IPsec connection stops working at some point

RouterOS General
1

Hello community :slight_smile:

We currently have the problem that the IPsec connection simply doesn’t work any more at some point. It does not work again until the router is restarted.

Router model:
RouterBOARD 3011UiAS

RouterOS version:
6.42.9

Here is the IPsec configuration:

/ip ipsec mode-config
add address-pool=dhcp_ipsec address-prefix-length=32 name=cfg_roadwarrior static-dns=192.168.111.1 system-dns=no
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256,sha1 enc-algorithms=aes-256-cbc pfs-group=none
/ip ipsec peer
add address=0.0.0.0/0 auth-method=rsa-signature certificate=IPsec-Server dh-group=modp2048 enc-algorithm=aes-256 exchange-mode=ike2 generate-policy=port-strict hash-algorithm=sha256 mode-config=cfg_roadwarrior passive=yes
/ip ipsec policy
set 0 dst-address=192.168.114.0/24 src-address=0.0.0.0/0

Here is the firewall filter configuration:

/ip firewall filter
add action=drop chain=input comment="drop bogons" in-interface-list=wan ipsec-policy=in,none src-address-list=private
add action=accept chain=input comment="accept established,related" connection-state=established,related
add action=accept chain=input comment="IPsec IKE exchange" dst-port=500,4500 in-interface=ether2_wan protocol=udp
add action=accept chain=input comment="accept IPsec DNS" dst-port=53 ipsec-policy=in,ipsec protocol=udp
add action=accept chain=input comment="accept IPsec WinBox" dst-port=8291 ipsec-policy=in,ipsec protocol=tcp
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=drop chain=input comment="drop all from WAN" in-interface-list=wan
add action=accept chain=forward comment="accept established,related" connection-state=established,related
add action=accept chain=forward comment="accept IPsec traffic" ipsec-policy=in,ipsec
add action=drop chain=forward comment="drop invalid connection" connection-state=invalid
add action=drop chain=forward comment="drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=wan

Does anyone have any idea what the problem might be?

2

please add Ipsec logs.

3

I will do, when the problem occurs again. Unfortunately I did not save them, before I restarted the router.

4

Hey HExSM,

A few thoughts that immediatley popped into my mind while reading your problem:

1.) Make sure that the lifetime of the respective phase are the same on both sides
2.) If it’s not disabled, disable Fast-Path for the bridge on the Tik.
3.) Upgrade to the latest available firmware :wink:
4.) Make sure the time/date on both sides is set correctly and does is not being altered.

Best regards
Areanod

5

The log just says

ipsec,info new ike2 SA (R): 24.134.xxx.xxx[500]-80.187.xxx.xxx[500] spi:e24d867a06a0a343:96aa3f145d60520b 
ipsec,info killing ike2 SA: 24.134.xxx.xxx[4500]-80.187.xxx.xxx[4500] spi:e24d867a06a0a343:96aa3f145d60520b

@areanod,

thank you for the suggestions, what else to check. :slight_smile:
Point 4 sounds interesting, because the time was wrong. I will enable the ntp client to solve that problem.
Point 2 was already done and point 3 I did yesterday night.
Can you tell me how I can check point 1?

Best regards,
Stefan

6

Check your settings, I assume you’re affected by a bug related to IKEv2 SA rekey which has been fixed in 6.43.1:

*) ike2 - fixed rare authentication and encryption key mismatches after rekey with PFS enabled;

So if you have set pfs to anything else than none in /ip ipsec proposal, don’t wait and upgrade both ends. If your already did, you should be good by now.