CONTAP-183882：テイクオーバー/ギブバックイベント中にIKE SAの再ネゴシエーションが失敗することがある

最後の更新
PDFとして保存

Views:: 1

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: CORE

Last Updated:

問題

As part of a Takeover/Giveback event, all IKE and IPsec SAs must be renegotiated in a short period of time.This can overwhelm the system and lead to SA negotiation timeouts.
Fast retry logic, which was introduced to address some SA negotiation corner cases, can exacerbate the situation.
With fast retry logic enabled, the charon log will contain log entries similar to those below:[[MGR] checkout_by_message() IKE_SA not found with SPIs ******_i ******_r.][[NET]process_message_job.c: Fast recovery logic, looking for peer configs matching **** to **** for any identity.]
[[MGR]ike_sa_manager.c:create_new() IKEv2 SA with SPIs *****.]
[[NET]process_message_job.c: Applying fast recovery logic to new IKE SA.]
[[IKE] initiating IKE_SA ***** to ******.]