I am experiencing an odd set of circumstances. I have an L2TP/IPSEC that I use for Site-To-Site connections, general windows VPN, as well as mobile VPN connections. I have absolutely no issues when it comes to the windows VPN or the Site-To-Site connections. They establish and everything works correctly.
Site-To-Site connections (non-restricted) are on the 172.16.0.0/24 subnet
Site-To-Site connections (restricted) are on the 172.48.0.0/24 subnet
Windows VPN connections fall within 172.32.0.10 - 172.32.0.50
Mobile VPN connections fall within 172.32.0.51 - 172.32.0.100
The mobile VPN connection will establish and connect to the system. Then all of my VPN functionalities will work perfectly for 15-45 seconds. Then all of the sudden nothing will load. The connection remains established/connected. And since it is a gateway connection all functionality on the phone is lost. If I disconnect the VPN and reconnect, same thing, I will have 15-45 seconds of successful ability to use anything I would normally be able to use before the connection drops again.
Any thoughts you have would be appreciated. Thanks!
But I cannot confirm that it is the same. In terms of logging do you have a recommendation on how to isolate logging for one individual device?
The standard logging is passing details from multiple site locations at once. Nearly impossible to dig through all the traffic to pick out the bits associated with this one device. Before it clears the screen.
Update: Upon checking the issue appears to be very similar. When connecting on the mobile device the interface is shown on the interface list. For about 15-35 seconds before the interface drops off of the list which is the exact same time I loose connectivity on the phone. Even though the phone still says connected and it is no longer listed as an active connection under PPP. But under the IPsec policies I can see the PH2 state as established for the destination address the phone is coming from and listed as a remote peer.
It’s not nearly impossible, it’s absolutely impossible. The way is /log print follow-only file=ipsec-l2tp-log where topics~“ipsec|l2tp”
Now switch the VPN on the mobile, wait until the connection succeeds and drops, break the /log print command, download the file, and use a text editor to search for the client IP address. And yes, it’s a PITA to read it if several clients are connected as it’s full of keepalive messages.