Site to site vpn drops on policy install

[iancollins]

I have about 8 site to site vpn connections to customers on our R80.30 firewall.

When I install policy changes, some of these connections drop out. Using vpn tu option 7 fixes it.
I've seen various discussions about this - but am unsure what to try.

We currently have "rematch connections" in the connections persistence settings. Is this the best setting - or are there any recommendations for "keep data connections" or "keep all connections"?

How about overriding the default settings in the services in the ipsec service group - and setting "Keep connections open after the policy has been installed"?

Thanks, Ian

[Timothy_Hall · Accepted solution]

Try setting the keep_IKE_SAs checkbox as described here:

sk142355: VPN tunnel goes down after policy push, must be reset to bring it up