Site-to-Site VPN from MX64 to Non-Meraki (SonicWALL TZ) stops passing traffic

[DunJer622]

Greetings,

I have several MX64-Non-Meraki (SonicWALL TZ205w and TZ300) VPNs.  Generally, all of them work without issue.  However, for no apparent reason, some of them will stop passing traffic.  If I look at the SonicWALL, it says the tunnel is online, but it isn't.  Once I renegotiate the tunnel, the VPN starts passing traffic again within seconds.  The other weird thing is that it doesn't drop all the tunnels between the devices.  I thought we were getting false positives, as I could ping the site from my workstation VLAN, but I then found that I couldn't do so from my server VLAN.

Any ideas on what is causing this?

Thanks,

Jeremy

[PhilipDAth]

See if the SonicWall has an option to enable dead peer detection and/or keepalives. 

[DunJer622]

They do and they are all enabled.

[JamesMN140]

This is the exact behavior i'm seeing on my Sonicwall NSA -> Meraki VPN setup.

[JohnT]

I had the same problem with Sophos UTM's and I had to disable NAT-T.  Meraki support had to disable it on their end.  It might be worth looking in to.

[JamesMN140]

Thanks for this heads up. A ticket was open and i'll have them try that first.

[Nash]

I've had success in the past with having support disable nat-t. It was between an ASA and an MX65, but I had a tunnel that just kept... dropping. Up and happy for a while, then boom splat unhappy remote site with no DNS.

After support disabled NAT-T, it has stayed up successfully for almost two months. I hope you get the same result!

[Sprocket]

+1

[GaryShainberg]

HI there,

Having just completed both the SNSA and SNSP courses, one of the things that was highlighted was to make sure only one end of the site has keep-alives active, unfortunately on the Meraki side there is no keep-alive option so you must make sure this is enabled on the Sonicwall side, also you might find playing with the MTU may also work.