Re: Anyone know what esp sequence fail means

If you have a CCO login you can put this command into the output
interpreter and it will tell you why you have received this error and
what you can do about. I run this output through and got some good
stuff. I don't think I can post it here.

The jist of the error is that a packet arrived out of sequence and
(sometimes this is natural) other times it means you have QoS
reordering the packets before IPSec gets its hands on the packets and
the anti-replay feature of IPSec is dropping the packet.

.

Relevant Pages

  • Re: best encryption + mode for network packets ?
    ... > I don't understand much about all the different encryption modes... ... The IPSEC design deals with many issues ... that the chaining modes typically require an unpredictable but non-secret ... start of the packet they've just received, ...
    (sci.crypt)
  • enc0 patch for ipsec
    ... This is a device to expose packets going in/out of ipsec and comes ... and handoff to pfilfor packet filtering. ... the extra work is only done when the enc0 interface is created. ...
    (freebsd-arch)
  • enc0 patch for ipsec
    ... This is a device to expose packets going in/out of ipsec and comes ... and handoff to pfilfor packet filtering. ... the extra work is only done when the enc0 interface is created. ...
    (freebsd-net)
  • Re: Lost/dropped datagram when sending UDP/IPv6 message over IPsec - Solaris bug?
    ... sending UDP/IPv6 over IPsec. ... It has something to do with fragmentation: ... I see the ICMP in a dtrace script as dropped incoming ... is called causing dropping packet and generating the ICMP. ...
    (comp.unix.solaris)
  • [patch] Path MTU Discovery when routing over IPSec connections
    ... I have been looking into some problems with PMTU Discovery when routing packets over IPSec tunnels, I have submitted the details to the open PR kern/91412 but have had no response as to whether my patch is the correct solution to the problem. ... Triggered when a packet that is to be routed over the IPSec link is larger than the MTU on the link and has the Don't Fragment bit set. ... Vr HL TOS Len ID Flg off TTL Pro cks Src Dst ...
    (freebsd-hackers)