Netgear FVS318G Site to Site VPN tunnel

[jmfranzen]

This tunnel has been working correctly and was reconfigured after the ISP at both sites was switched to another provider.

About a month later staff member noticed corruption in files copied over the VPN.

Looking at the VPN logs it seems the IP-sec keeps dropping and reconnecting every 15 minutes.

Any ideas?

Thanks,

Joe

[jmfranzen]

Here is sample of VPN logs. WAN IP's replaced with Site1 / Site2 names.

2015 Nov 12 00:52:52 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel Site1->Site2 with spi=123970818(0x763a502)_

2015 Nov 12 00:52:52 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel Site2->Site1 with spi=261599364(0xf97b084)_

2015 Nov 12 00:52:51 [FVS318g] [IKE] IPsec-SA expired: ESP/Tunnel Site2->Site1 with spi=95241123(0x5ad43a3)_

2015 Nov 12 00:52:51 [FVS318g] [IKE] IPsec-SA expired: ESP/Tunnel Site1->Site2 with spi=71402831(0x441854f)_

2015 Nov 12 00:52:51 [FVS318g] [IKE] Using IPsec SA configuration: 192.168.0.0/24<->192.168.1.0/24_

2015 Nov 12 00:52:51 [FVS318g] [IKE] Responding to new phase 2 negotiation: Site1[0]<=>Site2[0]_

2015 Nov 12 00:04:50 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel Site1->Site2 with spi=71402831(0x441854f)_

2015 Nov 12 00:04:50 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel Site2->Site1 with spi=95241123(0x5ad43a3)_

2015 Nov 12 00:04:50 [FVS318g] [IKE] Using IPsec SA configuration: 192.168.0.0/24<->192.168.1.0/24_

2015 Nov 12 00:04:49 [FVS318g] [IKE] Responding to new phase 2 negotiation: Site1[0]<=>Site2[0]_

2015 Nov 12 00:04:49 [FVS318g] [IKE] IPsec-SA expired: ESP/Tunnel Site2->Site1 with spi=152647891(0x91938d3)_

2015 Nov 12 00:04:49 [FVS318g] [IKE] IPsec-SA expired: ESP/Tunnel Site1->Site2 with spi=133067226(0x7ee71da)_

2015 Nov 11 23:16:48 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel Site1->Site2 with spi=133067226(0x7ee71da)_

2015 Nov 11 23:16:48 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel Site2->Site1 with spi=152647891(0x91938d3)_

2015 Nov 11 23:16:48 [FVS318g] [IKE] Using IPsec SA configuration: 192.168.0.0/24<->192.168.1.0/24_

2015 Nov 11 23:16:47 [FVS318g] [IKE] Responding to new phase 2 negotiation: Site1[0]<=>Site2[0]_

2015 Nov 11 23:16:47 [FVS318g] [IKE] IPsec-SA expired: ESP/Tunnel Site2->Site1 with spi=103178078(0x6265f5e)_

2015 Nov 11 23:16:47 [FVS318g] [IKE] IPsec-SA expired: ESP/Tunnel Site1->Site2 with spi=231509542(0xdcc8e26)_

2015 Nov 11 22:28:46 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel Site1->Site2 with spi=231509542(0xdcc8e26)_

2015 Nov 11 22:28:46 [FVS318g] [IKE] IPsec-SA established: ESP/Tunnel Site2->Site1 with spi=103178078(0x6265f5e)_

2015 Nov 11 22:28:46 [FVS318g] [IKE] Using IPsec SA configuration: 192.168.0.0/24<->192.168.1.0/24_

2015 Nov 11 22:28:45 [FVS318g] [IKE] Responding to new phase 2 negotiation: Site1[0]<=>Site2[0]_

2015 Nov 11 22:28:45 [FVS318g] [IKE] IPsec-SA expired: ESP/Tunnel Site2->Site1 with spi=155868931(0x94a5f03)_

2015 Nov 11 22:28:45 [FVS318g] [IKE] IPsec-SA expired: ESP/Tunnel Site1->Site2 with spi=219767050(0xd19610a)_

[adit]

Do you have static IP's or DHCP WAN IP's?

Public IP's on the 318 WAN's?

What are the SA Lifetimes in all 4 places?

Are both 318's?

Which firmware on each?

[jmfranzen]

Both using DHCP as the static IP's assigned are in wrong subnet and I am trying to get COX to remedy this issue.

Got both upgraded to newest firmware.

Maxed out the SA lifetime to 24 hours.

Identical FVS318G's purchased at same time

[adit]

Always list the specific firmware. The "latest" means nothing if a new firmware gets release the next day.

How often are your public IP's changing?

I've seen ISP's (VZ DSL) change IP's via DHCP as often as once a minute.  Everytime that IP changes the tunnel will drop.

Having DHCP on the WAN you should lower the SA Lifetimes.  I use 3600 at most on dynamic WAN's, less if ISP DHCP expiration is set shorter than an hour (match the expiration time).

Static IP's I use 86400.

[jmfranzen]

Public IP's (even though DHCP) are not changing over several months now, and worked fine with these IP's for month or two,before the issue suddeny started

SA Lifetimes were set to 8 hours and the connection was resetting every 15 to 20 minutes.

I switched them to 24 hours.

They are both running 3.1.1-18 whihc is newest according to the Netgear download page.

They were both running 3.0.7-34 and working fine, before the issue suddeny started.

Firmware History:

3.1.1-18

3.1.1-14

3.1.1-08 

3.0.8-12

3.0.7-24

3.0.7-22

3.0.6-16

3.0.6-15

3.0.5-27

[adit]

Are you sure the WAN connection is not dropping out?

Not sure what diagnostic software you run but have you tried a continuous PING to the remote site WAN IP to see if it drops, and for how long?  If it drops, figure out where it is dropping.  Run a few traceroutes and notate the IP's.

You also need to find out what the DHCP expiration is set for.  Just because the IP isn't changing doesn't mean that it isn't renewing itself every 15 or 20 minutes.  Whenever the WAN renews your VPN tunnels can drop (I've seen it happen in as little as 4 seconds for the VPN to renegotiate).  This is probably not enough to disrupt someones browsing but could be enough for it to booger up a VPN transfer.

Who is the ISP and what type of service is it?  Same on both sides?  (I see you mention Cox)