IPsec VPN tunnel disconnects during periods of inactivity in VMware NSX

Products

• VMware NSX

Issue/Introduction

In VMware NSX, an IPsec VPN tunnel may disconnect or transition to a 'Down' state when there is no active user data traffic. This behavior typically occurs when the remote peer device or intermediate network infrastructure enforces idle timers that tear down the Security Association (SA) in the absence of traffic.

• The IPsec VPN tunnel status shows Down or Negotiating after a period of inactivity.
• Connectivity is restored only after interesting traffic (data plane) is initiated from the local network.
• Lack of continuous monitoring visibility when no user traffic is present.

Environment

• Product: VMware NSX
• Component: IPsec VPN / NSX Edge
• Version: 4.2.3.3 and earlier
• Configuration: Site-to-Site IPsec VPN (Policy-Based or Route-Based)

Cause

IPsec sessions are often configured with idle timers on the remote peer device. If no data plane traffic is detected within the specified interval, the remote peer initiates a deletion of the Security Association (SA) to conserve resources. This is an expected behavior of the IPsec protocol implementation on many third-party gateway devices when keepalives or data packets are not present.

Resolution

To maintain an active IPsec VPN tunnel and monitor its health during periods of inactivity, implement one of the following workarounds:

• Configure a Dead Peer Detection (DPD) Profile
  
  • Assign a custom DPD profile to the IPsec session with the Probe Mode set to Periodic. This ensures the NSX Edge sends continuous ISAKMP keepalive probes at a specific interval, regardless of active data plane traffic.
  • Refer to TechDoc Add DPD Profiles. 
• Continuous ICMP (Scripted Synthetic Traffic)
  
  • If the remote peer ignores DPD keepalives and strictly requires data-plane traffic to maintain the SA, use synthetic traffic.
  • Refer to KB 379731 Troubleshooting NSX IPSec VPN
• SNMP Polling
  
  • Utilize a Network Management System (NMS) to poll a remote device via SNMP across the VPN tunnel.
  • Refer to TechDoc Simple Network Management Protocol (SNMP).
• Syslog Monitoring
  
  • Forward NSX Edge logs to a remote Syslog server to alert on tunnel state changes.
  • Refer to TechDoc  Add Syslog Servers for NSX Nodes.

Additional Information

• For details on Dead Peer Detection, refer to TechDoc Add DPD Profiles. 
• For further diagnostic steps and details on scripted sythnetic traffic, refer to KB 379731 Troubleshooting IPsec VPN in VMware NSX .
• For details on SNMP Polling, refer to TechDoc Simple Network Management Protocol (SNMP).
• For details on Syslog Monitoring, refer to TechDoc  Add Syslog Servers for NSX Nodes.