Something to keep in mind when VPN tunnel is down

[the_rock]

Hey guys,

I know these settings in Guidbedit might not always be relevent, specially in newer versions, but I did come across few scenarios lately, in R81.20 as a matter of fact, where we had to go to guidbedit and set below values to false to get VPN tunnel to work:

ike_enable_supernet

ike_p2_enable_supernet_from_R80.20

ike_use_largest_possible_subnets

I sometimes also check this on the gateway, though this was only problem few times, so probably not a requirement, but also something to consider:

gateway object -> other -> connection persistence -> I always check keep all connections

Andy

[kamilazat]

Yes! And this can become a daunting issue when trying to set up a tunnel with 3rd party peers. And if you're unlucky enough, even some TAC engineers forget to think about it and a simple solution as this turns into a repeated debugging and messaging back and forth. 

Or if you pay attention during your studies for CCTE, hopefully it won't become that big of an issue 🙂

[the_rock]

Well, its good those sort of things dont happen too often these days, but just something to keep in mind, as I mentioned. Thats why we share ideas on here, to help others out 🙂

Andy

[CaseyB]

Do you think these still come into play when using granular encryption domains?

[the_rock]

Hey @CaseyB 

I can only speak from my own experience and here it is 🙂

Ever since R80 came out, I had never seen this issue with Azure, AWS or Fortinet, ONLY with Palo Alto and Cisco. Cant say if thats case with others, but thats what I had observed.

Andy

[the_rock]

One thing I also found from time to time, depending on 3rd party vendor, is that say even if ONLY subnets are involved, you still may need to select "per gateway" in tunnel management tab of the VPN community.

Andy

[G_W_Albrecht]

Sources:

sk108600: VPN Site-to-Site with 3rd party

sk101219: VPN features in R80.x and R81.x versions

sk144094: VPN tunnels with 3rd party peers fail because of mismatched IDs

[the_rock]

All great references @G_W_Albrecht 

[the_rock]

Btw, that last sk, never seen it before, but ran the command in R82 and it worked.

Thank you!

Andy