Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 2 replies
  • Subscribers 39 subscribers
  • Views 2432 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSLVPN taking too long to reconnect the vpn tunnel

JavierFelip

Hello,

We are having some problems with our vpn tunnels and we would really appreciate any help.

We have a central central unit (XG 135) in headquarters. And we have different offices working with XG 85 and RED devices.

The XG 85 are configured against the central unit with SSL VPN Site to Site.

The problem is that sometimes, we are forced to restart our central unit (XG 135) or even internet router in the headquarters, when we do it, the vpn tunnels go down (obviously), but here is where the problems begin.

As soon as the central unit is back to work and the connection is restablished, the RED devices reconnect quickly the tunnels, this is perfect, but it doesn´t happen with the XG85 devices which are configured with SSL VPN Site to Site. Sometimes they take even 2 or 3 hours to reconnect.

I have seen that when you configure IPSEC Site to Site VPNs, you are able to apply IPSEC policies which allows you to force the reconnection every X minutes since the peer is down.

My query is:

Is there any way to force a VPN reconnection with SSL VPN (Site to Site) configuration so that the tunnel is restablished more quickly?

Otherwise, can you confirm that using IPSEC Site to Site with IPSEC instead of SSL VPN Site to Site, is a correct way to force a quick reconnection?

 

Thanks in advance.



This thread was automatically locked due to age.
Parents
  • +1

    Hi  

    There's no provision in SSL VPN Site-to-Site to for a reconnection attempt or timeout. I would suggest creating a site-to-site RED tunnel between Head Office and Branch office XG devices.

     PS: I have moved your post to the XG forum.

    Regards

    Jaydeep

  • 0 in reply to Jaydeep

    I have the same challenges with SSL - with a large estate with many firewalls, it's not easy just to change it over to RED site to site.

    How is the reconnection time determined? There must be something on the endpoints that forces them to reconnect after a period - as JavierFelip said, they do eventually reconnect after 2-3 hours (random times per endpoint). Can we not ask the dev team to decrease this timeout period in a future firmware build?

Reply
  • 0 in reply to Jaydeep

    I have the same challenges with SSL - with a large estate with many firewalls, it's not easy just to change it over to RED site to site.

    How is the reconnection time determined? There must be something on the endpoints that forces them to reconnect after a period - as JavierFelip said, they do eventually reconnect after 2-3 hours (random times per endpoint). Can we not ask the dev team to decrease this timeout period in a future firmware build?

Children
No Data
Unfiltered HTML