?
Solved

Some Sonicwall VPNs time out on Stage1 negotiation

Posted on 2010-08-26
8
Medium Priority
?
3,969 Views
Last Modified: 2012-06-21
We have 6 locations with store to store VPN.
2 of them have Sonicwall SOHO3 routers
2 - Sonicwall TZ170
1 - TZ180
1 - Cisco RV042

Last week, our Cisco router lost VPN to TZ180. It reestablished it only once ever since, for about 2 minutes.
Today, one of TZ170 has lost connection to the same TZ180 as well.

VPN configs have been the same for years and worked flawlessly.
Here is the message from TZ180 log:
----------------------------
360 08/26/2010 14:11:29.800 IKE Responder: Received Main Mode request (Phase 1) 192.168.200.1, 500, mail.domain.com 192.168.400.1, 500, 192.168.400.1.dimcom.net    
361 08/26/2010 14:11:29.800 RECEIVED<<< ISAKMP OAK MM (InitCookie 0x39dd1d678bec2eed, MsgID: 0x0) (SA, VID) 192.168.200.1, 500, mail.domain.com 192.168.400.1, 500, 192.168.400.1.dimcom.net    
362 08/26/2010 14:11:12.783 IKE Responder: Received Main Mode request (Phase 1) 192.168.200.1, 500, mail.domain.com 192.168.400.1, 500, 192.168.400.1.dimcom.net    
363 08/26/2010 14:11:12.783 RECEIVED<<< ISAKMP OAK MM (InitCookie 0x39dd1d678bec2eed, MsgID: 0x0) (SA, VID) 192.168.200.1, 500, mail.domain.com 192.168.400.1, 500, 192.168.400.1.dimcom.net    
364 08/26/2010 14:11:12.716 IKE Initiator: No response - remote party timeout 192.168.400.1, 500, 192.168.400.1.dimcom.net 192.168.200.1, 500, mail.domain.com    
365 08/26/2010 14:11:03.800 IKE Responder: Received Main Mode request (Phase 1) 192.168.200.1, 500, mail.domain.com 192.168.400.1, 500, 192.168.400.1.dimcom.net    
366 08/26/2010 14:11:03.800 RECEIVED<<< ISAKMP OAK MM (InitCookie 0x39dd1d678bec2eed, MsgID: 0x0) (SA, VID) 192.168.200.1, 500, mail.domain.com 192.168.400.1, 500, 192.168.400.1.dimcom.net    

368 08/26/2010 14:11:00.716 IKE Initiator: No response - remote party timeout 192.168.400.1, 500, 192.168.400.1.dimcom.net 192.168.200.1, 500, mail.domain.com    
369 08/26/2010 14:10:56.833 IKE Responder: Received Main Mode request (Phase 1) 192.168.200.1, 500, mail.domain.com 192.168.400.1, 500, 192.168.400.1.dimcom.net    
370 08/26/2010 14:10:56.833 RECEIVED<<< ISAKMP OAK MM (InitCookie 0x39dd1d678bec2eed, MsgID: 0x0) (SA, VID) 192.168.200.1, 500, mail.domain.com 192.168.400.1, 500, 192.168.400.1.dimcom.net  
372 08/26/2010 14:10:52.833 SENDING>>>> ISAKMP OAK MM (InitCookie 0xb25cd2594ed9f2f0, MsgID: 0x0) (SA, VID, VID) 192.168.400.1, 500, 192.168.400.1.dimcom.net 192.168.200.1, 500, mail.domain.com    
373 08/26/2010 14:10:52.833 IKE Initiator: Start Main Mode negotiation (Phase 1) 192.168.400.1, 500, 192.168.400.1.dimcom.net 192.168.200.1, 500, mail.domain.com    
374 08/26/2010 14:10:52.716 IKE negotiation aborted due to timeout 192.168.400.1, 192.168.400.1.dimcom.net 192.168.200.1, mail.domain.com    

----------------------------------

192.168.200.1 is TZ170
192.168.400.1 is TZ180

All VPN tunnel settings are identical.
I can successfully ping WAN ports on both remote routers. Therefore, they see each other without any issues.
I have disabled Dead peer option to eliminate any chances here.

Thank you
0
Comment
Question by:learn_it
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
8 Comments
 

Author Comment

by:learn_it
ID: 33536449
forgot to add...
At the same time, 2 VPN tunnels from TZ180 to SOHO3's are working just fine...
And again, settings for those tunnels are identical.
0
 
LVL 8

Expert Comment

by:jimmyray7
ID: 33536533
Does power cycling the TZ180 help?   If that's not feasible, try unchecking the "Enable VPN" checkbox at the top of the VPN tab, click apply, check it again, and click apply.  This will reset all VPN connections.
0
 

Author Comment

by:learn_it
ID: 33539126
actually, power cycling has become a reason for losing VPN to TZ170.

I have spent 12 hours today trying any possible VPN setup - no luck. Just checked 6-7 hours later, VPN to TZ170 started working...by itself. All i did before I left was changing Preshared key. That didn't help right away, but may have caused eventual fix.

VPN to cisco is still timing out. i have just disabled that particular VPN tunnel and reenabled it. We'll see what happens.

0
Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

 

Accepted Solution

by:
learn_it earned 0 total points
ID: 33619410
issue resolved.
Keep alive had to be enabled on ONE END ONLY. I had it selected on both ends. Sonicwall tech support assured that it was the reason why devices were timing out all the time.
0
 

Author Comment

by:learn_it
ID: 33619415
case may be closed now.
thanks for your input, jimmyray7.
0
 

Author Closing Comment

by:learn_it
ID: 34126678
Tech support resolved the issue
0
 
LVL 2

Expert Comment

by:dpedersen13
ID: 34853745
Simple and Elegant.  Thanks for posting the solution, thought I was going crazy.  I'd award points if I could
0
 

Author Comment

by:learn_it
ID: 34856714
Glad that it helped :) I have just upgraded all Sonicwalls with newer models. Had the same issue until I unchecked the box on on end.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question