IPSec IKE Logging

BMS Posts: 21
Second Anniversary
 Freshman Member
I have multiple VPNs set up on multiple firewalls, and they all throw logs constantly to the IKE_LOG with the following information:

     The cookie pair is : 0x958dcb0ce7d072c5 / 0xe561d6849efb9191

Nothing bad is happening, but the logs are constant and these seem to be popping in every few seconds or faster.  I don't know if I have a misconfiguration or if that's how the logs are supposed to look?

All Replies

  • CHS
    CHS Posts: 172
    5 Answers First Comment Friend Collector Fifth Anniversary
     Master Member
    The cookie pair is for identify different VPN tunnels. The cookie ID is public key for exchanging with peer site when building VPN tunnel. If your VPN tunnels are working without any problem, you can ignore this kind of log.....because it is come from VPN healthy check mechanism in phase 1 setting. (Dead Peer Detection)
  • BMS
    BMS Posts: 21
    Second Anniversary
     Freshman Member
    Is it normal for it to pop up every second or so per tunnel?
  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,299
    100 Answers 1000 Comments Friend Collector Sixth Anniversary
     Zyxel Employee
    Hi @BMS
    The VPN tunnel will have a unique cookie ID during VPN tunnel is established. As @CHS mentioned, it is for identify different VPN tunnels.
    You may have a reference by this screenshot, even same source IP address, but it using for different cookie ID:
    Tunnel#1: 0x5f217166560929ce(X.228.34.4.) & 0xeadfa01732e2510f(X.247.131.54)
    Tunnel#2: 0x4fecef857d208395(X.228.34.4) & 0x3a6b6bcaf6d2a404(X.222.75.14)

    The cookie pair entries are coming from DPD function. It is happening in the same time with "R_U_There" & "R_U_There_ACK". It is connectivity check to prevent zombie tunnel.
    If your tunnel without any stability issue, you can ignore this log.

Security Highlight