Ipsec via main GW stops work, Found old outbound SPI error in debug log

Zyxel_Cooldia

Hi @alexey

When the issue occur again, please don’t change interface IP and keep the symptoms, we will check it immediately. 

alexey

This is not real. We need that sites was avaible every time.

So I must change gw/ip.

alexey

Problems still persist. 2 vti in dead state. GWs are avaible.

alexey

2 ZW USG 1100. Less than 3 hours of work each. 1 of 2 VTI stops working.

Can't see each other. Other 15 VTIs work.

Caps from VTI.

Caps.7z

Zyxel_Cooldia

Hi @alexey,

It works fine as now after we added another policy to block abnormal traffic coming up to USG interface.Also, we found out that, the connectivity check packet lost in ISP routing. You may check with ISP about it.

 

A send connectivity check packet to B, B receiver the packet, and did reply.

However, A got no response from B.

alexey

Hi again. Today this situation returned again on 1 site. Both gw available, but vpn via main dont work. Help only switch ipsec vpn.

alexey

+1 to this count today

Zyxel_Cooldia

Hi @alexey

I will contact with you via private message to check if it is same as before that related to CC packets lost in ISP routing.

alexey

This happened again today. USG 1100 fw 4.62

Zyxel_Can

Hi @alexey,

Can you share some information with us:

1-  Topology with IP addresses and subnets that related to site with the problem.
2-  Device model names for that setup and their firmware version.

Best regards.