Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 13 replies
  • Answers 1 answer
  • Subscribers 41 subscribers
  • Views 1744 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSec connections go down very slowly

Anthony Anderson

Is there something other than the gateway monitoring that takes a tunnel down? 

I ask because my device (SFOS 18.5.3 MR-3-Build408) has two tunnels, a primary and a backup, to another XG(SFOS 18.0.5 MR-5-Build586).

Connection type: Tunnel Mode

XFRMs: configured as a /30 

Gateway Monitoring: pinging the other end of the tunnel's XFRM(the other /30) 

Heres my health check settings:

Problem is when I pull my WAN1 cable, the WAN link monitoring takes it down and the Gateway monitoring registers the 10.210.153.197 as unpingable on the other side of the tunnel BUT the IPsec connection keeps that tunnels "Connected" state green for nearly 2 minutes and 40 seconds before it finally takes it down. That's way to long to wait for tunnel traffic to resume. 

Does anyone have any ideas for this issue to bring the tunnel down faster? 



This thread was automatically locked due to age.
Parents
  • 0

    Could you use SD-WAN instead? It's more developed under v19, but might do the job in 18.5. Just trying to think outside of the box.

  • 0 in reply to Wayne Folta

    I did that. It should switch to the other tunnel as soon as the primary gateway goes down which is about 5-10 seconds but it actually will not until the tunnel itself turns red which takes about 2:40.

  • 0 in reply to Anthony Anderson

    In v19, using the quality-based SD-WAN, it should switch based on pings/lag so it should not care about a tunnel being up or down or gateways at all. If you have the chance to try v19, it might not have the issue and it might allow SD-WAN to reroute when the pings stop rather than when something else causes something to go down.

    (I have to admit that I'm confused by the whole tunnel thing. The only tunnel I've used is a 6in4 tunnel and there's no gateway associated with it. I can make one, but it doesn't make any difference to the traffic or anything else as far as I can tell. Then again, that kind of tunnel isn't "up" or "down".)

  • 0 in reply to Wayne Folta

    Thanks Wayne, I will give 19 a try

  • 0 in reply to Anthony Anderson

    Upgraded to V19. Connected my tunnels and pulled WAN1. My gateways(WAN1 and Tunnel) went down but my tunnel stayed Green. This is a real problem. 

  • 0 in reply to Anthony Anderson

    You can configure when the gateway should turn RED. This has nothing to do with the XFRM interface. 

    So basically if this check will result in a RED state, SD-WAN will not use this interface anymore. 

    You change this check in the profile to some host behind your tunnel (or the XFRM Interface IP of the other end). 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    I configured my SDWAN profile just as you did above. Here is what happened:

    1. Constant ping to LAN address of the COLO Sophos LAN IP started and pinging normally. 

    2. Pulled my WAN1. 

    3. Pings stop. 

    4. SDWAN policy group shows Tun1 gateway is Red and Secondary gateway is Green with checkmark(in use)

    5. Tunnels remain green like so:

    6.Try to manually bring down Tun1 by clicking the "Connection" green light - get long wait spinner in the middle of the screen and then an error

    7. Try to click the "Connection" button of Tun1 again - get long wait spinner in the middle of the screen and thenthe same error about cant connect to the interface 

    8. Try clicking "Active" to deactivate completely - get long wait spinner in the middle of the screen and then then a yellow box says this will take some time to complete and you can check the log file. 

    9. Finally the tunnel goes to red/red and I can resume pinging the COLO Sophos LAN IP.

    This is a bug. It's keeping the tunnel up and the traffic is not correctly tied to gateway state but rather the "Active/Connection" state of the tunnels being green/green, green/red. or red/red. Whatever module in the os is determining that state seems to be controlling traffic flow, not the gateway monitor. 

    The following screenshots were taken simultaneously:

    1. The gateway is down still cant ping across the tunnel even though it should be using the secondary tunnel for ICMP traffic

    2. 

    Tunnels stay green for approx 2:40 seconds

    3.

    Tunnel connection finally turns red and instantly pings resume. 

     

  • 0 in reply to Anthony Anderson

    Ignore the Tunnel. 

    Use the SD-WAN Policy. This should be way faster RED. How long does the SD-WAN Policy need to switch? 

    BTW: Ping is actually hard to check for SD-WAN, as it is stateless. Try using a TCP/UDP Protocol. 

    BTW: You can configure the DPD (Dead peer Detection) within the IPsec Profile. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    The SDWAN Policy switches within seconds. Id say 3 seconds. 

    Also my DPD is 10/25/reinitiate. 

    I've got a plan for the TCP/UDP test ill report back after the test. 

Reply Children
No Data
Unfiltered HTML