VPN goes down each 8 hours

[BigPalo]

HI,

We have a VPN from PA to Oracle cloud. We realised that this VPN goes down each 8 hours and it takes so long to renegotiate. From Oracle side tells this: "

 early November, OCI implemented enhancements to IKE, including support for additional DH groups and support for IKEv2. Consequently, the IKE proposal payload from OCI can exceed 1500 bytes. Due to this implementation, it is possible that the proposals become fragmented and some CPEs may reject them. Consequently, you will want to check your CPE's WAN interface and assess whether or not fragmented packets are accepted. If they are not, we encourage you to allow fragmented packets on that interface and let us know whether or not that resolves the problem. We will now await your reply regarding this matter."

So its there any action that we can perform in PA?

[S.Cantwell]

So... there are many questions to your query.

You could look at your system logs and determine the cause of the why the VPN goes down.

Now, the default ike crypto file is configured to renegotiate at 8 hours...

Can you (or have you enabled) IKEv2 to take advantage of the higher timer?

Have you confirmed IF the OCI can be configured to increase its timer, beyond 8 hours?

Have you looked at your global counters to confirm if you are seeing fragmented traffic?

Do you have a Zone Protection profile (getting warmer...) that may be dropping fragmented traffic?

These are what I would start to look at first.

Keep us in the loop.  😛

[OtakarKlier]

Hello,

Another thing you might try is to have a tunnel monitor so there are pings and traffic going through the tunnel so it wont go down?

Just a thought.

[aleksandar.astardzhiev]

This doesn't make sense...If the problem is in the fragmented IKE packets, you shouldn't be able to build the tunnel at all. All of the renegotiation will contain packets bigger than 1500bytes and will be dropped.

VPNs going down after particular time usually happen if there is lifetime mismatch between the peers.

Check the lifetime on both ends of the tunnel for phase1 and phase2. Check also if they both use the same metric - seconds, or bytes, or both.

Also insist for deeper investigation from Oracle. The answer they have provide looks more like dust in the eyes, than plausible case.