How to - Automatically reset vpn tunnel

biedron · May 30, 2014, 7:57am

Hi,

In production, we have another problem witch connect vyatta/vyos to cisco router in ipscec + vti.

We have around 250 remote office, and no reasone some tunnel is down… In Cisco site, status is up, a vyos site status is down. We try many configuration witch phase 1 and 2 witch on vyos and no result.

Problem occurs, when remote office, lose internet connection, and some reasons tunnel don’t up in vyos site, but in cisco site tunnel is UP.

So we write another script :),

Script list not working tunnel witch status A/D, and reset, he is related witch correct dyndns name.

date
vbash -ic ‘show interfaces vti’ > /scheduler/resetvpn/log_show
#cat /scheduler/resetvpn/log_show | grep A/D | cut -c 57- > /scheduler/resetvpn/log
grep -Pzo “A/D\s+[\w.-]+” /scheduler/resetvpn/log_show | grep -Po “n[\w.-]{3,}” > /scheduler/resetvpn/log
licznik=wc -l /scheduler/resetvpn/log | cut -c 1-2
echo not work tunnel : $counter

x=1
while [ $x -le $counter ]; do
host_all=sed -n $x'p' /scheduler/resetvpn/log
echo host_all= $host_all
host_DHCP_office=echo $host_all | cut -c 1-4
echo host_DHCP_office= $host_DHCP_OFFICE
if [ $host_DHCP_OFFICE = “DHCP_OFFICE_” ]; then
echo “This is DHCP office”
host=echo $host_all | cut -c 5-
else
echo “This is not DHCP_OFFICE”
host=echo $host_all
fi

host_ip=host $host | awk -F"address " '{print $2}'
echo $host_ip
vbash -ic “reset vpn ipsec-peer $host_ip”
x=$[x + 1]
done

Script running in crontab (5 min timestap)

Adriano · May 30, 2014, 9:14am

Hello Biedron,
sorry for the trivial suggestion, did you try enabling [font=Courier]dead-peer-detection[/font] which implements RFC 3706 to reconnect disconnected tunnels?

I mean a configuration like this (please note, you have to change [font=Courier]your-group-here[/font] with your IKE group name).

set vpn ipsec ike-group your-group-here dead-peer-detection action 'restart' set vpn ipsec ike-group your-group-here dead-peer-detection interval '30' set vpn ipsec ike-group your-group-here dead-peer-detection timeout '30'

Regards
Adriano C.

biedron · May 30, 2014, 12:40pm

Hi,

Yes ofcourse :). But no reason, tunnel in one of site is down ( some times on vyos site, some times in cisco, but more on vyos ). I analyze log and, phase 1 is connect, but no transfer in phase 2. The strange thing is, all remote routers is simillar, and have identical configuration. For 250 office, maybe 5% is problem witch connection. So we write this script, and to day working ok.

Regards

Adriano · May 30, 2014, 1:27pm

Hello Biedron,
I had a similar issue in the past: did you try to reduce just for that tunnel (so assigning it to a different IKE Group) a very low lifetime value?

Regards
Adriano

system · July 14, 2014, 5:28pm

I had a similar issue, even with dead-peer-detection. I ended up installing cron and scheduling this script to run every minute:

#!/bin/bash

curl -s -o /dev/null --connect-timeout 2 [REMOTE_SERVER] 2>&1

if [[ $? != 0 ]] ; then
    vbash -ic 'restart vpn'
fi

where [REMOTE-SERVER] is a webserver on the other side of the tunnel (ping would be better for this, but I can’t seem to get a non-0 return value from the included ping).

biedron · July 15, 2014, 7:12am

Adriano -> I guess I have not tried this approach, because i wanted fixed this problem in global, on vytta/vyos site, and that time, change configuration in all cisco router is problematic, but soon i testing your idea.

mcowart -> This solution is ok, but if you have multi site to connect to one site, this is problem, when you restart ipsec process, and we have many “main links” to connect witch edge router, and when restart “ipsec process” we loose connection.

Adriano · July 15, 2014, 1:36pm

Hello Biedron,
thank you for your update. Feel free to give us further details about your tests.

Regards
Adriano C.

system · July 21, 2014, 2:23am

About 6 months ago while doing some trouble shooting with IPSec VPNs to a Cisco ASA, I discovered that Cisco has a 4GB limit at which time the tunnel is reset. The tunnel will sudo appear to be up, but there will be no traffic. DPD does not solve this as the Tunnel is actually up. Restarting the tunnel did fix the issue.

By setting the lifetimes very low the tunnels are reestablished before that magical 4GB of transfer is encountered.

Cisco has since then corrected this behavior in there newer versions of software for the ASA.

system · July 22, 2014, 6:25pm

That’s true. The VyOS VM I have running is on the edge site (my house) that connects back to an ASA at the office, so it only has the single tunnel to deal with.