EoIP Log Entries explanation requested

RouterOS General
1

Having recently set up EoIP, I’m curious about the regular log entries (below).

Is this normal? Should I change the timeout/retries in the EoIP tunnel configs (they are now the default 10 seconds/10 retries)?

 04-02 21:21:03 ipsec,info ISAKMP-SA dying 100.38.xxx.xxx[500]-67.245.xxx.xxx[500] spi:xxxxxxx:xxxx
 04-02 21:21:04 ipsec,info respond new phase 1 (Identity Protection): 100.38.xxxx.xxx[500]<=>67.245.xxx.xxx[500]
 04-02 21:21:04 ipsec,info ISAKMP-SA established 100.38.xxx.xxx[500]-67.245.xxx.xxx[500] spi:xxxxxx:xxxx


 04-02 21:47:48 ipsec,info ISAKMP-SA dying 100.38.xxx.xxx[500]-69.xxx.xxx.xxx[500] spi:xxxx:xxxx
 04-02 21:47:48 ipsec,info initiate new phase 1 (Identity Protection): 100.38.xxx.xxx[500]<=>69.xxx.xxx.xxx[500]
 04-02 21:47:48 ipsec,info ISAKMP-SA established 100.38.xxx.xxx[500]-69.xxx.xxx.xxx[500] spi:xxxxx:xxxx

 04-02 22:04:24 ipsec,info ISAKMP-SA deleted 100.38.xxx.xxx[500]-67.245.xxx.xxx[500] spi:xxxxx:xxxx rekey:1
 04-02 22:04:41 ipsec,info ISAKMP-SA deleted 100.38.xxx.xxx[500]-24.168.xxx.xxx[500] spi:xxx:xxxx rekey:1
 04-02 22:04:44 ipsec,info ISAKMP-SA deleted 100.38.xxx.xxx[4500]-69.xxx.xxx.xxx[4500] spi:xxxx:xxxx rekey:1

 00:29:56 ipsec,info ISAKMP-SA dying 100.38.xxx.xxx[4500]-69.xxx.xxx.xxx[4500] spi:xxxx:xxxx
 00:29:56 ipsec,info respond new phase 1 (Identity Protection): 100.38.xxx.xxx[4500]<=>69.xxx.xxx.xxx[4500]
 00:29:57 ipsec,info ISAKMP-SA established 100.38.xxx.xxx[4500]-69.xxx.xxx.xxx[4500] spi:xxxx:xxxx

 02:09:03 ipsec,info ISAKMP-SA deleted 100.38.xxx.xxx[500]-67.245.xxx.xxx[500] spi:xxxx:xxxx rekey:1
 02:35:48 ipsec,info ISAKMP-SA deleted 100.38.xxx.xxx[500]-69.xxx.xxx.xxx[500] spi:xxxxx:xxxx rekey:1

 04:10:10 ipsec,info the packet is retransmitted by 67.245.xxx.xxx[500].
 
 05:17:56 ipsec,info ISAKMP-SA deleted 100.38.xxx.xxx[4500]-69.xxx.xxx.xxx[4500] spi:xxxx:xxxx rekey:1
 05:46:11 ipsec,info the packet is retransmitted by 67.245.xxx.xxx[500].
2

I’d say it’s normal. I see similar stuff on my IPIP links (it also uses IPsec under the hood).

3

Great, thank you.

Now I’ve got to go and google IPIP – so I can have a clue (:wink: