vpn tunnel active but no trafic flowing through

pnobels — Fri, 12 Jan 2024 09:28:18 GMT

Hi,

having something strange...

Setup site-to-site vpn, onse side VSX cluster instance running R81.10 take 110, other side azure single fw running R81.10 take 78.

We see several vpn tunnels between the two are up. But sometimes we get complaints that there is no trafic flowing through. Typically this feedback comes from developers who are accessing some database in the specified subnet in Azure.

The issue appears and dissappears by itself. The source and destination subnets are not always the same.

An fw monitor shows us the trafic arrives on the VSX. But does not arrive on the azure gw.

Yesterday, i remarked that the affected tunnel started working again, at what i expect is the same time the tunnel is actually expiring (or what i believe is an ike renegotiation taking place?).

There's nothing being blocked, dropped or rejected in the logs. This environment has been running for at least ten years btw (altough upgraded, and the azure cloud connection was introduced a few years ago).

We use permanent tunnels, and seperate tunnels per subnet.

I suspect the issue popped up after we upgraded the vsx environment from take 66 to take 110.

Does this ring a bell with anyone? I'm thinking of upgrading the azure gw to take 110. Or restoring a snapshot to take 66 on one of the vsx members.

Yes, we have an open support ticket. So far no bug has been found. But i also wanted to check here if there are people running a similar environment on take 110 and have seen this issue before or not?

__PRESENT

Re: vpn tunnel active but no trafic flowing through

Machine_Head — Fri, 12 Jan 2024 11:36:46 GMT

I think you are right, first step here should be upgrading the Azure gw latest recommended JHF.

79 is fairly old and probably some behavior changes were introduced in later takes that are producint this issue

topic Re: vpn tunnel active but no trafic flowing through in Cloud Firewall

vpn tunnel active but no trafic flowing through

Re: vpn tunnel active but no trafic flowing through