Gateway confusion between two IPSec Gateways

mMontana

Up.
Tunnel survived to a firewall (spoke) reboot, however still have to understand if it will work after a public ip change.

StefanZ

Any news on this topic?

Seemingly I have the same issue.

• Win10 IKEv2 Cert tries to connect – to an IP that will just answer to this one gateway. On the 2nd WAN.
• Cert is signed on the IP (static)
• Gateway is listening to the IP and LocalID is set to the IP
• Setting a PeerID on Windows is not supported as far as I know?
• I get a proposal mismatch, since it seems to try ANY of the gateways, but NOT the one I am targeting.

Why would Gateway X answer a call to Gateway Y on a totally different WAN, IP and LocalID?

I need to have Apple, site-2-site (both working well) and now also Win10/11 running – PCs being the minority here.

mMontana

@StefanZ AFAIK your case is quite different than mine.
Then the only suggestion i can tell you that any IKEv1 or v2 tunnel listens only on ONE interface. If your current gateway is listening on WAN1, it won't listen at the same time on WAN2.

StefanZ

https://community.zyxel.com/en/discussion/comment/54996#Comment_54996

Yeah seemingly there is more to my problems and the gateway confusion is just one symptom.

But I am telling it as it was: Connect to WAN1 - get a response/error from a gateway on WAN2.

mMontana

I changed the negotiation parameters for the specific site-to-site tunnel. Then the IKEv1 tunnel from client worked without issues.