IPSec stops working but still established

RouterOS General
1

We have a RB5009UPr+S+ with an IPSec-tunnel that we’ve been using for years.
The other day we upgraded from 7.16.1 to 7.20 and all of the sudden we’re having problems with our IPSec-tunnel stops working randomly.

The tunnel shows as established under IP → IPSec → Policies in Winbox but no traffic can go through it.

The other side of the tunnel is also a MikroTik (CCR2004) but still on 7.16.1

When I disable and enable the policy the tunnel starts to work again immediately.
This happens every 20-30 minutes or so, sometimes it’s just 2 minutes in between and sometimes it can go a couple of hours without any problem.

We upgraded the tunnel to IKEv2 yesterday but still experience the same problem.

Is there something in 7.20 that can contribute to this? Or do we have a faulty config somehow?

I’m thinking about downgrading to 7.16.1 again to see if it fixes it but I would love to fix the issue instead if possible.

Is there anyone that can give me any information about this?

EDIT:

I just noticed that this MikroTik runs 20 seconds faster than the one on the other side. Could this be a factor?

2

Timing differences may have some impact but I am not sure.
It should be rather easy to make sure they are in sync ? Sync with NTP server ?

If the problems persist:
There have been IPSEC related issues since 7.19.4 (I think) and 7.20 as well.
It might be wise to downgrade to 7.19.1 and sit this one out.
Or be sage and use 7.21b2 ? :laughing:
(on a serious note: not recommended for Production !)

It rarely is a good idea to immediately jump on a new release without testing if everything works in a lab environment.
Usually in production I wait for at least .1 version, sometimes even .2 before applying (most of my production gear is still on 7.19.3).
At home I try to follow al beta and rc versions. If things break there, then I am the most impacted, not someone else.

3

yea I synced the time on both but did no difference. We’re rolling back the update.