topic VPN & fwconn_key_init_links (OUTBOUND) failed in Firewall and Security Management

VPN & fwconn_key_init_links (OUTBOUND) failed

Benoit_Verove — Tue, 27 Nov 2018 21:42:45 GMT

Hi Checkmates,

We are working on a migration project and we are facing a strange issue.

The architecture is quite simple :

- Cluster of 5800 appliances, R80.10 + jumbo 154

- Management is a R80.10 VM.

Everything seems fine except VPN. Only 4 VPN amongs 7 are working. Not always the same, but never more than 4.

For the failed VPNs, we've discovered that outgoing IKE packet are dropped by the active member :

;[cpu_7];[fw4_0];fw_log_drop_ex: Packet proto=17 a.a.a.a:500 -> b.b.b.b:500 dropped by fw_conn_post_inspect Reason: fwconn_key_init_links (OUTBOUND) failed;

a.a.a.a : cluster IP

b.b.b.b : peer IP

We have contacted the TAC and they've collected multiples captures. For now, nobody seems to be able to explain why the gateway drops its own IKE packets.

According to TAC, sk124732 doesn't applied.

If anyone knows what "fwconn_key_init_links (OUTBOUND) failed" could means ...

Thanks for your help !

Re: VPN & fwconn_key_init_links (OUTBOUND) failed

PhoneBoy — Wed, 28 Nov 2018 04:49:50 GMT

The error message seems to be NAT related, specifically when the attempt to NAT fails for one reason or another.

It comes up here (among other places): Traffic is not NATed correctly

Re: VPN & fwconn_key_init_links (OUTBOUND) failed

Benoit_Verove — Wed, 28 Nov 2018 08:28:04 GMT

Hi Dameon,

Thanks for the hint. Indeed something seems to go wrong with NAT. I will also check if the sk41916 might applied

Regards,

Benoit

Re: VPN & fwconn_key_init_links (OUTBOUND) failed

Hugo_vd_Kooij — Wed, 28 Nov 2018 09:00:05 GMT

Also make sure it is not the backup firewall sending out packets through the primary.

This is something we see a lof if people start to monitor both firewalls with SNMP over the VPN connection.

Re: VPN & fwconn_key_init_links (OUTBOUND) failed

Benoit_Verove — Tue, 11 Dec 2018 14:26:55 GMT

Hi,

We finaly solved our issue. It was a simple NAT rules that was conflicting with IKE trafic.... Rebuilding a narrowed NAT rule, and all the VPN came up !

Regards,

Benoit

Re: VPN & fwconn_key_init_links (OUTBOUND) failed

jslima — Wed, 22 May 2024 12:40:41 GMT

Hi,

How did you resolved? My customer is using a openserver cluster with R80.40 take 161 and we have an issue related to VPN Site-to-site. The tunnel is established but during the day, some times the tunnel is disconnected and come up later. We´ve tried some configurations to avoid it but the tunnel still come down few times on the day.