topic Re: VPN tunnel is getting dropped in General Topics

VPN tunnel is getting dropped

fatboy1607 — Fri, 27 Feb 2015 08:11:42 GMT

we are seeing tunnel drop with below error message.

IKE phase-1 SA is deleted SA: 1.1.1.1[500]-2.2.2.2[500] cookie:191098e4ef6db35d:eba9ee89ff200b07

Re: VPN tunnel is getting dropped

hshah — Fri, 27 Feb 2015 16:02:14 GMT

Hi Mandar,

This much logs are not enough to identify root cause. Please follow bellow method to get more meaningful logs.

1. open to ssh session to firewall.

2. execute "test vpn ike-vpn" on one firewall session.

3. execute "tail follow yes mp-log ike-mgr" on another firewall session. Wait untill phase-1 is deleted.

4. Provide me output for 3.

Other option is to provide time stamp for tunnel down event and provide me full output for "less mp-log ike-mgr"

Regards,

Hardik Shah

Re: VPN tunnel is getting dropped

kattaullah — Fri, 27 Feb 2015 16:42:46 GMT

Hello Mandar

Below is the link to very helpful document to troubleshoot VPN connectivity issues.

How to Troubleshoot VPN Connectivity Issues

Hope that helps.

Regards

Khan

Note: Please mark any correct or helpful answers

Re: VPN tunnel is getting dropped

fatboy1607 — Sat, 28 Feb 2015 15:21:48 GMT

Domain

Receive Time

Serial #

Type

Threat/Content Type

Config Version

Generate Time

Virtual System

eventid

fmt

module

Severity

Description

seqno

actionflags

2/27/2015 8:28

9.4E+09

SYSTEM

vpn

2/27/2015 8:28

ipsec-key-install

general

informational

IPSec key installed. Installed SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0xA8E288CA/0x0C4BB904 lifetime 3600 Sec lifesize unlimited.

32487

0x8000000000000000

2/27/2015 8:28

9.4E+09

SYSTEM

vpn

2/27/2015 8:28

ike-nego-p2-succ

general

informational

IKE phase-2 negotiation is succeeded as initiator, quick mode. Established SA: 203.82.55.114[500]-165.21.244.134[500] message id:0x9708CBA6, SPI:0xA8E288CA/0x0C4BB904.

32486

0x8000000000000000

2/27/2015 8:28

9.4E+09

SYSTEM

vpn

2/27/2015 8:28

ike-nego-p2-start

general

informational

IKE phase-2 negotiation is started as initiator, quick mode. Initiated SA: 203.82.55.114[500]-165.21.244.134[500] message id:0x9708CBA6.

32485

0x8000000000000000

2/27/2015 8:23

9.4E+09

SYSTEM

vpn

2/27/2015 8:23

tunnel-status-up

general

informational

Tunnel BS_LSVPN_Tunnel (id:1, peer: 172.21.4.1) is up

32482

0x8000000000000000

2/27/2015 8:21

9.4E+09

SYSTEM

vpn

2/27/2015 8:21

tunnel-status-up

general

informational

Tunnel BS_LSVPN_Tunnel (id:1, peer: 172.21.4.1) is up

32478

0x8000000000000000

2/27/2015 7:29

9.4E+09

SYSTEM

vpn

2/27/2015 7:29

ipsec-key-install

general

informational

IPSec key installed. Installed SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0x945B6135/0x03995B90 lifetime 3600 Sec lifesize unlimited.

32444

0x8000000000000000

2/27/2015 7:29

9.4E+09

SYSTEM

vpn

2/27/2015 7:29

ike-nego-p2-succ

general

informational

IKE phase-2 negotiation is succeeded as initiator, quick mode. Established SA: 203.82.55.114[500]-165.21.244.134[500] message id:0x58F37B11, SPI:0x945B6135/0x03995B90.

32443

0x8000000000000000

2/27/2015 7:29

9.4E+09

SYSTEM

vpn

2/27/2015 7:29

ike-nego-p2-start

general

informational

IKE phase-2 negotiation is started as initiator, quick mode. Initiated SA: 203.82.55.114[500]-165.21.244.134[500] message id:0x58F37B11.

32442

0x8000000000000000

2/27/2015 7:29

9.4E+09

SYSTEM

vpn

2/27/2015 7:29

ipsec-key-delete

general

informational

IPSec key deleted. Deleted SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0xA72B82F1/0x0271C85B.

32441

0x8000000000000000

2/27/2015 7:29

9.4E+09

SYSTEM

vpn

2/27/2015 7:29

ike-recv-p2-delete

general

informational

IKE protocol IPSec SA delete message received from peer. SPI:0x0271C85B.

32440

0x8000000000000000

2/27/2015 7:28

9.4E+09

SYSTEM

vpn

2/27/2015 7:28

ike-nego-p1-succ

general

informational

IKE phase-1 negotiation is succeeded as initiator, main mode. Established SA: 203.82.55.114[500]-165.21.244.134[500] cookie:5c12ea83776817d7:b4b349404f5d0b2e lifetime 86400 Sec.

32439

0x8000000000000000

2/27/2015 7:28

9.4E+09

SYSTEM

vpn

2/27/2015 7:28

ike-nego-p1-start

general

informational

IKE phase-1 negotiation is started as initiator, main mode. Initiated SA: 203.82.55.114[500]-165.21.244.134[500] cookie:5c12ea83776817d7:0000000000000000.

32438

0x8000000000000000

2/27/2015 7:10

9.4E+09

SYSTEM

vpn

2/27/2015 7:10

ike-nego-p1-delete

general

informational

IKE phase-1 SA is deleted SA: 203.82.55.114[500]-165.21.244.134[500] cookie:191098e4ef6db35d:eba9ee89ff200b07.

32419

0x8000000000000000

2/27/2015 7:10

9.4E+09

SYSTEM

vpn

2/27/2015 7:10

ike-send-p1-delete

general

informational

IKE protocol phase-1 SA delete message sent to peer. cookie:191098e4ef6db35d:eba9ee89ff200b07.

32418

0x8000000000000000

2/27/2015 7:10

9.4E+09

SYSTEM

vpn

2/27/2015 7:10

ike-nego-p1-expire

general

informational

IKE phase-1 SA is expired SA: 203.82.55.114[500]-165.21.244.134[500] cookie:191098e4ef6db35d:eba9ee89ff200b07.

32417

0x8000000000000000

2/27/2015 6:49

9.4E+09

SYSTEM

vpn

2/27/2015 6:49

ipsec-key-delete

general

informational

IPSec key deleted. Deleted SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0x8EC49306/0x0A00A601.

32412

0x8000000000000000

2/27/2015 6:49

9.4E+09

SYSTEM

vpn

2/27/2015 6:49

ike-send-p2-delete

general

informational

IKE protocol IPSec SA delete message sent to peer. SPI:0x8EC49306.

32411

0x8000000000000000

2/27/2015 6:48

9.4E+09

SYSTEM

vpn

2/27/2015 6:48

ipsec-key-install

general

informational

IPSec key installed. Installed SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0xA72B82F1/0x0271C85B lifetime 3600 Sec lifesize unlimited.

32410

0x8000000000000000

2/27/2015 6:48

9.4E+09

SYSTEM

vpn

2/27/2015 6:48

ike-nego-p2-succ

general

informational

IKE phase-2 negotiation is succeeded as initiator, quick mode. Established SA: 203.82.55.114[500]-165.21.244.134[500] message id:0xB9E73AE9, SPI:0xA72B82F1/0x0271C85B.

32409

0x8000000000000000

2/27/2015 6:48

9.4E+09

SYSTEM

vpn

2/27/2015 6:48

ike-nego-p2-start

general

informational

IKE phase-2 negotiation is started as initiator, quick mode. Initiated SA: 203.82.55.114[500]-165.21.244.134[500] message id:0xB9E73AE9.

32408

0x8000000000000000

2/27/2015 6:22

9.4E+09

SYSTEM

vpn

2/27/2015 6:22

tunnel-status-up

general

informational

Tunnel BS_LSVPN_Tunnel (id:1, peer: 172.21.4.1) is up

32396

0x8000000000000000

2/27/2015 6:21

9.4E+09

SYSTEM

vpn

2/27/2015 6:21

tunnel-status-up

general

informational

Tunnel BS_LSVPN_Tunnel (id:1, peer: 172.21.4.1) is up

32392

0x8000000000000000

2/27/2015 5:50

9.4E+09

SYSTEM

vpn

2/27/2015 5:50

ipsec-key-delete

general

informational

IPSec key deleted. Deleted SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0xB321E649/0x003591D6.

32379

0x8000000000000000

2/27/2015 5:50

9.4E+09

SYSTEM

vpn

2/27/2015 5:50

ike-send-p2-delete

general

informational

IKE protocol IPSec SA delete message sent to peer. SPI:0xB321E649.

32378

0x8000000000000000

2/27/2015 5:50

9.4E+09

SYSTEM

vpn

2/27/2015 5:50

ipsec-key-install

general

informational

IPSec key installed. Installed SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0x8EC49306/0x0A00A601 lifetime 3600 Sec lifesize unlimited.

32377

0x8000000000000000

2/27/2015 5:50

9.4E+09

SYSTEM

vpn

2/27/2015 5:50

ike-nego-p2-succ

general

informational

IKE phase-2 negotiation is succeeded as initiator, quick mode. Established SA: 203.82.55.114[500]-165.21.244.134[500] message id:0x90AF6DAA, SPI:0x8EC49306/0x0A00A601.

32376

0x8000000000000000

2/27/2015 5:50

9.4E+09

SYSTEM

vpn

2/27/2015 5:50

ike-nego-p2-start

general

informational

IKE phase-2 negotiation is started as initiator, quick mode. Initiated SA: 203.82.55.114[500]-165.21.244.134[500] message id:0x90AF6DAA.

32375

0x8000000000000000

2/27/2015 4:51

9.4E+09

SYSTEM

vpn

2/27/2015 4:51

ipsec-key-delete

general

informational

IPSec key deleted. Deleted SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0xAD6F2495/0x014F0B38.

32349

0x8000000000000000

2/27/2015 4:51

9.4E+09

SYSTEM

vpn

2/27/2015 4:51

ike-send-p2-delete

general

informational

IKE protocol IPSec SA delete message sent to peer. SPI:0xAD6F2495.

32348

0x8000000000000000

2/27/2015 4:51

9.4E+09

SYSTEM

vpn

2/27/2015 4:51

ipsec-key-install

general

informational

IPSec key installed. Installed SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0xB321E649/0x003591D6 lifetime 3600 Sec lifesize unlimited.

32347

0x8000000000000000

2/27/2015 4:51

9.4E+09

SYSTEM

vpn

2/27/2015 4:51

ike-nego-p2-succ

general

informational

IKE phase-2 negotiation is succeeded as initiator, quick mode. Established SA: 203.82.55.114[500]-165.21.244.134[500] message id:0xC4EA4E0E, SPI:0xB321E649/0x003591D6.

32346

0x8000000000000000

2/27/2015 4:51

9.4E+09

SYSTEM

vpn

2/27/2015 4:51

ike-nego-p2-start

general

informational

IKE phase-2 negotiation is started as initiator, quick mode. Initiated SA: 203.82.55.114[500]-165.21.244.134[500] message id:0xC4EA4E0E.

32345

0x8000000000000000

2/27/2015 4:22

9.4E+09

SYSTEM

vpn

2/27/2015 4:22

tunnel-status-up

general

informational

Tunnel BS_LSVPN_Tunnel (id:1, peer: 172.21.4.1) is up

32333

0x8000000000000000

2/27/2015 4:20

9.4E+09

SYSTEM

vpn

2/27/2015 4:20

tunnel-status-up

general

informational

Tunnel BS_LSVPN_Tunnel (id:1, peer: 172.21.4.1) is up

32329

0x8000000000000000

2/27/2015 3:52

9.4E+09

SYSTEM

vpn

2/27/2015 3:52

ipsec-key-delete

general

informational

IPSec key deleted. Deleted SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0x916AA3D2/0x0D19F830.

32315

0x8000000000000000

2/27/2015 3:52

9.4E+09

SYSTEM

vpn

2/27/2015 3:52

ike-send-p2-delete

general

informational

IKE protocol IPSec SA delete message sent to peer. SPI:0x916AA3D2.

32314

0x8000000000000000

2/27/2015 3:52

9.4E+09

SYSTEM

vpn

2/27/2015 3:52

ipsec-key-install

general

informational

IPSec key installed. Installed SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0xAD6F2495/0x014F0B38 lifetime 3600 Sec lifesize unlimited.

32313

0x8000000000000000

2/27/2015 3:52

9.4E+09

SYSTEM

vpn

2/27/2015 3:52

ike-nego-p2-succ

general

informational

IKE phase-2 negotiation is succeeded as initiator, quick mode. Established SA: 203.82.55.114[500]-165.21.244.134[500] message id:0xE4D9C17C, SPI:0xAD6F2495/0x014F0B38.

32312

0x8000000000000000

2/27/2015 3:52

9.4E+09

SYSTEM

vpn

2/27/2015 3:52

ike-nego-p2-start

general

informational

IKE phase-2 negotiation is started as initiator, quick mode. Initiated SA: 203.82.55.114[500]-165.21.244.134[500] message id:0xE4D9C17C.

32311

0x8000000000000000

2/27/2015 2:53

9.4E+09

SYSTEM

vpn

2/27/2015 2:53

ipsec-key-delete

general

informational

IPSec key deleted. Deleted SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0xD6119110/0x0782FE6A.

32285

0x8000000000000000

Re: VPN tunnel is getting dropped

fatboy1607 — Sat, 28 Feb 2015 16:52:34 GMT

2015-02-28 07:28:29 [INFO]: ====> PHASE-1 SA LIFETIME EXPIRED <====

====> Expired SA: 203.82.55.114[500]-165.21.244.134[500] cookie:5c12ea83776817d7:b4b349404f5d0b2e <====

2015-02-28 07:28:29 [INFO]: ====> PHASE-1 SA DELETED <====

====> Deleted SA: 203.82.55.114[500]-165.21.244.134[500] cookie:5c12ea83776817d7:b4b349404f5d0b2e <====

2015-02-28 08:03:29 [INFO]: IPsec-SA request for 165.21.244.134 queued since no phase1 found

2015-02-28 08:03:29 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS INITIATOR, MAIN MODE <====

====> Initiated SA: 203.82.55.114[500]-165.21.244.134[500] cookie:2df5e99ee9b8144e:0000000000000000 <====

2015-02-28 08:03:30 [INFO]: received Vendor ID: RFC 3947

2015-02-28 08:03:30 [INFO]: received Vendor ID: DPD

2015-02-28 08:03:30 [INFO]: Selected NAT-T version: RFC 3947

2015-02-28 08:03:30 [INFO]: Hashing 165.21.244.134[500] with algo #2

2015-02-28 08:03:30 [INFO]: Hashing 203.82.55.114[500] with algo #2

2015-02-28 08:03:30 [INFO]: Adding remote and local NAT-D payloads.

2015-02-28 08:03:30 [INFO]: Hashing 203.82.55.114[500] with algo #2

2015-02-28 08:03:30 [INFO]: NAT-D payload #0 verified

2015-02-28 08:03:30 [INFO]: Hashing 165.21.244.134[500] with algo #2

2015-02-28 08:03:30 [INFO]: NAT-D payload #1 verified

2015-02-28 08:03:30 [INFO]: NAT not detected

2015-02-28 08:03:30 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION SUCCEEDED AS INITIATOR, MAIN MODE <====

====> Established SA: 203.82.55.114[500]-165.21.244.134[500] cookie:2df5e99ee9b8144e:1c004f39f60ecd83 lifetime 86400 Sec <====

2015-02-28 08:03:30 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS INITIATOR, (QUICK MODE) <====

====> Initiated SA: 203.82.55.114[500]-165.21.244.134[500] message id:0x6F05C64C <====

2015-02-28 08:03:30 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION SUCCEEDED AS INITIATOR, (QUICK MODE) <====

====> Established SA: 203.82.55.114[500]-165.21.244.134[500] message id:0x6F05C64C, SPI:0xB24C20B8/0x0DF2F92C <====

2015-02-28 08:03:30 [INFO]: SADB_UPDATE ul_proto=255 src=165.21.244.134[500] dst=203.82.55.114[500] satype=ESP samode=tunl spi=0xB24C20B8 authtype=SHA1 enctype=AES128 lifetime soft time=3600 bytes=0 hard time=3600 bytes=0

2015-02-28 08:03:30 [INFO]: SADB_ADD ul_proto=255 src=203.82.55.114[500] dst=165.21.244.134[500] satype=ESP samode=tunl spi=0x0DF2F92C authtype=SHA1 enctype=AES128 lifetime soft time=3600 bytes=0 hard time=3600 bytes=0

2015-02-28 08:03:30 [INFO]: IPsec-SA established: ESP/Tunnel 165.21.244.134[500]->203.82.55.114[500] spi=2991333560(0xb24c20b8)

2015-02-28 08:03:30 [PROTO_NOTIFY]: ====> IPSEC KEY INSTALLATION SUCCEEDED <====

====> Installed SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0xB24C20B8/0x0DF2F92C lifetime 3600 Sec lifesize unlimited <====

2015-02-28 08:03:30 [INFO]: keymirror add start ++++++++++++++++

2015-02-28 08:03:30 [INFO]: keymirror add for gw 1, tn 3, selfSPI B24C20B8, retcode 0.

2015-02-28 08:03:31 [INFO]: keymirror del start ----------------

2015-02-28 08:03:31 [INFO]: keymirror del for gw 1, tn 3, selfSPI A15D4857, retcode 0.

2015-02-28 08:03:31 [PROTO_NOTIFY]: ====> IPSEC KEY DELETED <====

====> Deleted SA: 203.82.55.114[500]-165.21.244.134[500] SPI:0xA15D4857/0x09930C2C <====

2015-02-28 08:03:31 [INFO]: SADB_DELETE ul_proto=0 src=203.82.55.114[500] dst=165.21.244.134[500] satype=ESP spi=0xA15D4857

2015-02-28 08:03:31 [INFO]: received PFKEY_DELETE seq=0 satype=ESP spi=0xA15D4857

2015-02-28 08:03:40 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=2df5e99ee9b8144e 1c004f39f60ecd83 (size=16).

2015-02-28 08:03:50 [PROTO_NOTIFY]: notification message 36136:R-U-THERE, doi=1 proto_id=1 spi=2df5e99ee9b8144e 1c004f39f60ecd83 (size=16