I've been having this problem for awhile with a site-to-site connection between a usg50 and usg20w. Both are on 3.30(B*S.7). The connection works great without any errors or alarming log entries. After about 24 hours the tunnel disconnects. After logging in to one of the USGs and manually disconnect/connect the tunnel gets successfully built again. However, after the tunnel is rebuilt there are a lot of [NOTIFY:R_U_THERE_ACK] and WAN to ZyWALL, UDP, service VPN_IPSEC, ACCEPT entries getting logged. Rebooting the usg20w seems to get rid of those. Its as if once the SA lifetime is reached they can no longer negotiate correctly until reboot occurs on one of the USGs. Both ends are nailed up and have dead peer detection enabled. I guess I can up the SA lifetime to verify it only occurs after the time is reached. Any leads to a resolution greatly appreciated. I'm not sure where to start looking when the issue only occurs until after a day goes by.
Once the disconnect occurs the usg20w continuously logs the following line:
SPI: 0xdd23fc36 (3710123062) SEQ: 0x626 (1574) No rule found, Dropping ESP packet
On the USG50 at around the same time the following is logged.
x4692016-08-22 00:26:27errorIPSecSPI: 0x1e12458d (504513933) SEQ: 0x9 (9) No rule found, Dropping ESP packetxxx.xxx.xxx.xxxxxx.xxx.xxx.xxxipsec4702016-08-22 00:26:26errorIPSecSPI: 0x1e12458d (504513933) SEQ: 0x8 (8) No rule found, Dropping ESP packetxxx.xxx.xxx.xxxxxx.xxx.xxx.xxxipsec4712016-08-22 00:26:26errorIPSecSPI: 0x1e12458d (504513933) SEQ: 0x7 (7) No rule found, Dropping ESP packetxxx.xxx.xxx.xxxxxx.xxx.xxx.xxxipsec4722016-08-22 00:26:25errorIPSecSPI: 0x1e12458d (504513933) SEQ: 0x6 (6) No rule found, Dropping ESP packetxxx.xxx.xxx.xxxxxx.xxx.xxx.xxxipsec4732016-08-22 00:26:24infoIKESend:[HASH][NOTIFY:R_U_THERE_ACK] [count=2]xxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4742016-08-22 00:26:24infoIKERecv:[HASH][NOTIFY:R_U_THERE] [count=2]xxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4752016-08-22 00:26:24infoIKEPhase 1 IKE SA process donexxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4762016-08-22 00:26:24infoIKESend:[ID][HASH]xxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4772016-08-22 00:26:24infoIKERecv:[ID][HASH]xxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4782016-08-22 00:26:24infoIKESend:[KE][NONCE][PRV][PRV]xxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4792016-08-22 00:26:24infoIKERecv:[KE][NONCE][PRV][PRV]xxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4802016-08-22 00:26:24errorIPSecSPI: 0x1e12458d (504513933) SEQ: 0x5 (5) No rule found, Dropping ESP packetxxx.xxx.xxx.xxxxxx.xxx.xxx.xxxipsec4812016-08-22 00:26:24infoIKESend:[SA][VID][VID][VID][VID][VID][VID][VID][VID]xxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4822016-08-22 00:26:24infoIKEThe cookie pair is : 0x9819afac32b79274 / 0x085ef8815455b88e [count=6]xxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4832016-08-22 00:26:24infoIPSecrecv sa: SA([0] protocol = IKE (1), AES CBC key len = 256, HMAC-SHA1 PRF, HMAC-SHA1-96, 768 bit MODP; [1] protocol = IKE (1), A [count=3] IPSEC_LOG4842016-08-22 00:26:24infoIKERecv:[SA][VID][VID][VID][VID][VID][VID][VID][VID]xxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4852016-08-22 00:26:24infoIKEThe cookie pair is : 0x085ef8815455b88e / 0x9819afac32b79274 [count=5]xxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4862016-08-22 00:26:24infoIKERecv Main Mode request from [xxx.xxx.xxx.xxx]xxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4872016-08-22 00:26:24infoIKEThe cookie pair is : 0x9819afac32b79274 / 0x0000000000000000xxx.xxx.xxx.xxx:500xxx.xxx.xxx.xxx:500IKE_LOG4882016-08-22 00:26:23errorIPSecSPI: 0x1e12458d (504513933) SEQ: 0x4 (4) No rule found, Dropping ESP packetxxx.xxx.xxx.xxxxxx.xxx.xxx.xxxipsec4892016-08-22 00:26:23noticeFirewallpriority:6, from WAN to ZyWALL, service VPN_IPSEC, ACCEPTxxx.xxx.xxx.xxxxxx.xxx.xxx.xxxACCESS FORWARD
↧