Connection lost inside SSL VPN tunnel

Martin_Kuchar

Hello,

(USG 110) we still have problems with lost connections inside SSL VPN tunnel. Last documented issues:

1. Client connected with SecuExtender. He cannot connect with RDP to PC behind firewall and cannot ping them. SecuExtender is connected. After manual reconnect SecuExtender, RDP and ping works.

2. Client connected with SecuExtender. He have no problem connect to RDP. After some time (random from minutes to hours) RDP died and cannot reconnect. Ping also stop working. SecuExtender is connected. After manual reconnect SecuExtender, RDP and ping works.

Debug log on USG is flooded with "invalid state detected, DROP", but I don't know, if this is related to this case. Also we found many "page allocation failure" in swapper (120 occurances in one day).

Logs are available. Thank you for support.

Martin

Martin_Kuchar

Kernel panics was resolved with help of @Zyxel_Emily . In case of questions, you can contact me with private message.

Zyxel_Charlie

@Martin_Kuchar
According to the issue of RDP Connection lost inside SSL VPN tunnel,
I will send you the firmware via private message, please has a check.
Charlie

Martin_Kuchar

Thank You, Charlie for the Firmware. We now using it and testing. Will reply more later.

Martin

Martin_Kuchar

Hi, the provided firmware not solve our problem. Still the same - successfull connection with SecuExtender, but no connection to internal network, or lost connection to internal network after some time.

Is there possibility, that is the same as discused here?:

https://businessforum.zyxel.com/discussion/2071/secuextender-4-0-3-0-for-windows-failed-to-access-zywalls-lan

If yes, this is not solved in provided firmware ?

Thank you,

Martin

Zyxel_Charlie

@Martin_Kuchar
The firmware which I shared with you is latest version.
Moreover, I tested it on my lab internally near one day without any issue.

Therefore, can you private message the time for remote access?
Charlie

Martin_Kuchar

fragment.log

Hello,

we finaly made the analysis. The problem as described in the first post is problem of Zyxel USG110 all firmware from 2/2017 (when we bought one) up to now. The problem is not in SecuExtender, but insire USG.

After USG reboot, some time it will work fine. Many hours to 30 days. After this time something probably overflow the internal cache or memory management and in the USG starts some processes dying. It is to see in log (only when debug is ON) with:

kernel: warn_alloc_failed: 17 callbacks suppressed

kernel: swapper/2: page allocation failure: order:4, mode:0x200020

Followed by Kernel stack trace. When this starts happened, it will never recovery from this state and all new or existed incomming VPN connection will lost internal route. The only way is reboot router.

This problem exists accross all firmwares in 2017, 2018 and 2019.

Log fragment attached. Happy reading and please resolve.. The VPN is unusable for serious working!

Martin Kuchar

Zyxel_Emily

Hi @Martin_Kuchar,

We are analyzing the logs and need to clarify the issue with you.

I will contact you in private message for more information.

kyssling

Hello, does anyone working our problem ?

• specified in detail on this thread October 25, 2019 12:12AM ?

Thanks for answer ...

Zyxel_Emily

Hi @kyssling,

Yes, we are still working on this case with Martin_Kuchar’s help. We will update the result in this thread once we’ve got further conclusion. 

USG_User

We are using SSL VPN since we bought the USG110 years ago, mainly in connection with RDP for remotely working on our office servers and client machines. Presently we are using the current SecuExternder Version for manual operated SSL VPN tunnel. The tunnels will be established for app. some minutes up to some hours but normally not for a whole day.

Until now we didn't experience the a.m. issues of Martin. The last time we've got some weird behaviour, where connections getting unstable, was caused by fault settings. One user has been forgotten to be added to our SSLVPN_User_Group which has an own rule in our Policy Control for incoming tunnel traffic.

We are interested in this thread and keep it under surveillance. If you need our SSL VPN settings to compare with yours, please let me know.

Martin_Kuchar

Kernel panics was resolved with help of @Zyxel_Emily . In case of questions, you can contact me with private message.