In production, we have another problem witch connect vyatta/vyos to cisco router in ipscec + vti.
We have around 250 remote office, and no reasone some tunnel is down… In Cisco site, status is up, a vyos site status is down. We try many configuration witch phase 1 and 2 witch on vyos and no result.
Problem occurs, when remote office, lose internet connection, and some reasons tunnel don’t up in vyos site, but in cisco site tunnel is UP.
So we write another script :),
Script list not working tunnel witch status A/D, and reset, he is related witch correct dyndns name.
Yes ofcourse :). But no reason, tunnel in one of site is down ( some times on vyos site, some times in cisco, but more on vyos ). I analyze log and, phase 1 is connect, but no transfer in phase 2. The strange thing is, all remote routers is simillar, and have identical configuration. For 250 office, maybe 5% is problem witch connection. So we write this script, and to day working ok.
Adriano -> I guess I have not tried this approach, because i wanted fixed this problem in global, on vytta/vyos site, and that time, change configuration in all cisco router is problematic, but soon i testing your idea.
mcowart -> This solution is ok, but if you have multi site to connect to one site, this is problem, when you restart ipsec process, and we have many “main links” to connect witch edge router, and when restart “ipsec process” we loose connection.
About 6 months ago while doing some trouble shooting with IPSec VPNs to a Cisco ASA, I discovered that Cisco has a 4GB limit at which time the tunnel is reset. The tunnel will sudo appear to be up, but there will be no traffic. DPD does not solve this as the Tunnel is actually up. Restarting the tunnel did fix the issue.
By setting the lifetimes very low the tunnels are reestablished before that magical 4GB of transfer is encountered.
Cisco has since then corrected this behavior in there newer versions of software for the ASA.