IPSEC Site to Site tunnel With Watchguard Firewalls as peers

[nationalhme]

I have a problem with the PAN keeping a tunnel connected to Watchguard firewalls.

Phase1

Main Mode

IKE Crypto: MD5-3DES-GP1

Lifetime: 8 Hours

DPD 5-5

Phase2

IPSec Crypto: MD5-3DES-NoPFS

Lifetime 8 Hours

LifeSize 128 MB

Proxy: Local 10.0.0.0/8     Remote: 192.168.4.0/24

I have tried just about every type of Authentication and Encryption possible but still cant get a stable tunnel. They will work for a day or 2 and then fail. I have to delete and rebuild the tunnels on the Watchguards to bring the connection back up.

I have not tried to play with the lifetime or size settings yet. I also have not tried Agressive mode yet. Anyone out there been able to make a stable tunnel with a Watchguard Firewall?

[gwesson]

If the PA firewall is the responder, take a look at your ikemgr.log file. You can use this command to navigate using standard linux 'less' navigation:

> less mp-log ikemgr.log

Find the time of the most recent failure and see what the reason for the failure is, the log should give you pretty good details.

If the PA firewall is the initiator, you'll need to look at the logs on the Watchguard. It sounds like you're establishing correctly, but a re-key is likely failing. The log is your best bet for seeing the issue.

Does it re-establish by itself? How about if you use the test command:

> test vpn ipsec-sa tunnel <tunnel-name>

You may also try enabling tunnel monitoring on the PA firewall in the IPSec config (Network > IPSec Tunnels > (tunnel name) > General tab > Advanced > Tunnel Monitor. Configure an address on the other side of the tunnel.

Good luck!

Greg