts consistently.

I am using time machine but it fails after three successful attempts consistently.
I am using a brand new 4TB G-drive. I have tested with Apple support and they are sure the problem is not with the disk.
The error message is "Unable to complete back-up folder". System log states:
Starting standard backup
Backing up to: /Volumes/Time Machine/Backups.backupdb
Error: (22) setxattr for key:com.apple.backupd.ModelID path:/Volumes/Time Machine/Backups.backupdb/Mac Pro Desktop Computer size:9
Error: (-50) Creating directory 2013-01-25-015650.inProgress
Failed to make snapshot container.
Error: (22) setxattr for key:com.apple.backupd.ModelID path:/Volumes/Time Machine/Backups.backupdb/Mac Pro Desktop Computer size:9
Backup failed with error: 2
I have trawled Google and Apple and seen that this problem has been experienced by many but I have yet to find a solution to resolve my problem.
Does anyone have a solution?
Chris

I have seen this precise problem on a client machine. It would run one to three backups fine, then start giving this error.
I tried every hint in the other discussions. I repaired the backup volume. I ERASED the backup folder and started over. I erased and reformatted the drive. Every time, it would get me one to three clean backups, then the same error all over again. I tested the snot out of the drive and there was absoutely nothing wrong with it as a drive.
In desperation, I upgraded the client to Mountain Lion. Mountain Lion took the "bad" backup set just as Snow Leopard had left it, and backed up to it with NO COMPLAINT. It's still backing up fine several days later.
I guess the upshot is that Time Machine in Snow Leopard has problems that Time Machine in Mountain Lion has outgrown.

881 VPN fails after 24hrs/IKE key lifetime

Similar Messages

Maybe you are looking for