topic Re: Need to clear traffic or reset the tunnel to access in General Topics

Need to clear traffic or reset the tunnel to access

NavidAlam — Wed, 09 Oct 2019 10:25:03 GMT

We had site to site vpn tunnels and traffic is always stuck and until unless we reset or clear the traffic the access is not working.

Any one have experience . The VPN tunnel never go down only the traffic PA to Sonic wall any recommendation on how to troubleshoot this issue ?

Re: Need to clear traffic or reset the tunnel to access

BPry — Thu, 10 Oct 2019 01:39:36 GMT

@NavidAlam,

I'm going to assume that you don't actually have tunnel monitoring setup, so the firewall won't display the tunnel as being down until the re-key is missed. I'd setup tunnel monitoring and see if the aggressive key re-negotiation helps your situation at all.

Re: Need to clear traffic or reset the tunnel to access

NavidAlam — Thu, 10 Oct 2019 09:40:20 GMT

Tunnel monitoring is setup . As i mention the tunnel never go down only the access to the tunnel stop. The only way we can access we had to clear the tunnel both Ike & IPsec to make accessable ?

Re: Need to clear traffic or reset the tunnel to access

OtakarKlier — Fri, 11 Oct 2019 20:55:02 GMT

Hello,

I have many site to site VPNs with the PAN's and never have this issue. However you are using a 3rd party firewall, I would say contact SonicWall support and see if they have any known issues with this.

Regards,

Re: Need to clear traffic or reset the tunnel to access

BPry — Fri, 11 Oct 2019 21:07:58 GMT

@NavidAlam,

If tunnel monitoring is enabled you would be getting a critical vpn event within your system logs stating the tunnel is down when the target becomes unreachable; either I'm missing something or at least some traffic is making it through the tunnel. Tunnel monitoring would attempt to resolve the issue by accelerating the re-key in an attempt to get things to refresh and become operational again, because you are using a third party firewall you wouldn't get the advantage of DPD.

It really sounds like your missing something when it comes to re-key events, so I would look at your lifetime settings.