This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

v18 MR-3 IPsec unstable with SWDAN

Carlos Cesario over 3 years ago

Hello, Im running v18 MR-3 over 5 days and Im having a serious problem.

Currently we have a Ipsec tunnel established and working.

I have created a SDWAN rule to direct my traffic to internet using my WAN interface

and I have configured the route precedence to

Routing Precedence:
1. VPN routes
2. Static routes
3. SD-WAN policy routes

The traffic From HO to Bo over ipsec interface it works correctly, but in random momments some hosts from BO Lan when try access hosts to HO Lan has the access interruped.

With a little troubleshooting I could check that in this momment the Hosts from BO try access the hosts to HO over WAN interface, even the ipsec tunnel is UP and other hosts from the same subnet BO LAN is working over IPSEC tunnel.

It seems that route precedence stop to works and redicrect the traffic over SDWAN rule.

Does someone has any experience like this!?

Regards

Carlos

This thread was automatically locked due to age.

Top Replies

Carlos Cesario over 3 years ago +1 suggested

Hi Folks, only to report. This problem does not happen with the IPSEC Tunnels are connected by "Tunnel Mode" and using BGP for routing protocol. When I changed my environment using this, replaced Site…

0 Carlos Cesario over 3 years ago

#ipsec status
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to Carlos Cesario

In case of this issue, if this appears, can you generate a ipsec status?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Cesario over 3 years ago in reply to LuCar Toni

Hi LuCar Toni

I will check it and post here.
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Cesario over 3 years ago in reply to LuCar Toni

LuCar Toni

Look this

look that the traffic are trying outgoing by interface Port2_ppp (my Wan interface)

# ipsec status

In this same momment

You can see that there is traffic over Ipsec tunnel

Regards

Carlos
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to Carlos Cesario

Does this only appear on MR3 and worked fine in MR1?

The SAs looks way less compared to the SAs on the first screenshots. Did you work on this one?

Is any NAT involved?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Cesario over 3 years ago in reply to LuCar Toni

In MR1 this problem does not happing. I have the same topology and config with other customer.

This "ipsec status" is from other BO peer, it has less routes.

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Cesario over 3 years ago in reply to Carlos Cesario

Only to report.

In one BO peer I have disabled the SDWAN today rule and this bad behaivor does not happened more
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 3 years ago in reply to Carlos Cesario

Will try to recreate this issue in my installations. Let me test some stuff and i will get back to this thread.

In the mine while, would recommend to open a case, that this can be tracked.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Cesario over 3 years ago in reply to LuCar Toni

Hi LuCar Toni

Thank you by feedback.

I will open a case for this

regards

Carlos
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Cesario over 3 years ago

Hi Folks, only to report.

This problem does not happen with the IPSEC Tunnels are connected by "Tunnel Mode" and using BGP for routing protocol.

When I changed my environment using this, replaced Site-To-Site tunnel to Tunel Mode iPsec VPNs and put BGP to do the routing, the SWDAN it works as expected.

Regards

Carlos
Cancel
Vote Up +1 Vote Down

Cancel