Technical Tip: IPsec tunnel traffic issues after upgrade to v6.2.4.
Description
IPSec tunnel does not pass traffic configured on interface with VLAN ID 1 after upgrade to v6.2.4.
Scope
For version 6.2.4 and above.
Solution
Both phases of IPSec tunnel shows up after upgrade to v6.2.4 but the tunnel traffic does not work.
The traffic enters firewall and the sniffer shows that packets are sent out but the packet is not forwarded out by NP.
Sniffer Output:
This is expected behavior from v6.2.4 onwards as vlan ID 1 is reserved in FOS 6.2.4.
Avoid using VLAN ID 1.
Any configurations that use a VLAN with vlan ID 1 will not work as expected.
After changing IPSec to other VLAN based settings, such as vlan10, this issue will be gone.
(Reference bug ID: 698527).
Workaround.
There are 2 workarounds:
1) Use VLAN ID other than 1 (or).
2) Disable npu-offload under IPSec Phase-1 interface:
IPSec tunnel does not pass traffic configured on interface with VLAN ID 1 after upgrade to v6.2.4.
Scope
For version 6.2.4 and above.
Solution
Both phases of IPSec tunnel shows up after upgrade to v6.2.4 but the tunnel traffic does not work.
The traffic enters firewall and the sniffer shows that packets are sent out but the packet is not forwarded out by NP.
Sniffer Output:
[FPM03] 11.211328 1-A3 in 192.168.10.5 -> 10.45.32.8: icmp: echo requestFrom below output, the packets are received but not transmitted:
[FPM03] 11.211360 tunnel1 out 192.168.10.5 -> 10.45.32.8: icmp: echo request
[FPM03] 11.220450 1-A3 in 192.168.10.5 -> 10.45.32.8: icmp: echo request
[FPM03] 11.220465 tunnel1 out 192.168.10.5 -> 10.45.32.8: icmp: echo request
[FPM03] 16.074098 1-A3 in 192.168.10.5 -> 10.45.32.8: icmp: echo request
[FPM03] 16.074111 tunnel1 out 192.168.10.5 -> 10.45.32.8: icmp: echo request
FGT (Vdom) # get vpn ipsec tunnel summaryThis issue occurs when IPSec is created on an interface that is tagged with VLAN ID-1 and ingress port is un-tagged.
'tunnel1' 10.1.1.1:0 selectors(total,up): 3/3 rx(pkt,err): 16006/0 tx(pkt,err): 88/0
This is expected behavior from v6.2.4 onwards as vlan ID 1 is reserved in FOS 6.2.4.
Avoid using VLAN ID 1.
Any configurations that use a VLAN with vlan ID 1 will not work as expected.
After changing IPSec to other VLAN based settings, such as vlan10, this issue will be gone.
(Reference bug ID: 698527).
Workaround.
There are 2 workarounds:
1) Use VLAN ID other than 1 (or).
2) Disable npu-offload under IPSec Phase-1 interface:
# config vdom
edit vdom1
# config vpn ipsec phase1-interface
edit "tunnel1"
set npu-offload disable
end
