Subject: [Ipsec] i have a question about manual key

From: "eric.qu" <[email-masked]>
Date: Wed, 23 Feb 2005 09:55:33 +0800

hi
  i have a question about manual key 
  i have two route by own develop, i can establish the vpn tunnel by use manual key . and test icmp traffic from left route to right route , it is ok .
  and then , the left route continue send encrypt icmp traffic to right, and change the manual key of right route ,now , the right route dropped encrypt icmp traffic , beacause the manual key of left route can't be matched. 
  after some packets , i recover the correct maunal key in right route , but the left route can't receive encrypt icmp reply traffic from right route successfully 
  i find the left route send esp packet with large seqnumber , and right route reply esp packest with min seqnumber ,because the right route make a new ipsec sa , thus the left route receive the esp pakcet with min-seqnumber from right route 
  because it is manual key , the left route can't know that the right route have changed ipsec sa , the left keep the ipsec sa , and the seq number window is so large that can't match the esp seq number of right route, so left route will dropped the esp packtes . 
  who can tell me how solve this problem ?
  thanks!!

  Best regards

Eric
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec