Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 13 replies
  • Subscribers 3 subscribers
  • Views 18396 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN Verbindung bricht einmal am Tag ab.

Enigma81

VPN Verbindung bricht einmal am Tag ab. Ich habe daheim eine Fritzbox und die Sophos.  VPN Verbindung steht. Einmal am Tag bricht die Verbindung ab. Und ich muss nur die Connections einmal schliessen und dann wieder einschalten und schon geht wieder alles.



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to Enigma81

    Es gibt eine DPD (DPT) Option (Dead Peer Detection), damit die UTM erkennt ob die Gegenstelle noch aktiv ist. Steht das VPN der UTM auf initiieren ... Ich kann es abkürzen, in dem ich meine Frage von oben frei zitiere: Wie ist das VPN konfiguriert und was steht in den Logs?

Children
  • 0 in reply to K.N.

    Jup DPD ist aktive.

    Gatewaytype: Initiate connection

    Authentication type: RSA Key

    logs muss ich morgen erst schauen wenn es nicht mehr geht.

  • 0 in reply to Enigma81

    Hab jetzt mal geschaut,


    hier das Log wo es meiner Meinung nach nicht mehr funktioniert

    IPsec SA established {ESP=>0xe1adea20 <0x6abbda8c NATOA=0.0.0.0 DPD}
2016:06:25-02:19:22 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_0" #121: responding to Quick Mode
2016:06:25-02:19:22 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_0" #121: IPsec SA established {ESP=>0x8b838dc8 <0x024f3d77 NATOA=0.0.0.0 DPD}
2016:06:25-02:26:47 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_1" #122: responding to Quick Mode
2016:06:25-02:26:47 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_1" #122: IPsec SA established {ESP=>0x0fff24b5 <0x439b8ef0 NATOA=0.0.0.0 DPD}
2016:06:25-02:28:30 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #116: received Delete SA(0xb686dc2e) payload: deleting IPSEC State #115
2016:06:25-02:30:22 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #123: responding to Quick Mode
2016:06:25-02:30:22 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #123: IPsec SA established {ESP=>0xddd8276c <0xd3576360 NATOA=0.0.0.0 DPD}
2016:06:25-02:34:17 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #116: ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0xf4ebd6fa) not found (maybe expired)
2016:06:25-02:39:33 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #116: ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0xfd45d0d7) not found (maybe expired)
2016:06:25-02:43:45 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #116: ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0xb3c758ad) not found (maybe expired)
2016:06:25-03:02:39 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_2" #124: responding to Quick Mode
2016:06:25-03:02:39 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_2" #124: IPsec SA established {ESP=>0x7757299b <0x69a396ff NATOA=0.0.0.0 DPD}
2016:06:25-03:05:40 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_0" #114: DPD: Phase1 state #114 has been superseded by #116 - timeout ignored
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #116: DPD: No response from peer - declaring peer dead
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #116: DPD: Restarting all connections of peer
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #116: DPD: Terminating all SAs using this connection
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #123: deleting state (STATE_QUICK_R2)
2016:06:25-03:05:56 schweiger-utm pluto[29152]: id="2204" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN down" variant="ipsec" connection="REF_IpsSitTcgeo" address="192.168.150.1" local_net="192.168.150.0/24" remote_net="172.18.136.0/21"
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #116: deleting state (STATE_MAIN_R3)
2016:06:25-03:05:56 schweiger-utm pluto[29152]: DPD: Restarting connection "S_REF_IpsSitTcgeo_3"
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_2": DPD: Terminating all SAs using this connection
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_2" #124: deleting state (STATE_QUICK_R2)
2016:06:25-03:05:56 schweiger-utm pluto[29152]: id="2204" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN down" variant="ipsec" connection="REF_IpsSitTcgeo" address="192.168.150.1" local_net="192.168.150.0/24" remote_net="172.18.0.0/18"
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_2" #120: deleting state (STATE_QUICK_R2)
2016:06:25-03:05:56 schweiger-utm pluto[29152]: DPD: Restarting connection "S_REF_IpsSitTcgeo_2"
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_1": DPD: Terminating all SAs using this connection
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_1" #122: deleting state (STATE_QUICK_R2)
2016:06:25-03:05:56 schweiger-utm pluto[29152]: id="2204" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN down" variant="ipsec" connection="REF_IpsSitTcgeo" address="192.168.150.1" local_net="192.168.150.0/24" remote_net="172.17.136.0/21"
2016:06:25-03:05:56 schweiger-utm pluto[29152]: DPD: Restarting connection "S_REF_IpsSitTcgeo_1"
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_0": DPD: Terminating all SAs using this connection
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_0" #121: deleting state (STATE_QUICK_R2)
2016:06:25-03:05:56 schweiger-utm pluto[29152]: id="2204" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN down" variant="ipsec" connection="REF_IpsSitTcgeo" address="192.168.150.1" local_net="192.168.150.0/24" remote_net="172.17.0.0/18"
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_0" #114: deleting state (STATE_MAIN_I4)
2016:06:25-03:05:56 schweiger-utm pluto[29152]: DPD: Restarting connection "S_REF_IpsSitTcgeo_0"
2016:06:25-03:05:56 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #125: initiating Main Mode
2016:06:25-03:19:07 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #125: max number of retransmissions (20) reached STATE_MAIN_I1.  No response (or no acceptable response) to our first IKE message
2016:06:25-03:19:07 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #125: starting keying attempt 2 of an unlimited number
2016:06:25-03:19:07 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #126: initiating Main Mode to replace #125
2016:06:25-03:32:17 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #126: max number of retransmissions (20) reached STATE_MAIN_I1.  No response (or no acceptable response) to our first IKE message
2016:06:25-03:32:17 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #126: starting keying attempt 3 of an unlimited number
2016:06:25-03:32:17 schweiger-utm pluto[29152]: "S_REF_IpsSitTcgeo_3" #127: initiating Main Mode to replace #126
  • 0 in reply to Enigma81

    Du könntest testweise das (Interface und Routing) Uplinkmonitoring aktivieren. Dazu brauchst Du eine erreichbare IP-Adresse im Netz hinter der Fritzbox als Bedingung und als Aktion den Neustart des S2S VPNs.

  • 0 in reply to K.N.

    Hallo zusammen,

    ich hänge mich hier mal mit dran. Bei uns haben wir derzeit das gleiche Problem.

    Ein VPN-Tunnel bricht einmal am Tag ab (vorzugsweise nachts) wobei es durch den ISP keine Zwangstrennung gibt.

    Wir haben mittlerweile festgestellt, dass nach Deaktivierung und Wiederaktivierung des erweiterten Debuggings (IKE-Fehlersuche) der Tunnel wieder aufgebaut wird.

    Evtl. liegt es einer der letzten Firmwareänderungen???

    Gruß

    Frank

  • 0 in reply to FrankDiedrich

    MMMhhhh... heute kam ja zum Glück ein Update... vielleicht hilft das ja

  • 0 in reply to Enigma81

    Wird zur Zeit aufgespielt. Wir werden sehen.

    Es soll wohl wirklich an der letzten Firmware gelegen habe.

  • 0 in reply to FrankDiedrich

    Woher hast du die Info das es an der Firmware lag?

    Ich hoffe es... aber weil es nervt

  • 0 in reply to Enigma81

    Ich hoffe es einfach mal. FW wurde runtergeladen und wird heute Nacht installiert:

    Up2Date 9.404005 package description:
    Remarks:
     System will be rebooted
     Configuration will be upgraded
     Connected REDs will perform firmware upgrade
     Connected Wifi APs will perform firmware upgrade
    News:
     Maintenance Release
    Bugfixes:
     Fix [NUTM-1775]: [Access & Identity] 35668: DHCP Broadcast over all RED LAN ports causing wrong IP address assignment
     Fix [NUTM-1784]: [Access & Identity] implement "TLS 1.2 only" switch for RED to UTM communication
     Fix [NUTM-2404]: [Access & Identity] 36172: RED15 has loaded fallback network config
     Fix [NUTM-2841]: [Access & Identity] 36224: WARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_expect.c:51 nf_ct_unlink_expect_report+0x5e/0xd1 [nf_conntrack]()
     Fix [NUTM-3415]: [Access & Identity] PPTP VPN with an IP Pool 172.16.0.0/20 doesn't work correctly
     Fix [NUTM-3439]: [Access & Identity] After upgrade to 9.4 and using SSL VPN the IPv4 traffic is not going over the full tunnel
     Fix [NUTM-3536]: [Access & Identity] RED15 traffic not possible, red_server reports "Unable to get proc entry"
     Fix [NUTM-3719]: [Access & Identity] mdw errors when configuring a RED device
     Fix [NUTM-3735]: [Access & Identity] SSL VPN IP pool should not be usable without IPv4
     Fix [NUTM-3757]: [Access & Identity] SSL VPN: don't push IPv6 interface address if no IPv6 route is pushed
     Fix [NUTM-3763]: [Access & Identity] SSL VPN client cannot be downloaded from userportal with IE
     Fix [NUTM-3843]: [Access & Identity] SSL VPN route injection into OSPF not working properly after update to 9.4
     Fix [NUTM-3867]: [Access & Identity] SMC: WEP passwords are not pushed correctly
     Fix [NUTM-3924]: [Access & Identity] PPTP and iOS with config from userportal doesn't work properly
     Fix [NUTM-3934]: [Access & Identity] RED: CON_CLOSE provide information to UTM if peer is not stable enough
     Fix [NUTM-3962]: [Access & Identity] IPsec doesn't work with SHA2
     Fix [NUTM-4173]: [Access & Identity] Since Update to 9.4 IPsec site-to-site connections won't work after pppoe reconnect
     Fix [NUTM-3982]: [Basesystem] Errors in Notifications Database
     Fix [NUTM-2677]: [HA/Cluster] 36293: The Slave node in HA doesn't show any resource usage
     Fix [NUTM-2235]: [Network] 35662: Additional adresses of a PPPoE interface are not reachable after takeover
     Fix [NUTM-3684]: [Network] APN can't be changed if LTE is selected as network
     Fix [NUTM-3061]: [Reporting] Remote Access filtering is not working correctly if the username contains a "\" sign
     Fix [NUTM-3662]: [Reporting] wrong descriptions for CRIT-065 and INFO-007 in MIB file
     Fix [NUTM-3753]: [Reporting] Remote Access Accounting not recording L2TP sessions
     Fix [NUTM-4306]: [Reporting] postgres[xxxxx]: [x-x] STATEMENT: select src_ip, virt_ip, virt_ip6, logintime, service from vpn where status = 0 and logintime = logouttime LIMIT 1000
     Fix [NUTM-3689]: [SUM] device agent claims SUM objects
     Fix [NUTM-3028]: [Virtualization] HyperV interface handling (9.4)
     Fix [NUTM-3482]: [WAF] form template unchanged with update from 9.355 to 9.4
     Fix [NUTM-3694]: [WAF] Customized mod_security rule didn't work correctly
     Fix [NUTM-3748]: [WAF] Content length and content get lost when using form-harding
     Fix [NUTM-4119]: [WAF] SSL is not used to transfer sticky session cookies
     Fix [NUTM-3172]: [WebAdmin] Support tools - PPPoE shows itfhw instead of vlantag
     Fix [NUTM-3113]: [Web] Proxy freeze after Savi update
     Fix [NUTM-3118]: [Web] "Remove embedded objects" / "Disable JavaScript" shows script code
     Fix [NUTM-3367]: [Web] "Unblock URL" button is displayed even when "Users/Groups Allowed to Bypass Blocking" is empty
     Fix [NUTM-3485]: [Web] HTTP Proxy profile matching doesn't work for DNS groups which contain IPv6 addresses
     Fix [NUTM-3550]: [Web] frox segfaults/core dumps while uploading files
     Fix [NUTM-3554]: [Web] Error returned from samba command on AD sync
     Fix [NUTM-3617]: [Web] Sandstorm Database Error
     Fix [NUTM-3710]: [Web] New exception regex for Chrome Update
     Fix [NUTM-3844]: [Web] If using a ' character in file name, postgres is not able to insert this to the TransactionLog (Sandbox)
     Fix [NUTM-3920]: [Web] Sandbox: cleaning up old data in TransactionLog on slave nodes raises postgres errors
     Fix [NUTM-4055]: [Web] HTTP Proxy causing weird log entries in uma.log
     Fix [NUTM-3039]: [WiFi] RADIUS authentication failover via Availability Group not working correctly
     Fix [NUTM-3072]: [WiFi] Hotspot: race condition if multiple logins per MAC
     Fix [NUTM-3472]: [WiFi] wireless.log - download_ca: CA fingerprint overwritten by TA / No trusted fingerprint found in certificate chain HUB.
     Fix [NUTM-3760]: [WiFi] WIFI profile pushed to SMC using same name
     Fix [NUTM-4117]: [WiFi] Mesh AP's all go down and do not come back up
     Fix [NUTM-4151]: [WiFi] AP30 (possibly other models) not becoming active anymore after update to >= 9.400
     Fix [NUTM-4126]: [[Backend/Devel] Confd] Clean up of duplicate Domain-Regex
     Fix [NUTM-4142]: [[Backend/Devel] Confd] Remote Access Manager can't deactivate a VPN profile with groups
     Fix [NUTM-4158]: [[Backend/Devel] Confd] confd[xxx]: parse_formats: unrecognized tag format: FUNC__XXX
     Fix [NUTM-4160]: [[Backend/Devel] Confd] Accessing WebAdmin as non-superuser repeatedly raises "NODE_READ_DENIED" error on confd node "migration->tab_visibility"
  • 0 in reply to FrankDiedrich

    Hallo zusammen,

    so, ich kann berichten, dass das Firmwareupdate das Problem bei uns gelöst hat.

    Schnelle Reaktion seitens Sophos [:D]

    Gruß

    Frank

  • 0 in reply to FrankDiedrich

    "Schnell" ist relativ:

    NUTM-4173 [Access & Identity] Since Update to 9.4 IPsec site-to-site connections won't work after pppoe reconnect

    Da waren vier Patches dazwischen.

    Ein lesender Zugriff auf den Bugtracker wäre auch mal net ...

Cookie Information Banner