Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 39 subscribers
  • Views 1546 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSEC Tunnels Dying After Some Time

NateP2

Hi

We have around 40 XGs deployed in Azure for our customers.  We host a solution that needs to connect back to the customer datacenter/premise to pull data over.  We have a few tunnels on various XGs that just seem to die off after a couple days.  When reviewing the strongswan.log, the CHILD_SAs rekey just fine, and then it just disappears along with about 75% of them.  The ones that are up appear to have been initiated by the other side, so it appears that the strongswan daemon just stops rekeying things until we take the tunnel down and bring it back up.

 

  • DPD messages are working
  • Seems to affect IKEv2 more/only
  • Traffic initiation from local side does not build the SA
  • Traffic initiation from remote side seems to build the SA, so it seems
  • No event of the SA being deleted, it just vanishes after the last rekey line in the strongswan.log
  • Have verified with the customer that all policy settings match
  • Have verified that the crypto map (local/remote subnets) objects match
  • Have had the Cisco admins disable SA idle-timeout.  ASAs like to remove the SAs after 30 minutes of no traffic, Sophos builds them right back possibly causing stress to strongswan.
  • Cisco admins have removed the "Bytes Lifetime" from the config (set to unlimited), since Sophos doesn't support that life type

I would contact "premium support" but they are never helpful.  Has anyone ever gotten decent help from creating a issue on the support portal?  Is this an issue with Strongswan or the implementation of it inside XG?



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi NateP2,

    We have to review strongswan logs in debug to identify the cause of the issue. 

    Command to put strongswan service in debug : service strongswan:debug -ds nosync

    Please provide the logs in debug around the time of the issue.

    Thanks,

     

  • 0 in reply to FormerMember

    I don't have one with debug enabled, but every time we turn that on, the logs are so chatty that by the time we are made aware of a VPN issue, the part of the logs we need is long gone and already rotated out.  We are working on getting syslog implemented, but not there currently.

    Is it possible to increase the log rotation history, so there are more logs on hand?  strongswan.log.0 to say... strongswan.log.10, etc.  Our UTMs have them daily for going on 7+ years now, zipped up.

     

    Thanks
    Nate

Reply
  • 0 in reply to FormerMember

    I don't have one with debug enabled, but every time we turn that on, the logs are so chatty that by the time we are made aware of a VPN issue, the part of the logs we need is long gone and already rotated out.  We are working on getting syslog implemented, but not there currently.

    Is it possible to increase the log rotation history, so there are more logs on hand?  strongswan.log.0 to say... strongswan.log.10, etc.  Our UTMs have them daily for going on 7+ years now, zipped up.

     

    Thanks
    Nate

Children
Unfiltered HTML