Firewall – Unstable VPN Connections from netgear router

firewallipsecnetgearvpn

I am having trouble with a NETGEAR ProSafe VPN Firewall (model FVX538).

The system is set up to form one end of an IPSec VPN tunnel, and most of the time it works fine. However, for a couple of days a week, it seems to give up and drops the connection every few minutes. This doesn't seem to be related to network load (although the monitoring on this particular box is woefully inadequate).

Any suggestions as to what might be going on here and how to solve it?

Here is an excerpt from the logs around one of the events (IP addresses replaced with **):

2010 Jan 22 17:35:18 [FVX538] [IKE] Initiating new phase 2 negotiation: **[0]<=>**[0]_
2010 Jan 22 17:35:18 [FVX538] [IKE] The packet is retransmitted by **[500]._
2010 Jan 22 17:35:18 [FVX538] [IKE] the packet retransmitted in a short time from **[500]_
2010 Jan 22 17:35:19 [FVX538] [IKE] The packet is retransmitted by **[500]._
2010 Jan 22 17:35:25 [FVX538] [IKE] wrong state 8._
            - Last output repeated 2 times -
2010 Jan 22 17:35:36 [FVX538] [IKE] attribute has been modified._
2010 Jan 22 17:35:47 [FVX538] [IKE] IPsec-SA established: ESP/Tunnel **->** with spi=86788277(0x52c48b5)_
2010 Jan 22 17:35:48 [FVX538] [IKE] The packet is retransmitted by **[500]._
2010 Jan 22 17:35:48 [FVX538] [IKE] IPsec-SA established: ESP/Tunnel **->** with spi=523825667(0x1f38f203)_
2010 Jan 22 17:35:49 [FVX538] [IKE] IPsec-SA established: ESP/Tunnel **->** with spi=57677960(0x3701888)_
2010 Jan 22 17:35:49 [FVX538] [IKE] IPsec-SA established: ESP/Tunnel **->** with spi=523825668(0x1f38f204)_
2010 Jan 22 17:35:51 [FVX538] [IKE] Sending Informational Exchange: delete payload[]_
2010 Jan 22 17:35:51 [FVX538] [IKE] an undead schedule has been deleted: 'pk_recvupdate'._

EDIT:

The other end is an enterprise grade juniper box over which I have no control. On the netgear box, upgrading the firmware was the first thing I tried, with no luck…

Best Answer

Best course of action with the FVX538 is put it in the bin. That way you save yourself days and days of figuring out its designers were nocturnal rodents from the moon. And that's with firmware 3.0.6-29. I hate to think what previous firmware was like.