topic Re: VPN SITE TO SITE in General Topics

VPN SITE TO SITE

Gacki — Tue, 20 Dec 2022 08:46:15 GMT

Hello,

I set up a vpn site to site with a partner, unfortunately after 30 minutes from setting up the vpn stops going through the second phase of IKE, what could be the problem?
We have the same vpn settings for phase 1 and phase 2

Thank you.

Re: VPN SITE TO SITE

G_W_Albrecht — Tue, 20 Dec 2022 09:30:07 GMT

What about the peers details ? What is the error shown in logs ?

Re: VPN SITE TO SITE

Blason_R — Tue, 20 Dec 2022 10:49:14 GMT

VPN v1 or v2?

Start debug and see where is that failing. Hope you are aware of vpn debug commands?

vpn debug trunc

vpn debug ikeon

vpn debug on

once done

vpn debug ikeoff

vpn debug off

fw ctl debug 0

Re: VPN SITE TO SITE

G_W_Albrecht — Tue, 20 Dec 2022 11:41:27 GMT

> VPN v1 or v2?

You mean IKE ?

Re: VPN SITE TO SITE

Blason_R — Wed, 21 Dec 2022 05:37:20 GMT

That is correct - Wondering what was the IKE version and what is the tunnel type? Route based or policy based?

Re: VPN SITE TO SITE

G_W_Albrecht — Wed, 21 Dec 2022 08:30:21 GMT

Did not answer...

Re: VPN SITE TO SITE

Gacki — Wed, 21 Dec 2022 08:33:17 GMT

Policy base, IKEv2

Re: VPN SITE TO SITE

G_W_Albrecht — Wed, 21 Dec 2022 09:27:50 GMT

So give us information - we only know that you have two VPN peers and use IKEv2, but no more details: no error messages, no log entries, so nobody can tell you anything usefull by now...

Re: VPN SITE TO SITE

G_W_Albrecht — Wed, 21 Dec 2022 12:12:32 GMT

I would suggest that you contact TAC - a quick RAS could find the issue easily and it will be resolved soon. As you do not want to explain anything here i see no other possible way...

Re: VPN SITE TO SITE

the_rock — Wed, 21 Dec 2022 15:00:38 GMT

I agree with @G_W_Albrecht . You did not give us much info, except its ikev2 and policy based. Thats great, but as he said, we need errors, logs you see, where it fails, phase 1, phase 2? @Blason_R provided you excellent basic VPN debug that TAC would ask you to do anyway, but you may as well call them and get this fixed, way better over remote.

Re: VPN SITE TO SITE

Lloyd_Braun — Wed, 21 Dec 2022 18:39:14 GMT

I have had issues with Cisco ASA VPN peers that leave their default vpn-idle-timeout at 30 minutes.

Re: VPN SITE TO SITE

Blason_R — Thu, 22 Dec 2022 03:18:49 GMT

Or best way I would recommend is try disabling vpn acceleration. That has helped me lot many times.

vpn accel off -> This would reinitialize the IKE session.