# Racoon: unknown notify message

## archiem

Hi Gurus,

I've got a problem with IPsec configuration (based on IPsec-tools), which I could not solve for a long time, and which is becaming really frustrating to me. Hope you can help me at least with pointing out, where the potential problem could be.

Here comes my IPsec-tools configuration:

racoon.conf:

```

path pre_shared_key "psk.txt";

timer

{

        counter 5;

        interval 20 sec;

        persend 1;

        phase1 30 sec;

        phase2 15 sec;

}

log notify;

remote anonymous

{

        exchange_mode main;

        lifetime time 24 hour;

        proposal_check obey;

        doi ipsec_doi;

        proposal {

                encryption_algorithm 3des;

                hash_algorithm md5;

                authentication_method pre_shared_key;

                dh_group 2;

        }

}

sainfo anonymous

{

        lifetime time 3600 sec;

        encryption_algorithm 3des;

        authentication_algorithm hmac_md5;

        compression_algorithm deflate;

}

```

setkey.sh:

```

#!/usr/sbin/setkey -f

flush;

spdflush;

spdadd -4n 172.16.0.0/24   192.168.0.0/24    any -P out ipsec esp/tunnel/a.b.c.d-w.x.y.z/unique:1;

spdadd -4n 192.168.0.0/24    172.16.0.0/24   any -P in  ipsec esp/tunnel/w.x.y.z-a.b.c.d/unique:2;

```

psk.txt:

```

w.x.y.z   somesecretpassword

```

The remote side (Cisco router) is configured in accordance to the above parameters (IPs, subnets, lifetimes and encryption/hashing algorithms). So far the Cisco does not log anything strange.

Now, after running racoon everything works ok for random time (20 minutes or more). After that the tunnel suddenly stops working. Here comes the logs:

```

Nov 22 08:07:35 vpn-gw racoon: INFO: ISAKMP-SA established a.b.c.d[500]-w.x.y.z[500] spi:a4b7be48c7823271:cac3f5c48d1c9ca8

Nov 22 08:07:35 vpn-gw racoon: INFO: received Vendor ID: CISCO-UNITY

Nov 22 08:07:35 vpn-gw racoon: INFO: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt

Nov 22 08:07:35 vpn-gw racoon: INFO: received Vendor ID: DPD

Nov 22 08:07:36 vpn-gw racoon: INFO: initiate new phase 2 negotiation: a.b.c.d[500]<=>w.x.y.z[500]

Nov 22 08:07:36 vpn-gw racoon: WARNING: ignore RESPONDER-LIFETIME notification.

Nov 22 08:07:36 vpn-gw racoon: WARNING: attribute has been modified.

Nov 22 08:07:36 vpn-gw racoon: INFO: IPsec-SA established: ESP/Tunnel w.x.y.z[0]->a.b.c.d[0] spi=152461000(0x9165ec8)

Nov 22 08:07:36 vpn-gw racoon: INFO: IPsec-SA established: ESP/Tunnel a.b.c.d[0]->w.x.y.z[0] spi=3525438477(0xd221ec0d)

Nov 22 08:55:36 vpn-gw racoon: INFO: IPsec-SA expired: ESP/Tunnel w.x.y.z[0]->a.b.c.d[0] spi=152461000(0x9165ec8)

Nov 22 08:55:36 vpn-gw racoon: INFO: initiate new phase 2 negotiation: a.b.c.d[500]<=>w.x.y.z[500]

Nov 22 08:55:36 vpn-gw racoon: INFO: IPsec-SA expired: ESP/Tunnel a.b.c.d[0]->w.x.y.z[0] spi=3525438477(0xd221ec0d)

Nov 22 08:55:36 vpn-gw racoon: WARNING: ignore RESPONDER-LIFETIME notification.

Nov 22 08:55:36 vpn-gw racoon: WARNING: attribute has been modified.

Nov 22 08:55:36 vpn-gw racoon: INFO: IPsec-SA established: ESP/Tunnel w.x.y.z[0]->a.b.c.d[0] spi=186847843(0xb231263)

Nov 22 08:55:36 vpn-gw racoon: INFO: IPsec-SA established: ESP/Tunnel a.b.c.d[0]->w.x.y.z[0] spi=1195127969(0x473c34a1)

Nov 22 08:56:07 vpn-gw racoon: ERROR: unknown notify message, no phase2 handle found.

Nov 22 08:56:07 vpn-gw racoon: ERROR: unknown notify message, no phase2 handle found.

Nov 22 08:56:07 vpn-gw racoon: ERROR: unknown notify message, no phase2 handle found.

Nov 22 08:56:07 vpn-gw racoon: ERROR: unknown notify message, no phase2 handle found.

Nov 22 08:56:08 vpn-gw racoon: ERROR: unknown notify message, no phase2 handle found.

Nov 22 08:56:08 vpn-gw racoon: ERROR: unknown notify message, no phase2 handle found.

Nov 22 08:56:08 vpn-gw racoon: ERROR: unknown notify message, no phase2 handle found.

Nov 22 08:56:10 vpn-gw racoon: ERROR: unknown notify message, no phase2 handle found.

Nov 22 08:56:12 vpn-gw racoon: ERROR: unknown notify message, no phase2 handle found.

Nov 22 08:56:12 vpn-gw racoon: ERROR: unknown notify message, no phase2 handle found.

```

The connection will not work until the racoon is restarted.

I would really appreciate any help with solving this problem out.

Kind regards,

archiem

PS. The MTU should be ok (1400 for internal interfaces - non encrypted traffic), 1500 for external (ESP) traffic

----------

## archiem

In addition - I am using the latest IPsec-tools (0.6.3) and kernel (2.6.14-gentoo-r2).

Regards,

archiem

----------

