Connection lost inside SSL VPN tunnel

Martin_Kuchar
Martin_Kuchar Posts: 38  Freshman Member
First Comment Friend Collector Second Anniversary
edited April 2021 in Security
Hello,

(USG 110) we still have problems with lost connections inside SSL VPN tunnel. Last documented issues:
1. Client connected with SecuExtender. He cannot connect with RDP to PC behind firewall and cannot ping them. SecuExtender is connected. After manual reconnect SecuExtender, RDP and ping works.

2. Client connected with SecuExtender. He have no problem connect to RDP. After some time (random from minutes to hours) RDP died and cannot reconnect. Ping also stop working. SecuExtender is connected. After manual reconnect SecuExtender, RDP and ping works.

Debug log on USG is flooded with "invalid state detected, DROP", but I don't know, if this is related to this case. Also we found many "page allocation failure" in swapper (120 occurances in one day).

Logs are available. Thank you for support.

Martin


Accepted Solution

«1

All Replies

  • Zyxel_Charlie
    Zyxel_Charlie Posts: 1,034  Zyxel Employee
    50 Answers 500 Comments Friend Collector Fourth Anniversary
    @Martin_Kuchar
    According to the issue of RDP Connection lost inside SSL VPN tunnel,
    I will send you the firmware via private message, please has a check.
    Charlie
  • Martin_Kuchar
    Martin_Kuchar Posts: 38  Freshman Member
    First Comment Friend Collector Second Anniversary
    Thank You, Charlie for the Firmware. We now using it and testing. Will reply more later.
    Martin
  • Martin_Kuchar
    Martin_Kuchar Posts: 38  Freshman Member
    First Comment Friend Collector Second Anniversary
    Hi, the provided firmware not solve our problem. Still the same - successfull connection with SecuExtender, but no connection to internal network, or lost connection to internal network after some time.
    Is there possibility, that is the same as discused here?:
    If yes, this is not solved in provided firmware ?

    Thank you,
    Martin

  • Zyxel_Charlie
    Zyxel_Charlie Posts: 1,034  Zyxel Employee
    50 Answers 500 Comments Friend Collector Fourth Anniversary
    @Martin_Kuchar
    The firmware which I shared with you is latest version.
    Moreover, I tested it on my lab internally near one day without any issue.

    Therefore, can you private message the time for remote access?
    Charlie

  • Martin_Kuchar
    Martin_Kuchar Posts: 38  Freshman Member
    First Comment Friend Collector Second Anniversary
    edited October 2019
    fragment.log

    Hello,

    we finaly made the analysis. The problem as described in the first post is problem of Zyxel USG110 all firmware from 2/2017 (when we bought one) up to now. The problem is not in SecuExtender, but insire USG.

    After USG reboot, some time it will work fine. Many hours to 30 days. After this time something probably overflow the internal cache or memory management and in the USG starts some processes dying. It is to see in log (only when debug is ON) with:

    kernel: warn_alloc_failed: 17 callbacks suppressed

    kernel: swapper/2: page allocation failure: order:4, mode:0x200020

    Followed by Kernel stack trace. When this starts happened, it will never recovery from this state and all new or existed incomming VPN connection will lost internal route. The only way is reboot router.

    This problem exists accross all firmwares in 2017, 2018 and 2019.

    Log fragment attached. Happy reading and please resolve.. The VPN is unusable for serious working!

    Martin Kuchar

  • Zyxel_Emily
    Zyxel_Emily Posts: 1,396  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 100 Answers 1000 Comments

    Hi @Martin_Kuchar,

    We are analyzing the logs and need to clarify the issue with you.

    I will contact you in private message for more information.

  • kyssling
    kyssling Posts: 107  Ally Member
    First Comment First Answer Friend Collector Sixth Anniversary

    Hello, does anyone working our problem ?

    • specified in detail on this thread October 25, 2019 12:12AM ?

    Thanks for answer ...

  • Zyxel_Emily
    Zyxel_Emily Posts: 1,396  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 100 Answers 1000 Comments

    Hi @kyssling,

    Yes, we are still working on this case with Martin_Kuchar’s help. We will update the result in this thread once we’ve got further conclusion. 

  • USG_User
    USG_User Posts: 374  Master Member
    5 Answers First Comment Friend Collector Sixth Anniversary

    We are using SSL VPN since we bought the USG110 years ago, mainly in connection with RDP for remotely working on our office servers and client machines. Presently we are using the current SecuExternder Version for manual operated SSL VPN tunnel. The tunnels will be established for app. some minutes up to some hours but normally not for a whole day.

    Until now we didn't experience the a.m. issues of Martin. The last time we've got some weird behaviour, where connections getting unstable, was caused by fault settings. One user has been forgotten to be added to our SSLVPN_User_Group which has an own rule in our Policy Control for incoming tunnel traffic.

    We are interested in this thread and keep it under surveillance. If you need our SSL VPN settings to compare with yours, please let me know.

  • Martin_Kuchar
    Martin_Kuchar Posts: 38  Freshman Member
    First Comment Friend Collector Second Anniversary
    Answer ✓

    Kernel panics was resolved with help of @Zyxel_Emily . In case of questions, you can contact me with private message.

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）