Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 27 subscribers
  • Views 748 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPsec tunnels up but XFRM Gateways not pinging

Anthony Anderson

Hello, 

Just some config info on this to start out with. The device is and XG on 18.5.1. We have IPsec tunnels with Tunnel Interfaces on a /30 network, routes being distributed via OSPF. Great setup, never had any problems at all, until this morning. 

The tunnel was up and connected but on the gateways page of my XG the tunnel gateway wasn't pinging and the tunnel wasnt passing traffic. 

Both ends of the tunnel were up and green. 

Once I shut down the tunnels and brought them back up the gateways began pinging again and S2S traffic resumed. 

Nothing meaningful in logs and I'm just wondering why the gateway would have stopped pinging. 

We dont use re-keying on this tunnel. Is it possible a middle man attack took place or something else anyone can think of?



This thread was automatically locked due to age.
Parents
  • 0

    we have the same issue with XGS on 18.5.2
    We use site-to-site VPN with the rekeying
    It happens every week or second week, VPN go down and automatically up and they are all green but no traffic over VPN.

    I have checked the logs and console commands:
    ipsec statusall
    ip xfrm state

    Same problem with IKEv1 and IKEv2

    Details from StatusAll:
    Status of IKE charon daemon (strongSwan 5.5.3, Linux 4.14.38, x86_64)
    IKE proposal: AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/CURVE_25519

    Details from XFRM state:
    SRC and DST keys are the same

Reply
  • 0

    we have the same issue with XGS on 18.5.2
    We use site-to-site VPN with the rekeying
    It happens every week or second week, VPN go down and automatically up and they are all green but no traffic over VPN.

    I have checked the logs and console commands:
    ipsec statusall
    ip xfrm state

    Same problem with IKEv1 and IKEv2

    Details from StatusAll:
    Status of IKE charon daemon (strongSwan 5.5.3, Linux 4.14.38, x86_64)
    IKE proposal: AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/CURVE_25519

    Details from XFRM state:
    SRC and DST keys are the same

Children
No Data
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?