Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am having trouble with a NETGEAR ProSafe VPN Firewall (model FVX538).

The system is set up to form one end of an IPSec VPN tunnel, and most of the time it works fine. However, for a couple of days a week, it seems to give up and drops the connection every few minutes. This doesn't seem to be related to network load (although the monitoring on this particular box is woefully inadequate).

Any suggestions as to what might be going on here and how to solve it?

Here is an excerpt from the logs around one of the events (IP addresses replaced with **):

2010 Jan 22 17:35:18 [FVX538] [IKE] Initiating new phase 2 negotiation: **[0]<=>**[0]_
2010 Jan 22 17:35:18 [FVX538] [IKE] The packet is retransmitted by **[500]._
2010 Jan 22 17:35:18 [FVX538] [IKE] the packet retransmitted in a short time from **[500]_
2010 Jan 22 17:35:19 [FVX538] [IKE] The packet is retransmitted by **[500]._
2010 Jan 22 17:35:25 [FVX538] [IKE] wrong state 8._
            - Last output repeated 2 times -
2010 Jan 22 17:35:36 [FVX538] [IKE] attribute has been modified._
2010 Jan 22 17:35:47 [FVX538] [IKE] IPsec-SA established: ESP/Tunnel **->** with spi=86788277(0x52c48b5)_
2010 Jan 22 17:35:48 [FVX538] [IKE] The packet is retransmitted by **[500]._
2010 Jan 22 17:35:48 [FVX538] [IKE] IPsec-SA established: ESP/Tunnel **->** with spi=523825667(0x1f38f203)_
2010 Jan 22 17:35:49 [FVX538] [IKE] IPsec-SA established: ESP/Tunnel **->** with spi=57677960(0x3701888)_
2010 Jan 22 17:35:49 [FVX538] [IKE] IPsec-SA established: ESP/Tunnel **->** with spi=523825668(0x1f38f204)_
2010 Jan 22 17:35:51 [FVX538] [IKE] Sending Informational Exchange: delete payload[]_
2010 Jan 22 17:35:51 [FVX538] [IKE] an undead schedule has been deleted: 'pk_recvupdate'._

EDIT:

The other end is an enterprise grade juniper box over which I have no control. On the netgear box, upgrading the firmware was the first thing I tried, with no luck...

share|improve this question
    
What is at the other end of the VPN tunnel? Have you tried upgrading to the latest firmware? kbserver.netgear.com/products/FVX538.asp –  stukelly Jan 23 '10 at 14:16
add comment

1 Answer

up vote 2 down vote accepted

best course of action with the FVX538 is put it in the bin. that way you save yourself days and days of figuring out its designers were nocturnal rodents from the moon. and thats with firmware 3.0.6-29. i hate to think what previous firmwares were like.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.