connection IPSec have a problem

[kittinan]

Hi everyone

I'm having an IPSec connection problem. This issue occurs after my router shuts down. Below is the debug log. I want to know where the problem is and how to fix it.

TCTPK-FG100F-12F-02 # ike 0:IPSec1viaPANET:5396: negotiation timeout, deleting
ike 0:IPSec1viaPANET: connection expiring due to phase1 down
ike 0:IPSec1viaPANET: deleting
ike 0:IPSec1viaPANET: deleted
ike 0:IPSec1viaPANET: schedule auto-negotiate
ike 0:IPSec1viaPANET:IPSec1viaPANET: IPsec SA connect 7 61.47.81.6->203.104.128.66:0
ike 0:IPSec1viaPANET:IPSec1viaPANET: config found
ike 0:IPSec1viaPANET: created connection: 0x89da900 7 61.47.81.6->203.104.128.66:500.
ike 0:IPSec1viaPANET: IPsec SA connect 7 61.47.81.6->203.104.128.66:500 negotiating
ike 0:IPSec1viaPANET: no suitable IKE_SA, queuing CHILD_SA request and initiating IKE_SA negotiation
ike 0:IPSec1viaPANET:5397: out 2B1093AB74FCEA5500000000000000002120220800000000000001D8220000880200002C010100040300000C0100000C800E01000300000802000005030000080300000C000000080400000E0200002C020100040300000C0100000C800E00C00300000802000005030000080300000C000000080400000E0000002C030100040300000C0100000C800E00800300000802000005030000080300000C000000080400000E28000108000E0000DED0D7BFF3469C92FE4168FE785159393FE31602AAC2DE4037F258A0B6FB528F4DAFEC3092B2413259907C3A96C5B0958C1C34108FA99B208C02D0D7DC3330E46A468F5A5AC7E31EBAE7251808E86A8D024FAF215670DF5D94B7364B73E67FFC28FAE28408B05AD4B85F2A17B9FE50C6029E9EABA414EBF4F04D394CA8D5C36CE709251CB9BB87FDB2D490A2FD8A8E01F64588C1DE7B196F4582177B7B96DAC23C5503EEFA0004DE3D6FCAAB944697A0D78DBB1ED54235663EF7E7BE9EF2747E9D58D04782AA7F7E2835B6B155FA4A96D50273CED263D681692003902D1F5500298E94F500F15DE30AE154847F04DE08C8CAE93518BD9120B596BECDB00A86C229000024299877DA9DFF5A19B98676BFC2B9959CB338B717850D3FD5F09B8C8D64F35B7D000000080000402E
ike 0:IPSec1viaPANET:5397: could not send IKE Packet(SA_INIT):61.47.81.6:500->203.104.128.66:500, len=0, vrf=472: error 101:Network is unreachable
ike 0: comes 203.104.128.65:500->210.1.37.154:500,ifindex=42,vrf=0....
ike 0: IKEv2 exchange=INFORMATIONAL id=2c9f1144acb76b28/eb0c8ba53aa15b92:00000b7e len=80
ike 0: in 2C9F1144ACB76B28EB0C8BA53AA15B922E20250800000B7E000000500000003465819ED584CD5A901ED212806BC359AC5EA33E949F7E5AA54907F36821FC9196F38B0F21074AF1B2B0CA1772D2143C7F
ike 0:IPSec1viaPANET:5397: out 2B1093AB74FCEA5500000000000000002120220800000000000001D8220000880200002C010100040300000C0100000C800E01000300000802000005030000080300000C000000080400000E0200002C020100040300000C0100000C800E00C00300000802000005030000080300000C000000080400000E0000002C030100040300000C0100000C800E00800300000802000005030000080300000C000000080400000E28000108000E0000DED0D7BFF3469C92FE4168FE785159393FE31602AAC2DE4037F258A0B6FB528F4DAFEC3092B2413259907C3A96C5B0958C1C34108FA99B208C02D0D7DC3330E46A468F5A5AC7E31EBAE7251808E86A8D024FAF215670DF5D94B7364B73E67FFC28FAE28408B05AD4B85F2A17B9FE50C6029E9EABA414EBF4F04D394CA8D5C36CE709251CB9BB87FDB2D490A2FD8A8E01F64588C1DE7B196F4582177B7B96DAC23C5503EEFA0004DE3D6FCAAB944697A0D78DBB1ED54235663EF7E7BE9EF2747E9D58D04782AA7F7E2835B6B155FA4A96D50273CED263D681692003902D1F5500298E94F500F15DE30AE154847F04DE08C8CAE93518BD9120B596BECDB00A86C229000024299877DA9DFF5A19B98676BFC2B9959CB338B717850D3FD5F09B8C8D64F35B7D000000080000402E
ike 0:IPSec1viaPANET:5397: could not send IKE Packet(RETRANSMIT_SA_INIT):61.47.81.6:500->203.104.128.66:500, len=0, vrf=472: error 101:Network is unreachable
ike 0:IPSec1viaPANET:IPSec1viaPANET: IPsec SA connect 7 61.47.81.6->203.104.128.66:0
ike 0:IPSec1viaPANET:IPSec1viaPANET: using existing connection
ike 0:IPSec1viaPANET:IPSec1viaPANET: config found
ike 0:IPSec1viaPANET: request is on the queue
ike 0: comes 203.104.128.65:500->210.1.37.154:500,ifindex=42,vrf=0....
ike 0: IKEv2 exchange=INFORMATIONAL id=2c9f1144acb76b28/eb0c8ba53aa15b92:00000b7f len=80
ike 0: in 2C9F1144ACB76B28EB0C8BA53AA15B922E20250800000B7F00000050000000344239E5EA89AFB95E0C705DFAC6ABCAD60BF50E23A03F9EED8357875CCFF21A4C16AFF0B43EFFB42B2B16013AEDF7A181
ike 0:IPSec1viaCLSoxi:4906: dec 2C9F1144ACB76B28EB0C8BA53AA15B922E20250800000B7F0000002000000004
ike 0:IPSec1viaCLSoxi:4906: received informational request
ike 0:IPSec1viaCLSoxi:4906: enc 0F0E0D0C0B0A0908070605040302010F
ike 0:IPSec1viaCLSoxi:4906: out 2C9F1144ACB76B28EB0C8BA53AA15B922E20252000000B7F000000500000003419D40977D879AA1A57AAC998A25C27D8F6AB6A6A2F140699F743ADBC1B4307F8D15CDD23330E51BBB66ACDF64CD0D569
ike 0:IPSec1viaCLSoxi:4906: sent IKE msg (INFORMATIONAL_RESPONSE): 210.1.37.154:500->203.104.128.65:500, len=80, vrf=0, id=2c9f1144acb76b28/eb0c8ba53aa15b92:00000b7f
ike shrank heap by 159744 bytes

[sw2090]

the ony error in that log I see is this:

ike 0:IPSec1viaPANET:5397: could not send IKE Packet(SA_INIT):61.47.81.6:500->203.104.128.66:500, len=0, vrf=472: error 101:Network is unreachable

So it tries to establish the ipsec but cannot send any packets because the remote gw (203.104.128.66) is unreachable...

[kittinan]

Is it possible that my destination IP is blocked?

[gagandeeps]

Apologies for the late replies:
It could be possible that your ISP is blocking packets on port 500.

diagnose sniffer packet any 'host <dst IP address> and port 500' 4 0 l