asked on 9/11/2013

Watchguard XTM330 firewall BOVPN problem

I've been having some problems with my office BOVPN lately, randomly the bridge between our two offices breaks. We have two identical XTM330 firewalls on both locations and both have the same configuration, done using this guide:

http://www.watchguard.com/help/docs/webui/11/en-us/content/en-us/bovpn/manual/manual_bovpn_fireware-xtm_fireware-xtm_web.html

But sometimes randomly the tunel stops working and we can't access the other office's network. Usually resetting the firewalls temporaly fixes the issue.

I got the following debug messages off both firewalls logs:

Office A firewall

Process=iked msg=(officeAExternalIP<->officeBExternalIP)MWAN-Failback notify ikePcy=0x1078b638(officeBTunel), p1said=0xc645b540 UP

Process=iked msg=(officeAExternalIP<->officeBExternalIP)MWAN-Failback failed to find the ikePcyGrp by ikePcy - name=officeBTunel

Office B firewall

Process=iked msg=(officeBExternalIP<->officeAExternalIP)MWAN-Failback notify ikePcy=0x1078b638(officeATunel), p1said=0xc645b540 UP

Process=iked msg=(officeBExternalIP<->officeAExternalIP)MWAN-Failback failed to find the ikePcyGrp by ikePcy - name=officeATunel

Does anyone know what could be causing this?

Hardware Firewalls Networking Hardware-Other

Last Comment

Brian

9/25/2013

dpk_wal

9/12/2013

Looking at the logs it looks like that there was disruption in internet service...WG tried to fallback to backup internet [which I guess is not configured in your network] and did not succeed.

Can you make sure that the internet indeed remains up all the time.

Also, please make sure that you have configured IKE keep-alive...though not directly relevant here but can help.
As per link you posted:
Select NAT Traversal, IKE Keep-alive, or Dead Peer Detection (RFC3706). Make sure you select the same values you chose in the BOVPN Tunnel Settings.

Please check and update.

Thank you.

ScreenFox

9/12/2013

ASKER

I checked and right now the firewalls are using dead peer detection, before we were using only IKE keep-alive but the problem started happening so following the recommendation of the guide on that link I changed IKE keep-alive for Dead peer detection.

But the problem it's still there. I checked the Internet connections and no user has reported any problem with the internet.

Thanks for your reply

SOLUTION

dpk_wal

9/12/2013