NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
VPN between 2 netgear routers keeps dropping
I am trying to set up a stable VPN tunnel between an FVS318G on one site, and an SRX5308 at another site. Both are connected to Xfinity modems, and both have stable internet connections, the SRX has a fixed IP address, the FVS318G a dynamic address managed through no-ip.
I can set up a tunnel and it is stable for something like 10 - 12 hours, then it crashes. I think it also crashes when I try to use an L2TP login I have set up for my iPhone (that tunnel stays open, the box-to-box channel crashes).
The weird thing is when the tunnel crashes, box boxes still report the tunnel as open, but I can't access resources across the tunnel. Here is the VPN log of the FVS318. I have replaced the external IP addresses with "** ext IP ...", and masked the internal addresses.
There is a bit of weird stuff going on at 11:42, but in the end the firewall reports that VPN tunnels have been established between the extrenal IP addresses of the two firewalls (as usual, read from bottom):
2017 Oct 7 12:42:49 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel ** ext IP FVS318 **->** ext IP SRX ** with spi=170635942(0xa2bb2a6)_
2017 Oct 7 12:42:49 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel ** ext IP SRX **->** ext IP FVS318 ** with spi=40115734(0x2641e16)_
2017 Oct 7 12:42:48 [FVS318g] [IKE] IPsec-SA expired: ESP/Tunnel ** ext IP SRX **->** ext IP FVS318 ** with spi=140963799(0x866efd7)_
2017 Oct 7 12:42:48 [FVS318g] [IKE] Initiating new phase 2 negotiation: ** ext IP FVS318 **[0]<=>** ext IP SRX **[0]_
2017 Oct 7 12:42:48 [FVS318g] [IKE] Configuration found for ** ext IP SRX **._
2017 Oct 7 12:42:48 [FVS318g] [IKE] IPsec-SA expired: ESP/Tunnel ** ext IP FVS318 **->** ext IP SRX ** with spi=46243066(0x2c19cfa)_
2017 Oct 7 11:54:47 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel ** ext IP FVS318 **->** ext IP SRX ** with spi=46243066(0x2c19cfa)_
2017 Oct 7 11:54:47 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel ** ext IP SRX **->** ext IP FVS318 ** with spi=140963799(0x866efd7)_
2017 Oct 7 11:54:47 [FVS318g] [IKE] Purged IPsec-SA with proto_id=ESP and spi=14134305(0xd7ac21)._
2017 Oct 7 11:54:47 [FVS318g] [IKE] Purged IPsec-SA with proto_id=ESP and spi=193914864(0xb8ee7f0)._
2017 Oct 7 11:54:47 [FVS318g] [IKE] an undead schedule has been deleted: 'pk_recvupdate'._
2017 Oct 7 11:54:47 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel ** ext IP SRX **->** ext IP FVS318 ** with spi=14134305(0xd7ac21)_
2017 Oct 7 11:54:45 [FVS318g] [IKE] Initiating new phase 2 negotiation: ** ext IP FVS318 **[0]<=>** ext IP SRX **[0]_
2017 Oct 7 11:54:44 [FVS318g] [IKE] Using IPsec SA configuration: xxx.xxx.0.0/24<->xxx.xxx.3.1/24_
2017 Oct 7 11:54:44 [FVS318g] [IKE] Responding to new phase 2 negotiation: ** ext IP FVS318 **[0]<=>** ext IP SRX **[0]_
2017 Oct 7 11:54:44 [FVS318g] [IKE] Sending Informational Exchange: notify payload[608]_
2017 Oct 7 11:54:44 [FVS318g] [IKE] ISAKMP-SA established for ** ext IP FVS318 **[500]-** ext IP SRX **[500] with spi:12b13c141c03bb78:e887aef8f5b12e24_
2017 Oct 7 11:54:43 [FVS318g] [IKE] NAT not detected _
2017 Oct 7 11:54:43 [FVS318g] [IKE] NAT-D payload matches for ** ext IP SRX **[500]_
2017 Oct 7 11:54:43 [FVS318g] [IKE] NAT-D payload matches for ** ext IP FVS318 **[500]_
2017 Oct 7 11:54:43 [FVS318g] [IKE] Received Vendor ID: KAME/racoon_
2017 Oct 7 11:54:43 [FVS318g] [IKE] Configuration found for ** ext IP SRX **._
2017 Oct 7 11:54:43 [FVS318g] [IKE] Using IPsec SA configuration: xxx.xxx.0.0/24<->xxx.xxx.3.1/24_
2017 Oct 7 11:54:43 [FVS318g] [IKE] Setting DPD Vendor ID_
2017 Oct 7 11:54:42 [FVS318g] [IKE] For ** ext IP SRX **[500], Selected NAT-T version: RFC XXXX_
2017 Oct 7 11:54:42 [FVS318g] [IKE] DPD is Enabled_
2017 Oct 7 11:54:42 [FVS318g] [IKE] Received Vendor ID: DPD_
2017 Oct 7 11:54:42 [FVS318g] [IKE] Received unknown Vendor ID_
2017 Oct 7 11:54:42 [FVS318g] [IKE] Received Vendor ID: draft-ietf-ipsec-nat-t-ike-02__
2017 Oct 7 11:54:42 [FVS318g] [IKE] Received Vendor ID: RFC XXXX_
2017 Oct 7 11:54:42 [FVS318g] [IKE] Beginning Identity Protection mode._
2017 Oct 7 11:54:42 [FVS318g] [IKE] Received request for new phase 1 negotiation: ** ext IP FVS318 **[500]<=>** ext IP SRX **[500]_
2017 Oct 7 11:54:42 [FVS318g] [IKE] Configuration found for ** ext IP SRX **[500]._
- Last output repeated 9 times -
2017 Oct 7 11:42:41 [FVS318g] [IKE] Could not find configuration for ** ext IP SRX **[1]_
2017 Oct 7 11:42:31 [FVS318g] [IKE] IPsec-SA expired: ESP/Tunnel ** ext IP SRX **->** ext IP FVS318 ** with spi=181435667(0xad07d13)_
2017 Oct 7 11:42:31 [FVS318g] [IKE] IPsec-SA expired: ESP/Tunnel ** ext IP FVS318 **->** ext IP SRX ** with spi=258919417(0xf6ecbf9)_
2017 Oct 7 11:42:30 [FVS318g] [IKE] Could not find configuration for ** ext IP SRX **[1]_
2017 Oct 7 11:42:10 [FVS318g] [IKE] ISAKMP-SA deleted for ** ext IP FVS318 **[500]-** ext IP SRX **[500] with spi:265d9a2f627fe9a6:98040755a4dfcdf2_
2017 Oct 7 11:42:09 [FVS318g] [IKE] Sending Informational Exchange: delete payload[]_
2017 Oct 7 11:42:09 [FVS318g] [IKE] ISAKMP-SA expired ** ext IP FVS318 **[500]-** ext IP SRX **[500] spi:265d9a2f627fe9a6:98040755a4dfcdf2_
2017 Oct 7 11:01:54 [FVS318g] [IKE] ISAKMP-SA deleted for ** ext IP FVS318 **[4500]-** ext IP SRX **[4500] with spi:9b4321b0651585bd:b4fd24c96dadad11_
2017 Oct 7 11:01:53 [FVS318g] [IKE] Sending Informational Exchange: delete payload[]_
2017 Oct 7 11:01:53 [FVS318g] [IKE] ISAKMP-SA expired ** ext IP FVS318 **[4500]-** ext IP SRX **[4500] spi:9b4321b0651585bd:b4fd24c96dadad11_
2017 Oct 7 10:54:30 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel ** ext IP FVS318 **->** ext IP SRX ** with spi=258919417(0xf6ecbf9)_
2017 Oct 7 10:54:30 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel ** ext IP SRX **->** ext IP FVS318 ** with spi=181435667(0xad07d13)_
On the SRX side the whole story looks like this:
It reports (at 11:54) that a tunnel is established between the external IPs of the boxes. then the SA expires and after the renegotiation is done (12:42) The SRX again reports that a tunnel has been established, but this time between the WAN address of the FVS318 and the LAN address of the SRX:
Sat Oct 07 12:42:49 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA established: ESP/Tunnel xxx.xxx.3.1->** ext IP FVS318 ** with spi=40115734(0x2641e16)
Sat Oct 07 12:42:49 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA established: ESP/Tunnel ** ext IP FVS318 **->xxx.xxx.3.1 with spi=170635942(0xa2bb2a6)
Sat Oct 07 12:42:48 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 12:42:48 2017 (GMT -0600): [SRX5308] [IKE] INFO: Responding to new phase 2 negotiation: xxx.xxx.3.1[0]<=>** ext IP FVS318 **[0]
Sat Oct 07 12:42:48 2017 (GMT -0600): [SRX5308] [IKE] INFO: Floating ports for NAT-T with peer ** ext IP FVS318 **[500]
Sat Oct 07 12:42:47 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA expired: ESP/Tunnel ** ext IP FVS318 **->** ext IP SRX **with spi=46243066(0x2c19cfa)
Sat Oct 07 12:42:47 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA expired: ESP/Tunnel 23.24.148.81->** ext IP FVS318 ** with spi=140963799(0x866efd7)
Sat Oct 07 12:42:46 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA expired: ESP/Tunnel ** ext IP FVS318 **->** ext IP SRX **with spi=193914864(0xb8ee7f0)
Sat Oct 07 11:54:46 2017 (GMT -0600): [SRX5308] [IKE] INFO: an undead schedule has been deleted: 'pk_recvupdate'.
Sat Oct 07 11:54:46 2017 (GMT -0600): [SRX5308] [IKE] INFO: Sending Informational Exchange: delete payload[]
Sat Oct 07 11:54:46 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA established: ESP/Tunnel 23.24.148.81->** ext IP FVS318 ** with spi=140963799(0x866efd7)
Sat Oct 07 11:54:46 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA established: ESP/Tunnel ** ext IP FVS318 **->** ext IP SRX **with spi=46243066(0x2c19cfa)
Sat Oct 07 11:54:45 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
At that point I lost the ability to access resources across the tunnel. So, the tunnel is stable for 10-12 hours, then something happens that makes it impossible to transmit data. On both sstems the logs show that a tunnel is established, but on the srx the tunnel switches from between the WAN addresses of the boxes to between the WAN address of one and the LAN address of the other. I don't know if that is the problem, but it seems strange to me.
I set the tunnel up as described in a document from this site, using the VPN Wizards. The lifetimes are set to 3,600 and 28,800 (defaults).
I shuldmention that I have fighting this for days. At one time I updated the firmware on the srx and that broke everything. I could not establish even contact between the boxes. Reverting to the older firmware fixed that again. The FVS318 has the latest firmware installed.
I should also mention that i Have another post going with the same problem here, but after I got a response that in the end turned out not helping, it has been quiet, without any responses.
8 Replies
It gets weirder:
While I was writing the post above, the problem fixed itself !! I am posting below the log from the SRX. As you can see after a lengthy negotiation, the SRX ended up again with tunnels between the WAN addresses of the boxes, and lo and bhold, I can access data again. So, why would the SRX switch from the WAN address to the LAN address? I don't know too little about the intricacies of the VPN negotiations to follow the log from where it lost the WAN address to where it corrected itself, but someone must have seen this before. What is the problem here?
I have to split the log into 2 posts, as there is a limit on length.
Sat Oct 07 13:25:42 2017 (GMT -0600): [SRX5308] [IKE] INFO: an undead schedule has been deleted: 'pk_recvupdate'.
Sat Oct 07 13:25:42 2017 (GMT -0600): [SRX5308] [IKE] INFO: Sending Informational Exchange: delete payload[]
Sat Oct 07 13:25:42 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA established: ESP/Tunnel ** ext IP SRX **->** ext IP FVS318 ** with spi=4365434(0x429c7a)
Sat Oct 07 13:25:42 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA established: ESP/Tunnel ** ext IP FVS318 **->** ext IP SRX ** with spi=131648604(0x7d8cc5c)
Sat Oct 07 13:25:42 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:25:42 2017 (GMT -0600): [SRX5308] [IKE] INFO: Responding to new phase 2 negotiation: ** ext IP SRX **[0]<=>** ext IP FVS318 **[0]
Sat Oct 07 13:25:41 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA established: ESP/Tunnel ** ext IP SRX **->** ext IP FVS318 ** with spi=153273464(0x922c478)
Sat Oct 07 13:25:41 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA established: ESP/Tunnel ** ext IP FVS318 **->** ext IP SRX ** with spi=116393517(0x6f0062d)
Sat Oct 07 13:25:40 2017 (GMT -0600): [SRX5308] [IKE] INFO: Initiating new phase 2 negotiation: ** ext IP SRX **[0]<=>** ext IP FVS318 **[0]
Sat Oct 07 13:25:40 2017 (GMT -0600): [SRX5308] [IKE] INFO: Sending Informational Exchange: notify payload[INITIAL-CONTACT]
Sat Oct 07 13:25:40 2017 (GMT -0600): [SRX5308] [IKE] INFO: ISAKMP-SA established for ** ext IP SRX **[500]-** ext IP FVS318 **[500] with spi:070ddfe8d3a00374:177ee617632b23e6
Sat Oct 07 13:25:39 2017 (GMT -0600): [SRX5308] [IKE] INFO: NAT not detected
Sat Oct 07 13:25:39 2017 (GMT -0600): [SRX5308] [IKE] INFO: NAT-D payload matches for ** ext IP FVS318 **[500]
Sat Oct 07 13:25:39 2017 (GMT -0600): [SRX5308] [IKE] INFO: NAT-D payload matches for ** ext IP SRX **[500]
Sat Oct 07 13:25:39 2017 (GMT -0600): [SRX5308] [IKE] INFO: Received Vendor ID: KAME/racoon
Sat Oct 07 13:25:39 2017 (GMT -0600): [SRX5308] [IKE] INFO: For ** ext IP FVS318 **[500], Selected NAT-T version: RFC XXXX
Sat Oct 07 13:25:39 2017 (GMT -0600): [SRX5308] [IKE] INFO: Received Vendor ID: KAME/racoon
Sat Oct 07 13:25:39 2017 (GMT -0600): [SRX5308] [IKE] INFO: Received Vendor ID: DPD
Sat Oct 07 13:25:39 2017 (GMT -0600): [SRX5308] [IKE] INFO: Received Vendor ID: RFC XXXX
Sat Oct 07 13:25:38 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 9
Sat Oct 07 13:25:38 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 8
Sat Oct 07 13:25:38 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 4
Sat Oct 07 13:25:38 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:186]: XXX: NUMNATTVENDORIDS: 3
Sat Oct 07 13:25:38 2017 (GMT -0600): [SRX5308] [IKE] INFO: Beginning Identity Protection mode.
Sat Oct 07 13:25:38 2017 (GMT -0600): [SRX5308] [IKE] INFO: Initiating new phase 1 negotiation: ** ext IP SRX **[500]<=>** ext IP FVS318 **[500]
Sat Oct 07 13:25:38 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:25:38 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:25:38 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:23:53 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 1 negotiation failed due to time up for ** ext IP FVS318 **[500]. 6445c7b073ed5d55:0000000000000000
Sat Oct 07 13:23:50 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:23:18 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:23:18 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:23:18 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:22:34 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:22:03 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 9
Sat Oct 07 13:22:03 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 8
Sat Oct 07 13:22:03 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 4
Sat Oct 07 13:22:03 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:186]: XXX: NUMNATTVENDORIDS: 3
Sat Oct 07 13:22:03 2017 (GMT -0600): [SRX5308] [IKE] INFO: Beginning Identity Protection mode.
Sat Oct 07 13:22:03 2017 (GMT -0600): [SRX5308] [IKE] INFO: Initiating new phase 1 negotiation: ** ext IP SRX **[500]<=>** ext IP FVS318 **[500]
Sat Oct 07 13:22:03 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:22:03 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:22:03 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:21:22 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 1 negotiation failed due to time up for ** ext IP FVS318 **[500]. ae10131a098e29dd:0000000000000000
Sat Oct 07 13:21:16 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:20:45 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:20:45 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:20:45 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:20:05 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:19:32 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 9
Sat Oct 07 13:19:32 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 8
Sat Oct 07 13:19:32 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 4
Sat Oct 07 13:19:32 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:186]: XXX: NUMNATTVENDORIDS: 3
Sat Oct 07 13:19:32 2017 (GMT -0600): [SRX5308] [IKE] INFO: Beginning Identity Protection mode.
Sat Oct 07 13:19:32 2017 (GMT -0600): [SRX5308] [IKE] INFO: Initiating new phase 1 negotiation: ** ext IP SRX **[500]<=>** ext IP FVS318 **[500]
Sat Oct 07 13:19:32 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:19:32 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:19:32 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:18:52 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 1 negotiation failed due to time up for ** ext IP FVS318 **[500]. 12973c2b18d0bc41:0000000000000000
Sat Oct 07 13:18:48 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:18:17 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:18:17 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:18:17 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:17:33 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:17:02 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 9
Sat Oct 07 13:17:02 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 8
Sat Oct 07 13:17:02 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 4
Sat Oct 07 13:17:02 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:186]: XXX: NUMNATTVENDORIDS: 3
Sat Oct 07 13:17:02 2017 (GMT -0600): [SRX5308] [IKE] INFO: Beginning Identity Protection mode.
Sat Oct 07 13:17:02 2017 (GMT -0600): [SRX5308] [IKE] INFO: Initiating new phase 1 negotiation: ** ext IP SRX **[500]<=>** ext IP FVS318 **[500]
Sat Oct 07 13:17:02 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:17:02 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:17:02 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:16:46 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:16:21 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 1 negotiation failed due to time up for ** ext IP FVS318 **[500]. 6603935be3437384:0000000000000000
Sat Oct 07 13:16:14 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:16:14 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:16:14 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:16:09 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:15:38 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:15:38 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:15:38 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Continued in next post.
continuation of log:
Sat Oct 07 13:15:03 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:14:31 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 9
Sat Oct 07 13:14:31 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 8
Sat Oct 07 13:14:31 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 4
Sat Oct 07 13:14:31 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:186]: XXX: NUMNATTVENDORIDS: 3
Sat Oct 07 13:14:31 2017 (GMT -0600): [SRX5308] [IKE] INFO: Beginning Identity Protection mode.
Sat Oct 07 13:14:31 2017 (GMT -0600): [SRX5308] [IKE] INFO: Initiating new phase 1 negotiation: ** ext IP SRX **[500]<=>** ext IP FVS318 **[500]
Sat Oct 07 13:14:31 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:14:31 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:14:31 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:13:51 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 1 negotiation failed due to time up for ** ext IP FVS318 **[500]. 4180b9b0160ae252:0000000000000000
Sat Oct 07 13:13:47 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:13:16 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:13:16 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:13:16 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:12:32 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:12:01 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 9
Sat Oct 07 13:12:01 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 8
Sat Oct 07 13:12:01 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 4
Sat Oct 07 13:12:01 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:186]: XXX: NUMNATTVENDORIDS: 3
Sat Oct 07 13:12:01 2017 (GMT -0600): [SRX5308] [IKE] INFO: Beginning Identity Protection mode.
Sat Oct 07 13:12:01 2017 (GMT -0600): [SRX5308] [IKE] INFO: Initiating new phase 1 negotiation: ** ext IP SRX **[500]<=>** ext IP FVS318 **[500]
Sat Oct 07 13:12:01 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:12:01 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:12:01 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:11:05 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:10:44 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 1 negotiation failed due to time up for ** ext IP FVS318 **[500]. 1e5ebe9e6c54a358:0000000000000000
Sat Oct 07 13:10:34 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:10:34 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:10:34 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:09:25 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:08:54 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 9
Sat Oct 07 13:08:54 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 8
Sat Oct 07 13:08:54 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 4
Sat Oct 07 13:08:54 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:186]: XXX: NUMNATTVENDORIDS: 3
Sat Oct 07 13:08:54 2017 (GMT -0600): [SRX5308] [IKE] INFO: Beginning Identity Protection mode.
Sat Oct 07 13:08:54 2017 (GMT -0600): [SRX5308] [IKE] INFO: Initiating new phase 1 negotiation: ** ext IP SRX **[500]<=>** ext IP FVS318 **[500]
Sat Oct 07 13:08:54 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:08:54 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:08:54 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:06:00 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:05:59 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 1 negotiation failed due to time up for ** ext IP FVS318 **[500]. 2f6f06f556b4937f:0000000000000000
Sat Oct 07 13:05:29 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:05:29 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:05:29 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:04:40 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:04:09 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 9
Sat Oct 07 13:04:09 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 8
Sat Oct 07 13:04:09 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 4
Sat Oct 07 13:04:09 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:186]: XXX: NUMNATTVENDORIDS: 3
Sat Oct 07 13:04:09 2017 (GMT -0600): [SRX5308] [IKE] INFO: Beginning Identity Protection mode.
Sat Oct 07 13:04:09 2017 (GMT -0600): [SRX5308] [IKE] INFO: Initiating new phase 1 negotiation: ** ext IP SRX **[500]<=>** ext IP FVS318 **[500]
Sat Oct 07 13:04:09 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:04:09 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:04:09 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:02:15 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 1 negotiation failed due to time up for ** ext IP FVS318 **[500]. 55783624c7b12310:0000000000000000
Sat Oct 07 13:02:01 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:01:29 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:01:29 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:01:29 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 13:00:56 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 13:00:25 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 9
Sat Oct 07 13:00:25 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 8
Sat Oct 07 13:00:25 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 4
Sat Oct 07 13:00:25 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:186]: XXX: NUMNATTVENDORIDS: 3
Sat Oct 07 13:00:25 2017 (GMT -0600): [SRX5308] [IKE] INFO: Beginning Identity Protection mode.
Sat Oct 07 13:00:25 2017 (GMT -0600): [SRX5308] [IKE] INFO: Initiating new phase 1 negotiation: ** ext IP SRX **[500]<=>** ext IP FVS318 **[500]
Sat Oct 07 13:00:25 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:00:25 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 13:00:25 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 12:57:26 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 12:57:05 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 1 negotiation failed due to time up for ** ext IP FVS318 **[500]. 1ebdde52616c0db7:0000000000000000
Sat Oct 07 12:56:55 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 12:56:55 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 12:56:55 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 12:55:46 2017 (GMT -0600): [SRX5308] [IKE] ERROR: Phase 2 negotiation failed due to time up waiting for phase1. ESP ** ext IP FVS318 **->** ext IP SRX **
Sat Oct 07 12:55:15 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 9
Sat Oct 07 12:55:15 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 8
Sat Oct 07 12:55:15 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:190]: XXX: setting vendorid: 4
Sat Oct 07 12:55:15 2017 (GMT -0600): [SRX5308] [IKE] INFO: [isakmp_ident.c:186]: XXX: NUMNATTVENDORIDS: 3
Sat Oct 07 12:55:15 2017 (GMT -0600): [SRX5308] [IKE] INFO: Beginning Identity Protection mode.
Sat Oct 07 12:55:15 2017 (GMT -0600): [SRX5308] [IKE] INFO: Initiating new phase 1 negotiation: ** ext IP SRX **[500]<=>** ext IP FVS318 **[500]
Sat Oct 07 12:55:15 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 12:55:15 2017 (GMT -0600): [SRX5308] [IKE] INFO: remote configuration for identifier "** myDomainName **" found
Sat Oct 07 12:55:15 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 12:42:49 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA established: ESP/Tunnel xxx.xxx.3.1->** ext IP FVS318 ** with spi=40115734(0x2641e16)
Sat Oct 07 12:42:49 2017 (GMT -0600): [SRX5308] [IKE] INFO: [IPSEC_VPN] IPsec-SA established: ESP/Tunnel ** ext IP FVS318 **->xxx.xxx.3.1 with spi=170635942(0xa2bb2a6)
Sat Oct 07 12:42:48 2017 (GMT -0600): [SRX5308] [IKE] INFO: Using IPsec SA configuration: xxx.xxx.3.0/24<->xxx.xxx.0.1/24
Sat Oct 07 12:42:48 2017 (GMT -0600): [SRX5308] [IKE] INFO: Responding to new phase 2 negotiation: xxx.xxx.3.1[0]<=>** ext IP FVS318 **[0]
Hi bzness,
If ever you have not yet configured Keep-Alive and Dead Peer Detection on both SRX5308 and FVS318G, I suggest you to configure Keep-Alive and Dead Peer Detection then check if same problem will occur. Read pages 265-268 of the SRX5308 Reference Manual here and pages 5-53 to 5-55 of the FVS318G Reference Manual here about Keep-Alives and Dead Peer Detection.
You mentioned that you upgraded the firmware of the SRX5308 to the latest version. Did you perform a factory reset on it the reconfigure it from scratch after upgrading the firmware? It is best to reset the firewall to factory defaults then reconfigure it from scratch in order to start clean using the latest firmware version.
Regards,
DaneA
NETGEAR Community Team
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
