@walid-0 said in 1 out 2 IPSEC connections drops after random time.:

If you only get disconnected in phase2 please use IKEv1 instead of IKEv2 this will enable reauthentication and the phase2 will renew every time the life time reach to 90%

Even if this worked, I don't know that I would suggest using IKEv1 to resolve it. IKEv2 provides many benefits over the IKEv1, but a failed child SA is just a miss configuration and should be fixable.

The document I linked has all the information you'll need to get it working properly.

@tstok
I'm possibly not following what you're trying to do, but the tunnel IPs are just arbitrary point to point numbers. You can then route through the point to point vti interface. I can't see any reason why you'd have to create 60 tunnels.

@mathijsk Thank you for posting this! I, too, had all my IPSec tunnels go down, but I didn't realize it because I very rarely use them. Meanwhile, I was trying to setup a "Mobile Clients" vpn and have been banging my head against the wall for a few weeks now getting stuck with vague errors and no working connections. I, too, had not configured IPv6 and when I checked my WAN interface it was setup for DHCP6. When I set that to None, everything came back up. I don't know how it got set to DHCP6 as my ISP does not provide addresses with DHCP, so it must have gotten switched on with some update.

Nobody?

Did you try Child SA Close Action: Restart/Reconnect for the Tunnel Configuration at Site B?

Ok. Thank you for the effort.

This will be much improved on the next release:

https://forum.netgate.com/post/994704

https://forum.netgate.com/topic/165510/heads-up-ipsec-changes?_=1627666555213

Sounds like what you want is "Split connections" in the P1 options.

IKEv1 is always split -- each P2 gets its own separate configuration
IKEv2 can combine traffic selectors and does so by default, so all your P2 configurations get lumped into a single configuration entry. This is more efficient and flexible, since it only needs to maintain one child SA for all traffic, but some other devices/services don't like it for various reasons.

If you are using IKEv2 and check "Split Connections" then it creates a separate configuration for each P2 so they will be independent.

FYI someone linked a similar issue described here:
https://www.reddit.com/r/AZURE/comments/osp4n3/i_can_no_longer_connect_to_some_of_the_nodes_over/

Check the logs on the far side. It would seem to indicate that your identifier doesn't match what the other side expects, but your side doesn't have any more than that to go on. Logs on the other side would be more specific.

@mrgizmo
The point is that it only behaves like that if there is an active outbound NAT rule on LAN or if you're doing NAT in IPSec p 2.

So if you're in doubt provide these settings.