IPSec IKE Logging

BMS · July 2021

I have multiple VPNs set up on multiple firewalls, and they all throw logs constantly to the IKE_LOG with the following information:

The cookie pair is : 0x958dcb0ce7d072c5 / 0xe561d6849efb9191

Nothing bad is happening, but the logs are constant and these seem to be popping in every few seconds or faster. I don't know if I have a misconfiguration or if that's how the logs are supposed to look?

CHS · August 2021

The cookie pair is for identify different VPN tunnels. The cookie ID is public key for exchanging with peer site when building VPN tunnel. If your VPN tunnels are working without any problem, you can ignore this kind of log.....because it is come from VPN healthy check mechanism in phase 1 setting. (Dead Peer Detection)

BMS · August 2021

Is it normal for it to pop up every second or so per tunnel?

Zyxel_Stanley · August 2021

Hi @BMS
The VPN tunnel will have a unique cookie ID during VPN tunnel is established. As @CHS mentioned, it is for identify different VPN tunnels.
You may have a reference by this screenshot, even same source IP address, but it using for different cookie ID:

Tunnel#1: 0x5f217166560929ce(X.228.34.4.) & 0xeadfa01732e2510f(X.247.131.54)
Tunnel#2: 0x4fecef857d208395(X.228.34.4) & 0x3a6b6bcaf6d2a404(X.222.75.14)

Image: https://us.v-cdn.net/6029482/uploads/editor/yt/6fk3exwb7fwl.png

The cookie pair entries are coming from DPD function. It is happening in the same time with "R_U_There" & "R_U_There_ACK". It is connectivity check to prevent zombie tunnel.
If your tunnel without any stability issue, you can ignore this log.

IPSec IKE Logging

All Replies

Categories

Security Highlight

Security Help Center