7.4.4 - IPSec - Route not assigned after reconnect

[Team-IT]

No IPSec traffic cause of missing routing entry on 7.4.4 after hard disconnecting the "client" firewall.

additional info: main firewall is 200F - connecting client firewall is 60F (here i testet with 7.0 / 7.2 and 7.4 - so this is not important)

Following scenario on 7.4.4:

1) Connect "IPSec from DEV"

    edit "IPSec from DEV"
        set type ddns
        set interface "*******"
        set ike-version 2
        set keylife 5400
        set peertype any
        set net-device disable
        set proposal aes256-sha512 aes256-sha384
        set localid "*********"
        set auto-negotiate disable 
        set dpd on-idle             <- also testet without this line
        set npu-offload disable     <- also testet without this line
        set dhgrp 21 19 16
        set nattraversal disable
        set remotegw-ddns "***.**.*********.***"
        set psksecret ENC *****==
    next

2) get router info routing-table all

C       192.168.255.40/32 is directly connected, IPSec from DEV
S       192.168.255.41/32 [5/0] via IPSec from DEV tunnel 10.0.0.1, [1/0]
C       192.168.255.86/32 is directly connected, IPSec from PL
S       192.168.255.87/32 [5/0] via IPSec from PL tunnel 10.0.0.2, [1/0]
C       192.168.255.88/32 is directly connected, IPSec from BC
S       192.168.255.89/32 [5/0] via IPSec from BC tunnel ***.**.***.**, [1/0]

3) HARD POWER OFF "DEV" Firewall and wait 10-15 seconds

4) POWER ON "DEV" Firewall and wait till it connects (3-5 minutes)

5) get router info routing-table all

C       192.168.255.40/32 is directly connected, IPSec from DEV
C       192.168.255.86/32 is directly connected, IPSec from PL
S       192.168.255.87/32 [5/0] via IPSec from PL tunnel 10.0.0.2, [1/0]
C       192.168.255.88/32 is directly connected, IPSec from BC
S       192.168.255.89/32 [5/0] via IPSec from BC tunnel ***.**.***.**, [1/0]

The "192.168.255.41" line is missing (after a hard failure of the client firewall) an cannot even be added manually so the IPSec comes UP but since there is no route totally no traffic is flowing. 7.4.3 is building this route even after 10 "disconnects" - so something must be wrong with 7.4.4.

Can someone reproduce this and have the same issue?

[hbac]

Hi @Team-IT,

What do you mean "POWER ON "DEV" Firewall and wait till it connects"? You rebooted the firewall and reconnected to the VPN or you are using auto-negotiating? 

Regards, 

[Team-IT]

while "DEV (FG 60F) is ON and IPSec is connected just hard pull the power cord and replug it (like simulating a power outage) [there are other ways to reproduce this IPSec behavior; but this one works 100%]. "DEV" reboots and IPSec is automatically connecting again after a short time. And yes on "DEV" auto-negotiate is enabled:

    edit "IPSec to MAIN"
        set interface "*******"
        set ike-version 2
        set keylife 5400
        set peertype any
        set net-device disable
        set proposal aes256-sha512 aes256-sha384
        set localid "*******"
        set dpd on-idle           <- also tested without this line
        set npu-offload disable   <- also tested without this line
        set dhgrp 21 19 16
        set nattraversal disable
        set remote-gw *****FIXED IP*****
        set psksecret ENC *****==
    next