Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 

IPSec VPN tunnel stuck at phase 1 ESP traffic dropped

Hi all,

 

So, we're currently having issue with our IPSec vpn tunnel, where all of the tunnels stuck at phase 1 when i saw the status on SmartView Monitor. Btw, we are using ClusterXL that has two cluster member (80.20 gateway).

Log for outbound traffic via ipsec tunnel shows encrypted status. But there is no inbound traffic.

Our log indicates that ESP Traffics are dropped and "Packet is dropped because an IPsec SA associated with the SPI on the received IPsec packet could not be found" and there is also error regarding Unknown SPI.

I looked for list of IKE and IPSEC sa using "vpn tu" on the active cluster member (FW-1). It showed nothing. There are no IKE and IPSEC sa on the active cluster. But on the standby member (FW-2), it showed the list of IKE and IPSEC sa.

I tried to bring up the standby member (FW-2), but the error still the same. Now it's the opposite. The IPSEC and IKE did not show up on FW-1 (active member), but they were present on the FW-2 (standby member).

Now i'm thinking about disabling and enabling the IPSec VPN software blade for the cluster. how do you think of this?

Kindly need your help and advise regarding this issues.

TO READ THE FULL POST it's simple and free

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events