Quantcast
Channel: All EdgeRouter posts
Viewing all articles
Browse latest Browse all 60861

Re: ipsec site-to-site tunnel hangs after several minutes no log entry on ERL side

$
0
0

on the edgerouter run

 

sudo swanctl --log

and leave it running.  This will show a much more detailed log of what is happening. 

 

I have successfully set up site-to-site IPsec VPNs from edgerouter to edgerouter but not to that other device you're using.  On the edgerouter you are making use of the ipsec-interfaces and nat-networks sections but these both show deprecated on my router. 

 

Also my settings (the defaults in these cases) have the IKE lifetime at 28800 like you, but the ESP lifetime at only 3600.  I'm not sure if this is your issue or not though.

 

You shouldn't need it for IKEv1 in my experience, but you could also try setting the id / remote-id (needs to be set at both sides, one side being the opposite of the other. I'm unsure of how to do this on your other device) as this was causing issues for me establishing the tunnel with IKEv2

set vpn ipsec site-to-site peer mypeer.com authentication id me
set vpn ipsec site-to-site peer mypeer.com authentication remote-id them

Last thing I can think of, for IKE you are using dh-group 2, but for ESP you are using pfs disable.  Should these not match?  As in

set vpn ipsec esp-group FOO0 pfs dh-group2

This is what I am using (matching dh-groups) but maybe it is not mandatory. 

 

Hope this helps.  I am not an IPsec expert so currently my troubleshooting strategy is to throw a bunch of things at it and see what sticks!


Viewing all articles
Browse latest Browse all 60861

Trending Articles