Multiple S2S VPNs with AWS can't established after internet break
Thank you for your feedback.
When you connect strongswan with your mobile phone, can Windows PC connect to USG210's L2TP?
In the provided log, we see that
22.214.171.124:4969 ,USG_IP:500 , info ,ike ,IKE_LOG , , , , Receiving IKEv2 request
Do you use strongswan software to connect with your USG210 or with another server?
What is the strongswan's VPN type?
In the screenshot you provided, there's a TEST_IKEv2_Tunnel. What is the purpose of this? Can you inactivate and test it again?
If you can always reproduce this symptom, can you clear your log(Monitor > Log > Clear), reproduce this symptom and send me the clean log output(ike, ipsec vpn and l2tp vpn log as before) by private message?
I have an L2TP VPN working, and people use it all time. I configured IKEv2 only for tests (TEST_IKEv2_Tunnel). When I made a connection from Windows10 (WiFI from my mobile phone) everything worked, but when I tried to connect from Android (stronswarm is needed because android nativli doesn't support IKEv2) I killed my IKEv2 tunnels to AWS.
I use strongswan software to connect with USG210 only, VPN type was IKEv2.
I tried to connect from strongSwarm two times and always tunnels to AWS goes down.
Sure, screens already sent by PM.0
Have you some news for me? I would like to switch all my users to IKEv2 C2S VPN tunnel, but I can't because I can't use it for mobile phones...
I have next, interesting observations. When I had set up IKEv2 C2S VPN with only one type of encryption in both phases, and tried connect from Windows 10, USG in phase 2 chose wrong VPN connection. More screens in PM.
I don't know why, but IKEv2 C2S VPN working ONLY in configuration describe in this scenario:
Thank you for sharing information with us.
When you broadcasting hotspot wifi signal from your Android smartphone,
If you press connect button on strongswan software does your smartphone connect to your USG210 successfully via IKEv2 VPN?
Does the IKEv2 tunnel between Android smartphone and USG210 build successfully?
If so, can you please share Monitor > VPN Monitor > IPSec menu’s screenshot with me?
Also, can you please provide me following information by private message:
1- Remote admin access to your USG210
2- Remote desktop(AnyDesk/Team Viewer) access to a Windows PC in your AD
I would like to test this symptom for Strongswan and Win10 clients.
I not broadcasting WiFi from my android smartphone, when I testing strongSwarm. I can't connect to USG, the IKEv2 tunnel has not built.I can't give you remote admin access to my USG, but I can preper Windows 10 laptop with TeamViewer, and limited-admin access, but we have to agree some maitancance window.0
I probably fixed it . The issue for the tunnels to AWS was the wrong DH group and encryption algorithms, when I had changed it to DH14 and AES128-SHA256 in both phases, the tunnels started working normally (enegotiation time is pretty fast, and all tunnels go to UP). I suppose that the reason for the issue in tunnel negotiation was in the DH group only, i will change AWS128-SHA256 to AES256-SHA256 in a few weeks, now I need some time for tests.
About the Client to Server IKEv2 tunnel, it started working too but I am still able to break another IKEv2 tunnel during tunnel initialization. Let's say that for C2S I have AES-256 with SHA-256 and DH14, the same settings for both phases. When I set on my Windows laptop IKEv2 VPN connection with parameters: AES-256, SHA-256, DH14 in phase 1, and AES-256, SHA-256, DH = None in phase 2, and I will try connect to USG, then I will break already established tunnel on first place on IPSec tunnel list. I don't know why... Fortunately after changes from the first acapit of this post, the tunnel came back really quickly..0
- 8.5K All Categories
- 1.6K Nebula
- 71 Nebula Ideas
- 57 Nebula Status and Incidents
- 4.5K Security
- 227 Security Ideas
- 982 Switch
- 46 Switch Ideas
- 879 WirelessLAN
- 24 WLAN Ideas
- 5.1K Consumer Product
- 158 Service & License
- 280 News and Release
- 98 Success Stories
- 61 Security Advisories
- 13 Education Center
- 581 FAQ
- 263 Nebula FAQ
- 160 Security FAQ
- 76 Switch FAQ
- 75 WirelessLAN FAQ
- 7 Consumer Product FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 62 About Community
- 46 Security Highlight