some of ipsec tunels stopped working

[akarpas]

I have ipsec tunnels configured , they were working fine for a long time , the sat few days every morning i come to office some of ipsec tunnels are not working
after router restart they comes’s back . On the next morning the same. This morning total disaster. Router was upgraded to newest version 6.42.2 tyhe same problem so downgraded to bug fix version 6.40.8 some of vpn tunnels came back but not all.
Phase 1 and 2 pass. Connection established, NAT ok . Nothing was changed from then it was working fine.
What could be a problem???

[CZFan]

I suspect your IPSec tunnels go down during the evening as there are no “interesting” traffic flowing through. There should be no reason to restart routers, a ping through the tunnel should suffice.

Without seeing your config, very difficult to say what your current problem is

[tippenring]

I’ve noticed a recent change around 6.42. Previously, if one side was set to tunnel 10.10.0.0/24, and the other side was set for 10.0.0.0/16, the side with the /16 defined would accept the /24 proposal.
Around 6.42, it seems that flexibility disappeared. Now both routers have to have matching subnet definitions.

[akarpas]

I suspect your IPSec tunnels go down during the evening as there are no “interesting” traffic flowing through. There should be no reason to restart routers, a ping through the tunnel should suffice.

Without seeing your config, very difficult to say what your current problem is

Thanks for your sarcasm seems to be you are rude geek, i fount the problem, some nat rules created before did problems so removed them problem fixed.

[akarpas]

I’ve noticed a recent change around 6.42. Previously, if one side was set to tunnel 10.10.0.0/24, and the other side was set for 10.0.0.0/16, the side with the /16 defined would accept the /24 proposal.
Around 6.42, it seems that flexibility disappeared. Now both routers have to have matching subnet definitions.

I always use the same subnets , tomorrow setting up new tunnel going to test your findings. Thanks man!!!

[CZFan]

I suspect your IPSec tunnels go down during the evening as there are no “interesting” traffic flowing through. There should be no reason to restart routers, a ping through the tunnel should suffice.

Without seeing your config, very difficult to say what your current problem is

Thanks for your sarcasm seems to be you are rude geek, i fount the problem, some nat rules created before did problems so removed them problem fixed.

WTF???

[sindy]

I suspect your IPSec tunnels go down during the evening as there are no “interesting” traffic flowing through. There should be no reason to restart routers, a ping through the tunnel should suffice.

Without seeing your config, very difficult to say what your current problem is

Thanks for your sarcasm seems to be you are rude geek, i fount the problem, some nat rules created before did problems so removed them problem fixed.

English is not my native language, can you pinpoint which part of @CZFan’s post you’ve found sarcastic? To me it seemed like a constructive and neutral statemement, some tunnelling protocols do tear down if idle for an extended period of time and sometimes they have a problem to re-establish because they need the triggering traffic to come in the “right” direction. For example, if the traffic is for a peer behind an uncontrolled NAT, it is physically impossible for the peer on public address to re-establish the connection.