Remote access IPSec stability

Options
kelmi
kelmi Posts: 63
First Comment Friend Collector Eighth Anniversary
image  Ally Member
edited October 9 in USG FLEX H Series

Hello,

While testing Remote Access IPSec with iPhones, I have noticed that stability with Phase2 AES256GCM is not so stable compared to AES256. E.g when iPhone screensaver goes on, AES256 tunnel remains active, while AES256GCM tunnel tends to break.

Phase 1 proposal in both the cases is AES256/SHA256. Latest iOS in use, latest 50H 139 firmware in use as well.

For AES256GCM, there are two messages in the log file:

  1. In trap, IKE_SA: RemoteAccess, resolve other: %any
  2. User abc(MAC=) from eap-cfg has logged out Device

This happens more easily, if iPhone is in 4G/5G network, not so often, if iPhone is in WiFi.

Anyone else having equal experiences?

K

All Replies

  • Zyxel_Luna
    Zyxel_Luna Posts: 113
    5 Answers First Comment Friend Collector
    image  Zyxel Employee
    edited October 15
    Options

    Hi @kelmi,
    Test Results & Findings:

    We conducted local testing using an iPhone running iOS 27 over 4G/5G cellular networks via a Remote Access VPN (with Phase 2 encryption configured as AES256-GCM), and observed that the connection does not disconnect frequently in standby or lock-screen mode.

    Instead, the connection remains stable in standby and can last anywhere from 30 minutes to over an hour. It only disconnects after prolonged idle standby (at least 30 minutes or more), which is most likely the intended behavior of iOS to manage background resources .

    Could you please provide the following information?

    Regarding the frequent drops you experienced on 4G/5G, could you let us know the approximate disconnection frequency (e.g., every 3 minutes, 5 minutes, etc.)?

    (Note: Frequent disconnections on cellular networks are often related to the carrier's NAT session timeout or signal handovers, and having the exact drop interval will help us pinpoint the cause.)

    Please also export the relevant VPN logs under Log & Report > Log / Events > System and send them to us via PM so we can investigate further.

    Remote Support Access:

    If possible, please enable Zyxel Remote Support Access by following the guide below, and provide us with your Organization and Site names.

    [Nebula] How to turn on Zyxel Support Access? — Zyxel Community

    Thank you.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）