Staff

Technical Tip: IPsec tunnel will get stuck and drop packets due to 'engine_status = 00000000' in np6Xlite register

Description

This article describes how to troubleshoot and use a workaround or fix for scenarios where IPsec VPN traffic unexpectedly stops.

Scope

NP6, NP6xlite, SOC4 model.

Solution

Troubleshooting:

Execute the following CLI command several times and confirm that the output continues to show '00000000'.

diagnose npu np6xlite register 0 | grep engine_status
engine_status =00000000 [16:23]

Execute the following CLI command several times, and confirm if the IPSEC_O parameter never changes value:

fnsysctl cat /proc/net/np6xlite_0/pdq

Cause:

If the value continues to show '00000000', the IPsec Engine will hang due to NP buffer limitation.

Disable NPU offloading.

config firewall policy
edit <policy_name>
set auto-asic-offload disable

next
end

Upgrade to one of the following versions for a fix:

Sign up