NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

bzness's avatar
bzness
Aspirant
Oct 01, 2017

VPN between 2 netgear routers keeps dropping

I have 2 networks that are connnected with a VPN tunnel through 2 Netgear firewalls. One is an FVS318G (firmware 3.3.3-18), the other ons is an SRX(something, can't check right now) 4-WAN box. The s...
Troubleshooting
DaneA's avatar
DaneA
NETGEAR Employee Retired
Oct 02, 2017

Hi bzness,

 

Kindly try to change the SA Lifetime.  Let me share these old forum links below that might help as reference:

 

IPSec SA Lifetime Values

 

SA Lifetime Guidelines for VPN Setup

 

If ever it does not help, delete the existing IKE and VPN policies.  Then, use the VPN Wizard to set up a box-to-box VPN between the FVS318G and SRX5308.  Refer to the link below as reference guide:

 

Configuring a Box to Box VPN on ProSAFE/ProSECURE routers using the VPN Wizard

 

 

Regards,

 

 

DaneA

NETGEAR Community Team

bzness's avatar
bzness
Aspirant
Oct 04, 2017

Ok, so I think I have found a solution and also another problem :-(

 

First the solution: I followed DaneA's advice, deleted the VPN policies and set them up again with the Wizard. Worked, but every time, after a while the connection would drop. I looked at the VPN logs, and I think I know what is going on, but not sure what the solution is.

In order to do have control of both routers at the same time (I can't be in two locations at the same time), I decided to log into one of the routers through my iphone (L2TP). I then went to the other site and did the wizard thing there as well.

The VPN connection was established ... and then dropped after a few minutes. In the VPN log I saw this time that another VPN channels was established (not the one between the two routers). And since I was the only one on the system, that would have to be the VPN connection to my cell phone (iPhone).

 

It therefore seems that the VPN tunnel between the 2 routers is stable until my iPhone breaks it. Is that possible? Can the router not maintain 2 different VPN tunnels at the same time? Why would the 2 tunnels interfere?

 

The reason why I have the iphone VPN in the first place is that when I am on the road I want to be able to tether my laptop to my iPhone and get access to the network (if I am not in WiFi range). that used to work fine until Apple in their infinite wisdom dropped PPTP, and will not even let a device use the iphone to use PPTP. The only options seems to be L2TP, which then breaks my box-to-box VPN.

 

Any solutions for this?

 

 

  • DaneA's avatar
    DaneA
    NETGEAR Employee Retired
    Oct 05, 2017

    bzness,

     

    I believe you are referring to the SRX5308 having both box-to-box IPSec VPN with the FVS318G and L2TP VPN on your iPhone at the same time.  The SRX5308 should be able to handle both VPN connections.  Both VPN connections are dependent to the subscribed bandwidth with your ISP.  

     

    Kindly check this.  The network address of both LANs of the SRX5308 and FVS318G should be different to each other.  For example, if the LAN network address of the SRX5308 is 192.168.1.0, the LAN network address of the FVS318G should 192.168.9.0 or 10.10.10.0.  Also, the starting/ending IP address configured on the L2TP server of the SRX5308 should be different to the LAN IP address of both LANs of the SRX5308 and FVS318G. 

     

     

    Regards,

     

    DaneA

    NETGEAR Community Team

    • bzness's avatar
      bzness
      Aspirant
      Oct 05, 2017

      Hello DaneA,

       

      you are correct, the device that needs to support is an SRX5308, and from what I read, it should be able to support 2 VPN tunnels. While I had my iPhone connected yesterday, the VPN tyunnel kept crashing. Since I disconnected my iphone, the other VPN tunnel has been rock solid (thanks for the suggestiuon with the Wizard. (I am still confused about the IP addresses in the VPN Wizard. the instructions seem to indicate the the "subnet" should be specified with a "starting IP address" of x.x.x.0. I could not get that to work. Only when I entered x.x.x.1 for both subnets did I get a connection).

       

      The internal subnets for the two Netgear boxes have different IP sections 192.168.A.x and 192.168.B.x. The L2TP server is enabled and has a third section (from 192,168.C.100 to 192.168.C.120. The rest of the VPN channels was setup exactly as described in a document I found here for iPhone setups.

      What I do see is that in the VPN policy the "local IP" is defined with the "A" subnet, not the "C" subnet. (the "remote IP" is set to "Any"). Is that correct? 

       

      Thanks.

      • bzness's avatar
        bzness
        Aspirant
        Oct 05, 2017

        Oops, I think I may have spoken too early. My VPN tunnel betweent he two boxes, after being stable for about 10 hours or just crashed again. Here is the log from the SRX5308.

         

        What is going on there?

         

        (Read from bottom)

         

        Thu Oct 05 11:13:57 2017 (GMT -0600): [SRX5308] [IKE] WARNING:  Remote address mismatched. Local=** FV318 IP **[1024], Peer=** FV318 IP **[4500]

        Thu Oct 05 11:13:42 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:13:37 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Adjusting encryption mode to use UDP encapsulation

        Thu Oct 05 11:13:37 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Initiating new phase 2 negotiation: ** SRX IP **[0]<=>** FV318 IP **[0]

        Thu Oct 05 11:13:37 2017 (GMT -0600): [SRX5308] [IKE] INFO:  remote configuration for identifier "** FV318 FDQN**" found

        Thu Oct 05 11:13:37 2017 (GMT -0600): [SRX5308] [IKE] INFO:  remote configuration for identifier "** FV318 FDQN**" found

        Thu Oct 05 11:13:37 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Using IPsec SA configuration: ** SRX internal IP **/24<->** FV318 internal IP **/24

        Thu Oct 05 11:13:37 2017 (GMT -0600): [SRX5308] [IKE] INFO:  an undead schedule has been deleted: 'quick_i1prep'.

        Thu Oct 05 11:13:37 2017 (GMT -0600): [SRX5308] [IKE] ERROR:  Phase 2 negotiation failed due to time up. a71fc7bb5f2faa39:7f468e86bb80c70e:fcab0c88

        Thu Oct 05 11:13:36 2017 (GMT -0600): [SRX5308] [IKE] INFO:  an undead schedule has been deleted: 'quick_r1prep'.

        Thu Oct 05 11:13:36 2017 (GMT -0600): [SRX5308] [IKE] ERROR:  Phase 2 negotiation failed due to time up. a71fc7bb5f2faa39:7f468e86bb80c70e:ebfa912f

        Thu Oct 05 11:13:32 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:13:22 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:13:12 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:13:02 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:12:52 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Adjusting peer's encmode 3(3)->Tunnel(1)

        Thu Oct 05 11:12:52 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Using IPsec SA configuration: ** SRX internal IP **/24<->** FV318 internal IP **/24

        Thu Oct 05 11:12:52 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Responding to new phase 2 negotiation: ** SRX IP **[0]<=>** FV318 IP **[0]

        Thu Oct 05 11:12:52 2017 (GMT -0600): [SRX5308] [IKE] WARNING:  Remote address mismatched. Local=** FV318 IP **[1024], Peer=** FV318 IP **[4500]

        Thu Oct 05 11:12:36 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:12:26 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:12:16 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:12:06 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:11:56 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:11:47 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Adjusting encryption mode to use UDP encapsulation

        Thu Oct 05 11:11:47 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Initiating new phase 2 negotiation: ** SRX IP **[0]<=>** FV318 IP **[0]

        Thu Oct 05 11:11:47 2017 (GMT -0600): [SRX5308] [IKE] INFO:  remote configuration for identifier "** FV318 FDQN**" found

        Thu Oct 05 11:11:47 2017 (GMT -0600): [SRX5308] [IKE] INFO:  remote configuration for identifier "** FV318 FDQN**" found

        Thu Oct 05 11:11:47 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Using IPsec SA configuration: ** SRX internal IP **/24<->** FV318 internal IP **/24

        Thu Oct 05 11:11:46 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Adjusting peer's encmode 3(3)->Tunnel(1)

        Thu Oct 05 11:11:46 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Using IPsec SA configuration: ** SRX internal IP **/24<->** FV318 internal IP **/24

        Thu Oct 05 11:11:46 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Responding to new phase 2 negotiation: ** SRX IP **[0]<=>** FV318 IP **[0]

        Thu Oct 05 11:11:46 2017 (GMT -0600): [SRX5308] [IKE] WARNING:  Remote address mismatched. Local=** FV318 IP **[1024], Peer=** FV318 IP **[4500]

        Thu Oct 05 11:01:34 2017 (GMT -0600): [SRX5308] [IKE] INFO:  an undead schedule has been deleted: 'quick_r1prep'.

        Thu Oct 05 11:01:34 2017 (GMT -0600): [SRX5308] [IKE] ERROR:  Phase 2 negotiation failed due to time up. a71fc7bb5f2faa39:7f468e86bb80c70e:88773864

        Thu Oct 05 11:00:34 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:00:24 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:00:14 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 11:00:04 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Thu Oct 05 10:59:54 2017 (GMT -0600): [SRX5308] [IKE] NOTIFY:  The packet is retransmitted by ** FV318 IP **[4500].

        Things go wrong from here

        Thu Oct 05 10:59:44 2017 (GMT -0600): [SRX5308] [IKE] INFO:  [IPSEC_VPN] IPsec-SA expired: ESP/Tunnel ** FV318 IP **->** SRX IP ** with spi=198848481(0xbda2fe1)

        Thu Oct 05 10:59:44 2017 (GMT -0600): [SRX5308] [IKE] INFO:  [IPSEC_VPN] IPsec-SA expired: ESP/Tunnel ** SRX IP **->** FV318 IP ** with spi=40085881(0x263a979)

        Thu Oct 05 10:59:44 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Adjusting peer's encmode 3(3)->Tunnel(1)

        Thu Oct 05 10:59:44 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Using IPsec SA configuration: ** SRX internal IP **/24<->** FV318 internal IP **/24

        Thu Oct 05 10:59:44 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Responding to new phase 2 negotiation: ** SRX IP **[0]<=>** FV318 IP **[0]

        Thu Oct 05 10:59:44 2017 (GMT -0600): [SRX5308] [IKE] WARNING:  Remote address mismatched. Local=** FV318 IP **[1024], Peer=** FV318 IP **[4500]

        Thu Oct 05 10:11:43 2017 (GMT -0600): [SRX5308] [IKE] INFO:  IPsec-SA established[UDP encap 4500->1024]: ESP/Tunnel ** SRX IP **->** FV318 IP ** with spi=40085881(0x263a979)

        Thu Oct 05 10:11:43 2017 (GMT -0600): [SRX5308] [IKE] INFO:  IPsec-SA established[UDP encap 1024->4500]: ESP/Tunnel ** FV318 IP **->** SRX IP ** with spi=198848481(0xbda2fe1)

        Thu Oct 05 10:11:43 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Adjusting peer's encmode 3(3)->Tunnel(1)

        Thu Oct 05 10:11:42 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Using IPsec SA configuration: ** SRX internal IP **/24<->** FV318 internal IP **/24

        Thu Oct 05 10:11:42 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Responding to new phase 2 negotiation: ** SRX IP **[0]<=>** FV318 IP **[0]

        Thu Oct 05 10:11:41 2017 (GMT -0600): [SRX5308] [IKE] INFO:  [IPSEC_VPN] IPsec-SA expired: ESP/Tunnel ** FV318 IP **->** SRX IP ** with spi=189094225(0xb455951)

        Thu Oct 05 10:11:41 2017 (GMT -0600): [SRX5308] [IKE] INFO:  [IPSEC_VPN] IPsec-SA expired: ESP/Tunnel ** SRX IP **->** FV318 IP ** with spi=219314876(0xd127abc)

        Thu Oct 05 09:25:26 2017 (GMT -0600): [SRX5308] [IKE] ERROR:  the length of the isakmp header is too big.

        Something happened.

        Thu Oct 05 09:23:40 2017 (GMT -0600): [SRX5308] [IKE] INFO:  IPsec-SA established[UDP encap 4500->1024]: ESP/Tunnel ** SRX IP **->** FV318 IP ** with spi=219314876(0xd127abc)

        Thu Oct 05 09:23:40 2017 (GMT -0600): [SRX5308] [IKE] INFO:  IPsec-SA established[UDP encap 1024->4500]: ESP/Tunnel ** FV318 IP **->** SRX IP ** with spi=189094225(0xb455951)

        Thu Oct 05 09:23:40 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Adjusting peer's encmode 3(3)->Tunnel(1)

        Thu Oct 05 09:23:40 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Using IPsec SA configuration: ** SRX internal IP **/24<->** FV318 internal IP **/24

        Thu Oct 05 09:23:40 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Responding to new phase 2 negotiation: ** SRX IP **[0]<=>** FV318 IP **[0]

        Thu Oct 05 09:23:39 2017 (GMT -0600): [SRX5308] [IKE] INFO:  [IPSEC_VPN] IPsec-SA expired: ESP/Tunnel ** FV318 IP **->** SRX IP ** with spi=198267160(0xbd15118)

        Thu Oct 05 09:23:39 2017 (GMT -0600): [SRX5308] [IKE] INFO:  [IPSEC_VPN] IPsec-SA expired: ESP/Tunnel ** SRX IP **->** FV318 IP ** with spi=238270361(0xe33b799)

        Still OK

        Thu Oct 05 08:35:38 2017 (GMT -0600): [SRX5308] [IKE] INFO:  IPsec-SA established[UDP encap 4500->1024]: ESP/Tunnel ** SRX IP **->** FV318 IP ** with spi=238270361(0xe33b799)

        Thu Oct 05 08:35:38 2017 (GMT -0600): [SRX5308] [IKE] INFO:  IPsec-SA established[UDP encap 1024->4500]: ESP/Tunnel ** FV318 IP **->** SRX IP ** with spi=198267160(0xbd15118)

        Thu Oct 05 08:35:37 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Adjusting peer's encmode 3(3)->Tunnel(1)

        Thu Oct 05 08:35:37 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Using IPsec SA configuration: ** SRX internal IP **/24<->** FV318 internal IP **/24

        Thu Oct 05 08:35:37 2017 (GMT -0600): [SRX5308] [IKE] INFO:  Responding to new phase 2 negotiation: ** SRX IP **[0]<=>** FV318 IP **[0]

        Thu Oct 05 08:35:36 2017 (GMT -0600): [SRX5308] [IKE] INFO:  [IPSEC_VPN] IPsec-SA expired: ESP/Tunnel ** FV318 IP **->** SRX IP ** with spi=261552496(0xf96f970)

        Thu Oct 05 08:35:36 2017 (GMT -0600): [SRX5308] [IKE] INFO:  [IPSEC_VPN] IPsec-SA expired: ESP/Tunnel ** SRX IP **->** FV318 IP ** with spi=143950036(0x89480d4)

        Start here: Everything is OK

NETGEAR Academy

Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology! 

Join Us!

ProSupport for Business

Comprehensive support plans for maximum network uptime and business peace of mind.

 

Learn More