Problem with site Certificate Based VPNs

[Agust]

We currently utilize certificate based VPNs between our main cluster and Fortinet and Starlink appliances.
These devices are installed on moving devices.

We see that the VPNs are established but after a while they go down and we were in logs the different types of errors:

"Main mode local machine configured not to responde to unknow IP address and or not included in the remoteaccess community"

"VPN failed to resolve gateway IP address"

We analyzed the SK related to these issues but we understand that they do not apply to this case.

We were also surprised to see inconsistencies in the IPs we had in the established tunnels when we consulted them through the VPN tu tlist command.

Does anyone have any suggestion of what we could analyze?

[the_rock]

What is the sk?

[Agust]

Hi 

The SK are sk132332, sk119301 and sk117713 but none of them apply to our case

[PhoneBoy]

I assume these "moving devices" are Dynamic IP.
Are the necessary interoperable objects defined as such?

One issue with DAIP VPN endpoints is that we don't know what IP address they're coming from.
In the case of a Check Point-managed gateway, most likely there is a persistent connection with management that we can use to determine the remote IP to use.
In the case of interoperable objects, we don't have such a mechanism and can only use traffic initiated from the remote VPN to learn about the IP in use.

I assume the errors occur when the IP association "times out" due to inactivity.
The fix for this is likely to have something periodically generate traffic through the VPN tunnel to keep it (and the IP association) active.
We have a mechanism called network probe to do this periodically starting in R82.
If on an earlier release, some other host will need to periodically generate traffic.

[Agust]

Hello PhoneBoy
Thank you very much for your response. We're using DAIP in this case to use certificates.
I asked you, would DPD also be a viable option, or would the survey you mentioned earlier only work for us in this case?
Thanks

[PhoneBoy]

DPD will definitely help here.

[PhoneBoy]

Implementing DPD definitely won't hurt here.

[Duane_Toler]

Curious... what do you mean by "after a while"?  What time interval (be as precise as you can) is this?

I'll hazard a guess, however: if it's 1 hour, then this is an IPsec phase 2 re-key issue.  Make sure you have the VPN control connections enabled in your Global Properties, or be certain to have IPsec NAT-Traversal (UDP 4500) allowed in your ruleset.