809 Error/Tunnel Swapping with IKEv2

WiSy
WiSy Posts: 5
First Comment Friend Collector Second Anniversary
edited April 2021 in Security

Hi there,

we are currently running Client2Site Tunnels over IKEv2 using the integrated Windows 10 VPN Client which works fine for the most Part.

But whenever I change something on the IKEv2 Tunnel (for example IP Range) I get 809 Errors from the Windows Clients (iOS works fine) and have to reboot the firewall to make it work again.

From the USG logs it looks like the Client wants to connect to the wrong Tunnel.

Is there any way to avoid/fix this without rebooting the firewall??

All Replies

  • Alfonso
    Alfonso Posts: 257
    5 Answers First Comment Friend Collector Second Anniversary
     Master Member

    Hi @WiSy


    Welcome to the forum.

    809 errors and windows clients is a long history.

    There was a bug on Windows and IKEv2, it could be solved running

     Set-VpnConnection -Name 'NameOfVpnConnection' -SplitTunneling $false

    from powershell,


    I hope it helps you,

    Regards

  • WiSy
    WiSy Posts: 5
    First Comment Friend Collector Second Anniversary


    I´ll try this next time. Thanks.


    But this isnt only related to the Windows Client.

    Greenbow produced the same kind of Error.


    I think the Problem is the Firewall.

    Maybe to many VPN Gateways?


    Its an USG 310 BTW.

  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 1,100
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 50 Answers 1000 Comments
     Guru Member

    Hi @WiSy

    In this case, you can click “Reset IKE” to clear related SA on TGB client before you establish new connection.

    If the TGB client still goes to wrong tunnel, please send me the TGB console log via private message.


    TGB console(Tools > Console)


    TGB console


Security Highlight