Speeded up SA Life Time site to site local test tunnel drops does not reconnect

PeterUK · April 13

USG FLEX 200H V1.10(ABWV.1)

FLEX200H

custom

IKEv2

Interface ge3 WAN3

Peer Gateway Address 192.168.254.9

Pre-Shared Key

Phase 1 Settings

SA Life Time 300

AES128

SH1

DH2

Phase 2 Settings

Initiation Nailed-up

local 192.168.255.32/28

remote 192.168.252.0/23

SA Life Time 180

AES128

SH1

DH2

To speed up the problem I changed Phase 1 and 2 SA Life Time as 300 Phase 1 and 180 Phase 2 after some time the Tunnel drop when ping check on site to site USG60W side to 192.168.255.44 down the tunnel on VLAN47 on FLEX200H

When the tunnel is up disable site to site USG60W side for 1 minute then enable the FLEX200H does not reconnect when it is the nailed up side.

PeterUK · April 13

Running a ping 192.168.252.1 then kicks the VPN to reconnect on FLEX200H guess its because protocol 50 and the FLEX200H sees no point when tunnel is lost but the other side is not nailed up so the only way for USG60W traffic to go down the tunnel when tunnel is lost is if the FLEX200H restarts the site to site when it has traffic to go down the tunnel.

Will do testing NATT and see how that behaves

PeterUK · April 13

So test with a NAT use USG60 so

FLEX200H > USG60 SNAT> USG60W

and FLEX dose not reconnect when you disable Site-to-site with Dynamic Peer for 1 minute unless traffic going to remote subnet happens on FLEX200H side and I when the tunnel is up I don't see NAT-keepalive packets.

also when the tunnel is up and I have USG60W ping down the tunnel over time the tunnel drops and will only connect when traffic form FLEX200H to the remote subnet happens.

PeterUK · April 20

Still problem for this in V1.20

The nailup in FLEX200H now reconnect in 60 seconds.

Remaining problem

With traffic only from USG60W ping Connectivity Check down tunnel to FLEX200H to a IP 192.168.255.43 for protocol 50 and NATT (each test) for 10 mins the tunnel drops reconnects in 60 seconds.

PeterUK · April 23

still a problem in SG FLEX 200H

V1.20(ABWV.0)

2024-04-18 14:10:29

ping every 5 seconds down the tunnel drop

PeterUK · April 24

here are the logs when the tunnel drops

log-ipsec-2024_04_25.zip

PeterUK · June 2

The problem seems to be Phase 1 SA Life Time for renegotiation the manual says “temporarily disconnects the VPN tunnel” on a short time but I think there is more to it then that being the disconnect is upto 60 seconds should not disconnect that long.

With Phase 1 SA Life Time at 300 the tunnel drops about 10 mins with it set to 2400 its about 1 hour 10mins