Screen OS

We are having a strange issue where the connection is estabilished and then 2 minutes later the connection will drop, wait 20 seconds and re-establish. From then on the connection will drop ever 90 seconds and re-establish again after 30 seconds. We have the timeout on the proposals set to 28800, and I have played with the keep-alive/heartbeat settings modifying the hello seconds and the reconnect. Any help would be much appreciated.

Josh Payne

sounds as if vpn monitor is turned on. The default vpn monitor setting is proprietary so will not work with other vendors.

Can you try "unset vpn xxx monitor"?

Regards,

Sam

Thanks for the quick reply. I can try that, however will Juniper still try to initiate the connection? We are supposed to be the initiator.

Thanks,

Josh Payne

the juniper will try to initiate if there's interested traffic.

Another option is to ping a remote ip using the 'trust' or (inside) interface of juniper.

for example:

set vpn <vpn_name> monitor source-interface bgroup0 destination-ip 10.1.1.1 rekey

 PC1---Bgroup0[Juniper]=======VPN======SonicWall(10.1.1.1)-----PC2

Both Bgroup0 and 10.1.1.1 are IP's that are protected by the VPN.

The default "set vpn xxx monitor rekey" uses the IPSec gateway IP addresses, encrypts them in IPsec and forwards to peer.  This only works with other ScreenOS devices.

Hope it makes sense.

Regards,

Sam

Oh, that would make sense to give it something to ping to keep it alive. (duh) I am trying that now.

Thanks,

Josh Payne

Well, I realized I didn't have an acceptable ip on my trust interface to communicate with the remote ip. I ended up removing monitor as you stated above and we are working fine without all those annoying critical alarms.

Thanks,

Josh Payne

glad it's working.

FYI.  for future reference, the vpn monitor setting by default is 10 tries, 10 misses before bringing down the VPN, so around 2minutes.

This setting is configureable and usually is, if quicker 'failover' type of scenario is required.

set vpnmonitor interval xxx
set vpnmonitor threshold xxx

ssg5-serial-wlan-> get vpnmonitor
Vpn monitor interval : 10(seconds)
Vpn monitor threshold: 10
ssg5-serial-wlan->

Regards,

Sam

I'm having the same issue.

I have no problem to turn off VPN monitor, but I still would prefer to keep the SA active all the time, will it happen or will it become active when no traffic exists? My concern is that there will be short times of packet loss every time the tunnel needs to be brought up again.

Can I turn off monitor but leave rekey enabled? does it make any sense?

Thanks

Hi.

there is no option to turn off monitor with rekey enabled.

With VPN monitor off, and there's no traffic, the SA will go inactive once the SA lifetime reaches 0.

Best bet is using monitor pings between protected resources through the tunnnel:

   set vpn <vpn_name> monitor source-interface bgroup0 destination-ip 10.1.1.1 rekey

Regards,

Sam