IKE Security

beers · Jul 18, 2011

Noticed these in the logs of my 2621 WAN facing device
Quote:

Jul 15 16:37:56.569: %CRYPTO-4-IKMP_NO_SA: IKE message from 94.181.174.212 has no SA and is not an initialization offer
Jul 15 17:36:12.862: %CRYPTO-4-IKMP_NO_SA: IKE message from 95.129.137.176 has no SA and is not an initialization offer
Jul 15 17:37:22.125: %CRYPTO-4-IKMP_NO_SA: IKE message from 95.129.137.176 has no SA and is not an initialization offer
Jul 16 03:48:56.092: %CRYPTO-4-IKMP_NO_SA: IKE message from 89.254.217.176 has no SA and is not an initialization offer

Russian IPs, I'm assuming this would be some sort of IKE tunnel connection attempt? I don't have a configuration for that traffic so no worries, was just curious as what kind of vulnerabilities this would be probing for outside of an insecure VPN configuration? I'm admittedly weak in the realm of IKE/IPsec

djk11 · Jul 18, 2011

Looks like a random scan for some vuln as you suspect, probably hit your whole netblock. Who knows what they're looking for, may be thus far unreported, but clearly you're on top of your logs and they aren't connecting through to anything so no harm done.

Spooony · Jul 18, 2011

ooh a DoS attack
What router are you using? Theres a couple of unpatched stuff not fixed yet like the Cisco IOS 2921/K9 Router

IKE Security

beers

djk11

Spooony

Top Contributors this Month

Recommended Communities