Hello,
Here is my problem, and in advance, thanks if you have time to read and help me.
I’ve 2 sites, linked with IPSec Ikev2.
Tunnels comes UP easily.
If second site become down, the first vyos router takes 120 seconds to set the “IPSec connection” down.
Even if I set the DPD delay to 2 or 5 seconds.
When I watch logs, I can see it tries to send/retransmit. But why the DPD timeout is so long ?
I known that in IKEv2, there is no “DPD” (the command timeout is not taken in account), it’s an INFORMATION message that is sent. But is there a way to detected that the remote peer is DOWN before 120 seconds ?
Apr 14 17:21:34 vyos charon: 13[IKE] <SITE2|19> retransmit 4 of request with message ID 2
Apr 14 17:21:34 vyos charon: 13[NET] <SITE2|19> sending packet: from 100.64.3.2[4500] to 100.64.2.2[4500] (57 bytes)
Apr 14 17:21:34 vyos charon: 07[IKE] <SITE2|23> retransmit 4 of request with message ID 0
Apr 14 17:21:34 vyos charon: 07[NET] <SITE2|23> sending packet: from 100.64.3.2[4500] to 100.64.2.2[4500] (57 bytes)
Apr 14 17:21:34 vyos charon: 12[IKE] <SITE2|20> retransmit 4 of request with message ID 0
Apr 14 17:21:34 vyos charon: 12[NET] <SITE2|20> sending packet: from 100.64.3.2[4500] to 100.64.2.2[4500] (57 bytes)
Apr 14 17:22:16 vyos charon: 11[IKE] <SITE2|19> retransmit 5 of request with message ID 2
Apr 14 17:22:16 vyos charon: 11[NET] <SITE2|19> sending packet: from 100.64.3.2[4500] to 100.64.2.2[4500] (57 bytes)
Apr 14 17:22:16 vyos charon: 16[IKE] <SITE2|23> retransmit 5 of request with message ID 0
Apr 14 17:22:16 vyos charon: 16[NET] <SITE2|23> sending packet: from 100.64.3.2[4500] to 100.64.2.2[4500] (57 bytes)
Apr 14 17:22:16 vyos charon: 05[IKE] <SITE2|20> retransmit 5 of request with message ID 0
Apr 14 17:22:16 vyos charon: 05[NET] <SITE2|20> sending packet: from 100.64.3.2[4500] to 100.64.2.2[4500] (57 bytes)
Apr 14 17:23:32 vyos charon: 16[IKE] <SITE2|19> giving up after 5 retransmits
Here is the configuration:
set vpn ipsec esp-group ESP_ALL_SITES mode 'tunnel'
set vpn ipsec esp-group ESP_ALL_SITES pfs 'dh-group15'
set vpn ipsec esp-group ESP_ALL_SITES proposal 1 encryption 'chacha20poly1305'
set vpn ipsec esp-group ESP_ALL_SITES proposal 1 hash 'sha256'
set vpn ipsec ike-group IKE_ALL_SITES close-action 'restart'
set vpn ipsec ike-group IKE_ALL_SITES dead-peer-detection action 'restart'
set vpn ipsec ike-group IKE_ALL_SITES dead-peer-detection interval '2'
set vpn ipsec ike-group IKE_ALL_SITES dead-peer-detection timeout '2'
set vpn ipsec ike-group IKE_ALL_SITES disable-mobike
set vpn ipsec ike-group IKE_ALL_SITES ikev2-reauth
set vpn ipsec ike-group IKE_ALL_SITES key-exchange 'ikev2'
set vpn ipsec ike-group IKE_ALL_SITES proposal 1 dh-group '15'
set vpn ipsec ike-group IKE_ALL_SITES proposal 1 encryption 'chacha20poly1305'
set vpn ipsec ike-group IKE_ALL_SITES proposal 1 hash 'sha256'
se
set vpn ipsec site-to-site peer SITE2 authentication local-id 'SITE-PSK'
set vpn ipsec site-to-site peer SITE2 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer SITE2 authentication remote-id 'SITE-PSK'
set vpn ipsec site-to-site peer SITE2 connection-type 'initiate'
set vpn ipsec site-to-site peer SITE2 force-udp-encapsulation
set vpn ipsec site-to-site peer SITE2 ike-group 'IKE_ALL_SITES'
set vpn ipsec site-to-site peer SITE2 local-address '100.64.1.2'
set vpn ipsec site-to-site peer SITE2 remote-address '100.64.2.2'
set vpn ipsec site-to-site peer SITE2 tunnel 0 esp-group 'ESP_ALL_SITES'
set vpn ipsec site-to-site peer SITE2 tunnel 0 local prefix '100.68.0.1/32'
set vpn ipsec site-to-site peer SITE2 tunnel 0 remote prefix '100.68.0.2/32'
set vpn ipsec site-to-site peer SITE2 vti bind 'vti0'
set vpn ipsec site-to-site peer SITE2 vti esp-group 'ESP_ALL_SITES'
Here is the version:
Version: VyOS 1.4-rolling-202304130846
Release train: current
Built by: autobuild@vyos.net
Built on: Thu 13 Apr 2023 08:46 UTC
Build UUID: 1d949ed4-c78a-4abb-a849-8f0d7617acd3
Build commit ID: e52a5136ef375e
Architecture: x86_64
Boot via: installed image
System type: KVM guest
Hardware vendor: QEMU
Hardware model: Standard PC (i440FX + PIIX, 1996)
Hardware S/N:
Hardware UUID: ad20a665-ebd1-4c0a-a50d-94ea7988c963
Copyright: VyOS maintainers and contributors
swanctl:
root@vyos:~# swanctl --version --pretty
strongSwan swanctl 5.9.8
Thanks a lot for your help
Regards,
Fred