Ipsec via main GW stops work, Found old outbound SPI error in debug log

24

All Replies

  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 1,511  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 100 Answers 1000 Comments

    Hi @alexey

    When the issue occur again, please don’t change interface IP and keep the symptoms, we will check it immediately. 

  • alexey
    alexey Posts: 188  Master Member
    First Comment Friend Collector Fifth Anniversary

    This is not real. We need that sites was avaible every time.

    So I must change gw/ip.

  • alexey
    alexey Posts: 188  Master Member
    First Comment Friend Collector Fifth Anniversary

    Problems still persist. 2 vti in dead state. GWs are avaible.

  • alexey
    alexey Posts: 188  Master Member
    First Comment Friend Collector Fifth Anniversary

    2 ZW USG 1100. Less than 3 hours of work each. 1 of 2 VTI stops working.

    Can't see each other. Other 15 VTIs work.

    Caps from VTI.


    Caps.7z


  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 1,511  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 100 Answers 1000 Comments

    Hi @alexey,

    It works fine as now after we added another policy to block abnormal traffic coming up to USG interface.Also, we found out that, the connectivity check packet lost in ISP routing. You may check with ISP about it.

     

    A send connectivity check packet to B, B receiver the packet, and did reply.

    However, A got no response from B.


  • alexey
    alexey Posts: 188  Master Member
    First Comment Friend Collector Fifth Anniversary

    Hi again. Today this situation returned again on 1 site. Both gw available, but vpn via main dont work. Help only switch ipsec vpn.

  • alexey
    alexey Posts: 188  Master Member
    First Comment Friend Collector Fifth Anniversary

    +1 to this count today

  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 1,511  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 100 Answers 1000 Comments

    Hi @alexey

    I will contact with you via private message to check if it is same as before that related to CC packets lost in ISP routing.

  • alexey
    alexey Posts: 188  Master Member
    First Comment Friend Collector Fifth Anniversary
    This happened again today. USG 1100 fw 4.62
  • Zyxel_Can
    Zyxel_Can Posts: 342  Zyxel Employee
    25 Answers First Comment Friend Collector
    Hi @alexey,

    Can you share some information with us:

    1-  Topology with IP addresses and subnets that related to site with the problem.
    2-  Device model names for that setup and their firmware version.

    Best regards.

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）