IPSEC Site to Site tunnel With Watchguard Firewalls as peers

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L0 Member

IPSEC Site to Site tunnel With Watchguard Firewalls as peers


I have a problem with the PAN keeping a tunnel connected to Watchguard firewalls.

Phase1

Main Mode

IKE Crypto: MD5-3DES-GP1

Lifetime: 8 Hours

DPD 5-5

Phase2

IPSec Crypto: MD5-3DES-NoPFS

Lifetime 8 Hours

LifeSize 128 MB

Proxy: Local 10.0.0.0/8     Remote: 192.168.4.0/24

I have tried just about every type of Authentication and Encryption possible but still cant get a stable tunnel. They will work for a day or 2 and then fail. I have to delete and rebuild the tunnels on the Watchguards to bring the connection back up.

I have not tried to play with the lifetime or size settings yet. I also have not tried Agressive mode yet. Anyone out there been able to make a stable tunnel with a Watchguard Firewall?

Tags (2)
Highlighted
L7 Applicator

If the PA firewall is the responder, take a look at your ikemgr.log file. You can use this command to navigate using standard linux 'less' navigation:

> less mp-log ikemgr.log

Find the time of the most recent failure and see what the reason for the failure is, the log should give you pretty good details.

If the PA firewall is the initiator, you'll need to look at the logs on the Watchguard. It sounds like you're establishing correctly, but a re-key is likely failing. The log is your best bet for seeing the issue.

Does it re-establish by itself? How about if you use the test command:

> test vpn ipsec-sa tunnel <tunnel-name>

You may also try enabling tunnel monitoring on the PA firewall in the IPSec config (Network > IPSec Tunnels > (tunnel name) > General tab > Advanced > Tunnel Monitor. Configure an address on the other side of the tunnel.

Good luck!

Greg

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!