Capsule VPN tries to use SSL after IPSec connection timeout

[emiev_av]

Hello, friends!

A small number of users have encountered an issue where after reaching an inactivity timeout of 15 minutes, reconnection fails and the VPN client hangs in reconnection status.

While reading the logs, I noticed an interesting behavior where after an IPSec session is timed out, the application tries to establish SSL connection. Is this behavior normal?

I will attach a part of the debug file where the real IP addresses are replaced with random ones.

[Chris_Atkinson]

What is the client OS used?

Automatic Reconnect
• On – When connectivity is broken, the application tries to reconnect as long as there is network available.
• Off – When connectivity is broken, the application tries to reconnect for 120 seconds. After this time, the application disconnects from the VPN site.
You can select the Off setting to use less battery on the device.

Custom Data Fields
These are the keys that can be used in the Custom Data screen:
• tuntype - possible values: kmp (IPsec tunnel) or snx (SSL tunnel)

[emiev_av]

Both iOS and Android

[emiev_av]

@Chris_Atkinsonthank you for your response. What's interesting is that I don't see any issues on the majority of clients that are installed on both Android an iOS. The logs I uploaded earlier, for example, are from an Android device.

Is there any documentation that provides instructions as to how to make the changes? I have not been able to find any information on the internet. I need to apply tuntype for Androin and iOS. Could you please give more information about Custom Data? And does the Capsule client really automatically switch to SSL if it fails on IPSec?

[Chris_Atkinson]

There are two knowledge articles that link to the admin guide but the links are broken, have requested they be fixed.

I'll aim to attach an old version of the guide and provide the SK details when I'm back in front of a PC.

Refer: sk105462, sk107536

[Chris_Atkinson]

Attached as promised the version from my archive.

[emiev_av]

Thanks for providing the documentation and SK. In adminguide it says: “You can set the VPN tunnel type to IPsec or SSL for the client”. Very interesting, can the app spontaneously change the tuntype value, in case of a failed connection over one vpn type? I didn't find such information in the provided documentation, but in the logs it looks like this scenario is happening

[PhoneBoy]

If there are connectivity issues using UDP 4500 (NAT-T), the client will switch to Visitor Mode (TCP 443).
This is known, expected behavior.