This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSec VPN Not Loading

Hey all,

I've recently done a fresh UTM 9 install into my VMWare environment and run into an issue with the IPSec VPN for a site to site link.

I'm using certificate based IPSec due to a dynamic IP on one end, the VPN tunnel came up ok last night and was working this morning till some the service's IP changed. I fixed up the dyndns on the remote end and the tunnel came up ok but then dropped after a few minutes. Looking in the Astaro logs it simply said that pluto had shut down.

I turned that tunnel off and on via both the Astaro and the remote end (note that the remote end is servicing other IPSec tunnels without issue) and recreated the configuration on the Astaro end and it just doesn't do anything. Nothing comes up in the IPSec logs.

Tried a restart of the unit and again nothing started up. My final solution was to roll back to an earlier config and reboot which brought it online. However the same issue has happened again which doesn't make any sense. Nothing appears in the logs and it just doesn't start the tunnel.

It doesn't even list it as trying within the interface (Site to Site VPN main heading). It simply lists "There is no Site-to-site VPN status information available". When it was down this morning at least it showed that there was a tunnel there but down.

Has anyone come across this? I really don't want to have to keep restoring the config and rebooting to fix it but I am a little confused as to why it is failing in this way.

This thread was automatically locked due to age.

Parents

0 claymen over 13 years ago

IPS is turned off at this stage and nothing in there at all.

Basically I can restore my config to the automatic backup at 1am before it went strange and it works for a short period then stops. When I was initially testing I thought it was a change I had made as I was working on some firewall rules and adjusting dyndns hence rolling it back initially. However when it happened again I started to get a little concerned.

In that log excerpt I posted there was no change made between starting the IPSec tunnel and it closing. I restored the config to the known working backup, started the tunnel and then watched it connect then drop and no longer able to start again.

Neither endpoint are NAT'd although NAT is in use. E.g. clients behind the firewalls at each end are NAT'd but the firewalls them selves where the IPSec tunnel is have direct access to the net given they have the WAN IP on an interface.

Dead-peer detection is enabled on both ends. But have tested with it off.

In it's broken state I can go into Site-to-Site VPN -> IPSec and turn on the tunnel and nothing will happen in the IPSec live log.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 claymen over 13 years ago

IPS is turned off at this stage and nothing in there at all.

Basically I can restore my config to the automatic backup at 1am before it went strange and it works for a short period then stops. When I was initially testing I thought it was a change I had made as I was working on some firewall rules and adjusting dyndns hence rolling it back initially. However when it happened again I started to get a little concerned.

In that log excerpt I posted there was no change made between starting the IPSec tunnel and it closing. I restored the config to the known working backup, started the tunnel and then watched it connect then drop and no longer able to start again.

Neither endpoint are NAT'd although NAT is in use. E.g. clients behind the firewalls at each end are NAT'd but the firewalls them selves where the IPSec tunnel is have direct access to the net given they have the WAN IP on an interface.

Dead-peer detection is enabled on both ends. But have tested with it off.

In it's broken state I can go into Site-to-Site VPN -> IPSec and turn on the tunnel and nothing will happen in the IPSec live log.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data