IPSEC Tunnels keep dropping



  • I upgraded yesterday and my IPSEC tunnels keep dropping.  I can restart ipsec and the tunnels come right back up.
    RC



  • The do not drop option is not working.  I got a constant ping running from my server to the router on the other end to keep the tunnels up.
    RC



  • Ok, I done plently of testing and can't figure out for the life of me why the IPSEC tunnels keep dropping.  The only what i can get them back up is to restart IPSEC.  This is causing me some issues.

    I don;t want to go backwards to a older version because of the performance increases and functionial.  So what is the scoop on the tunnels dropping.

    I have change the DPD to 5 seconds to see if it will help

    Interface issuse:  There are about 3 to 5 character out of place.  I only see the W in WAN.  I can't see any of the settings for pefect security.  I see part of the A in AES.  All of the menu throughout the interface are off by that much.

    RC



  • IPsec logs would be helpful. Impossible to say without that.



  • I have been able to keep the tunnels up for moe than a hour by changing DPD time to 5 and running a constant ping of 128 bytes.

    I will turn the ping off and try to capture a log entry and post that in a little while.
    RC



  • This is a example of a timeout:
    Reply from 192.168.xx.10: bytes=128 time=456ms TTL=127
    Reply from 192.168.xx.10: bytes=128 time=501ms TTL=127
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Request timed out.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 205.244.203.58: TTL expired in transit.
    Reply from 192.168.xx.10: bytes=128 time=393ms TTL=127
    Reply from 192.168.xx.10: bytes=128 time=455ms TTL=127

    Here are log entries:
    Trying to catch those now.



  • I change DPD time to 5, and the tunnels seems to staying up.  They have not dropped all weekend. What should a normal DPD time be?
    RC



  • Depends on the specifics of your environment, and the quality of the Internet connections. 5 seconds is pretty low, may cause unnecessary renegotiation.


Log in to reply