Hello,

I've been using Mikrotik's IPSec for VPN's for a long time with almost no problems. VPNHub is a RB1000 and peers use 450G. For sometime now my tunnels stop passing traffic, with no data flowing in one of the SA's of the tunnel. As you may know, each tunnel creates two SA's: one from VPNHub to peer and another from peer to VPNHub. Just one of the directions stop passing data. I don't know how to verify it, but to me the problem arises when the SA expires and tries to renegotiate another SA, for some reason it stops passing traffic. I haven't been able to locate anything special in the log files. My SA's lifetime is set to the default 30 minutes. Flushing the SA's on the peer's couter or at the VPNHub fixes the problem.

Don't know if it is related, but I see that there are more than one SA for each peer/direction but only one is currently passing traffic. That is, peer is accesible through the VPN but there are many SA's created.

What could be wrong? As the problem is quite random, is it worth to send a mail to Mikrotik support?

Thanks!

I still have this problem, but I have narrowed it down to my DSL routers on the branch offices stopping to send ESP packets to the Mikrotik router behind them. The test I did was to disable DPD on that tunnel and reboot the DSL router when the tunnel stopped sending packets. After the reboot, the tunner started passing packets again WITH THE SAME SA's.

As I have no control over the DSL routers, I'm using a script to check if the tunnel is working correctly:

:if ([/ping REMOTE_IP_REACHABLE_BY_THE_VPN_TUNNEL interval=3 count=3]<2) do={
:log warning "IPSec KO, flushing SAs"
/ip ipsec installed-sa flush sa-type=all
} else={
:log info "IPSec OK"
}

I run it every 33 seconds.
Hope it helps!