S2S VPN - 2 Routes, 1 stop working

ihates2svpns

Hi there,

following setting:
HQ (192.168.31.0/16) + SSLVPN-Users (192.168.113.0/24) ←BOVPN iKEV2→ BranchOffice (10.0.11.0/24)

After a while one of the two routes from HQ to BranchOffice randomly stops working. If i add another route (inactive one, not present on other side), its starts working again but fails some time again afterwards. Do the same over and over is fine, but not a solution :D

kimmo.pohjoisaho

The sslvpn 192.168.113.0/24 network is already included in the 192.168.31.0/16 network mask!
Network: 192.168.0.0/16
IP Range: 192.168.0.1 - 192.168.255.254

How does your VPN routing look like?

With Policy-based VPN Tunnel config, does it look like this:
HQ:
Local: Remote:
192.168.31.0/16 10.0.11.0/24

BranchOffice:
Local: Remote:
10.0.11.0/24 192.168.31.0/16

or if you are using Route-based (Bovpn Virtual Interface), does the VPN Routes To look like this:
HQ:
10.0.11.0/24

BranchOffice:
192.168.31.0/16

I would change the sslvpn network to something else! example: 10.100.100.0/24
Then the VPN routing should look like this:

Policy-based VPN Tunnel config:

HQ:
Local: Remote:
192.168.31.0/16 10.0.11.0/24
10.100.100.0/24 10.0.11.0/24

BranchOffice:

Local: Remote:
10.0.11.0/24 192.168.31.0/16
10.0.11.0/24 10.100.100.0/24

or with Route-based (Bovpn Virtual Interface), VPN Routes To:
HQ:
10.0.11.0/24

BranchOffice:
192.168.31.0/16
10.100.100.0/24

ihates2svpns

Hi kimmo,

thanks for your reply. I anonymised the subnets for the post, so the /16 subnet does not interfere with the sslvpn-subnet :D in reality it is a class a net: 172.16.0.0/16. sorry for this misshandling.

Meanwhile it looks like a child-sa problem caused by the other side oft the vpn (pfsense) that we're narrowing down rn. After first rekey the answer for the second subnet/child sa doesnt get answered from the other side of the vpn. So first route gets a answer, but second one does not come up because of the missing answer.

kimmo.pohjoisaho

Have you checked these guides?

https://www.watchguard.com/help/docs/help-center/en-US/Content/Integration-Guides/General/Pfsense_BOVPN.html

https://www.watchguard.com/help/docs/help-center/en-US/Content/Integration-Guides/General/Pfsense_BOVPN_virtual_interface.html

With Policy-based VPN the config should look something like this.

Lab example
Firebox:
10.0.20.0/24
10.0.30.0/24

pfSense:
192.168.32.0/24