Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 15 replies
  • Answers 2 answers
  • Subscribers 29 subscribers
  • Views 36348 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site to Site ipsec

ViciousMagician1116

Main XG has bee updated for about a week.  2 remote site Xg's both were on SFOS 17.0.3 MR-3.  I just updated one of them to SFOS 17.0.6 MR-6.  After the update to 1706 it will not connect its vpn anymore.

I see this in the log:  received IKE message with invalid SPI (646753DB) from other side  The other one that is on 1703 is still connected to the ipsec vpn.  



This thread was automatically locked due to age.
Parents
  • 0

    Hey  

    I would advise to schedule downtime and upgrade the rest of your XG firewall appliances to SFOS 17.0.6 MR-6 for consistency among the tunnels. Please let me know if you still experience issues after performing this. 

    Regards,

    FloSupport | Community Support Engineer

  • 0 in reply to FloSupport

    Im afraid to upgrade the other one (only have 3) since i can't get this one to make a tunnel at all.

    I have made a new copy of the defaultHeadOffice and defaultremoteoffice ipsec profiles edited the weaker security in them make sure they matched on both the Main XG and the remote XG.  Assigned each one to the tunnel.  Still no go. Even rebooted both XG units and nothing. 

     

     

  • 0 in reply to ViciousMagician1116

    Did you delete the old IPsec connection completely and create a new one? What log messages are being generated?

    Regards,

    FloSupport | Community Support Engineer

  • 0 in reply to ViciousMagician1116

    You do not need to be afraid. Just upgrade them and if it does not work you can rollback to the other firmware. ;)

  • 0 in reply to FloSupport

    I tried to make a copy and also delete the connection at both XG's.  Even tried using new keys.  They will not connect anymore.  I also tried to roll the remote XG back to 1703 and it will not connect like that either.  

     

    What logs should I be looking at?  In the System Log I see this:  peer did not respond to initial message 31 followed by parsing IKE message from 123.123.123.123[500] failed

  • 0 in reply to ViciousMagician1116

    I tried using the wizard to create new connection on each end, still fails with the same message.  

  • 0 in reply to ViciousMagician1116

    Try the following:

    1. Upgrade both appliances to MR6
    2. Delete all VPN profiles
    3. Make custom IKEv2 policies out of the default ones with only one crypt setting in each phase
      1. Make sure that DPD times are the same on both sites except one should be set to initiate and the other to disconnect
      2. Make sure that the Key Negotiation Tries are set to 0 on the initiating site.
    4. Recreate the VPN policies
      1. Make sure the PSK matches
      2. Make sure that networks are matching just the other way round.
      3. Make sure to set the Gateway Address if possible on both sites

    With these settings I was able to get IPsec connections running stable. I hope that helps you.

  • 0 in reply to Charmacas

    Both of these are fully upgraded.

    I tried this before but I did it again from scratch.  Copied the ikev2 to a new policy on each xg and edited it just as you said, only 1 algorithm per phase.  Remote site is set to 0 Key tries - Head Office set to 3.  DPD the remote is re-initiate - Head office is disconnect.  Everything else matches in the ipsec policy.  

    Now when i activate the connection on each end i get this in the log:  creating local authentication data failed

Reply
  • 0 in reply to Charmacas

    Both of these are fully upgraded.

    I tried this before but I did it again from scratch.  Copied the ikev2 to a new policy on each xg and edited it just as you said, only 1 algorithm per phase.  Remote site is set to 0 Key tries - Head Office set to 3.  DPD the remote is re-initiate - Head office is disconnect.  Everything else matches in the ipsec policy.  

    Now when i activate the connection on each end i get this in the log:  creating local authentication data failed

Children