I recently replaced my customer’s RB3011 router, running version 6.37.4. with a new R3011 router running firmware version version 6.46.1. Because of the changes in the IPsec configuration between the two versions of RouterOS, I had to manually rebuild some of the IPsec configuration. The rest of the router configuration was exported from the old router and imported into the new router as is. Since the firmware grade the IPsec VPN connections are experiencing seemingly random dropped connections, every few hours. After a few minutes, the VPN connections reestablish on their own. These peers are Sierra Wireless cellular routers, model GX450, all connecting to the same RB3011. Nothing has been changed with the Sierra Wireless routers. I have included the new and old IPsec configurations from both routers for one of the IPsec connections. Did I miss some configuration on the new configuration?
Any ideas on what I can do to improve the IPsec connection stability?
CURRENT IPSEC CONFIGURATION EXPERIENCING DROPPED CONNECTIONS:
+++++++++++++++++++++++++++++++++++++++++++++++++++++
/ip ipsec profile
add dh-group=modp1024 dpd-interval=disable-dpd enc-algorithm=3des
hash-algorithm=md5 name=“GX450-2188 (Unit 130)” nat-traversal=no
/ip ipsec peer
add address=166.x.x.108/32 name=“GX450-2188 (Unit 130)” profile=
“GX450-2188 (Unit 130)”
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip ipsec identity
add peer=“GX450-2188 (Unit 130)” secret=xxxxxxxxxxxxxxxxxxx
/ip ipsec policy
add dst-address=192.168.37.0/24 peer=“GX450-2188 (Unit 130)” sa-dst-address=
166.x.x.108 sa-src-address=108.x.x.118 src-address=192.168.30.0/24
tunnel=yes
add dst-address=192.168.37.0/24 peer=“GX450-2188 (Unit 130)” sa-dst-address=
166.x.x.108 sa-src-address=108.x.x.118 src-address=10.110.0.0/16
tunnel=yes
OLD STABLE IPSEC CONFIGURATION:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip ipsec peer
add address=166.x.x.108/32 comment=“GX450-2188 (Unit 130)” dpd-interval=
disable-dpd dpd-maximum-failures=1 enc-algorithm=3des hash-algorithm=md5
nat-traversal=no secret=xxxxxxxxxxxxxxxxxxx
/ip ipsec policy
add comment=GX450-2188 dst-address=192.168.37.0/24 sa-dst-address=
166.x.x.108 sa-src-address=108.x.x.118 src-address=10.110.0.0/16
tunnel=yes
add comment=GX450-2188 dst-address=192.168.37.0/24 sa-dst-address=
166.x.x.108 sa-src-address=108.x.x.118 src-address=192.168.30.0/24
tunnel=yes