IPSec VPN tunnel no longer working

[oschuler]

Hello guys

We have a few VPN tunnels between our PA-2050 (in HA cluster) and some WatchGuard firewalls (different models). We migrated these tunnels to the PA-2050 a few weeks ago and they ran stable. Now suddenly two of 10 tunnels are down and we don't get them back up.

Here's what we tried so far:

- Rebooting the WatchGuard firewalls

- Suspending the active PA-2050 so the standby HA device takes over

- Removing the VPN config on the WatchGuards and rebuild them (only VPN part)

- Overwrite the PSK on both ends

- On the PA-2050 CLI: clear vpn ike-sa gateway <gw-name> and clear vpn ipsec-sa tunnel <tunnel-name>

- some more small stuff

The config is the same on all tunnels, including the two not working...

Any inputs would on how we can further troubleshoot the issue would be much appreciated. The connection by the way is working. We can ping the endpoints mutually and we can also access the external admin interface of the remote WatchGuard firewalls...

Thanks!

Oliver

[pg_itdept]

Thank you for that oschuler will try it next time

[oschuler]

Looks like the latest release (version 318) contains modifications on the 'ike' decoder. We'll install it on Sunday, hopefully the issues are gone with it...

[pg_itdept]

OK our VPN is lasting for 28 hours with an 8 hour lifetime.

Having just got it back, it would appear that the UDP packets are not being correctly identified as IKE and being dropped at the firewall. I am guessing this is on a re-negotiation of the link.  I just looked for 318 and there was no sign of it so I will keep an eye on it being available

[jthompson1]

I haven't had an issue since reverting back to 4.1.4. Perhaps there was just an issue with the install...

When 4.1.7 is released I'll try that along with the 318 content.

-J