Home / OCI

OCIRunbookIntermediate

OCI Site-to-Site VPN (IPSec) tunnel down: runbook

Check tunnel status, compare IKE/IPSec parameters with the CPE, fix BGP or static routing, and verify DRG and VCN route tables when the OCI VPN won't pass traffic.

Deepak Bhardwaj2 min read

Applies toOCI Site-to-Site VPN v2, Dynamic Routing Gateway (DRG), customer premises equipment (CPE)

1. Tunnel status

oci network ip-sec-tunnel list --ipsc-id $IPSC \
  --query 'data[].{ip:"vpn-ip", status:status, ike:"ike-version", routing:routing, bgp:"bgp-session-info"."bgp-state"}' --output table

OCI provides two tunnels per IPSec connection. Configure both on the CPE. Oracle maintenance may take one down.

2. Phase 1 / phase 2 parameters

Use the console's CPE configuration helper (choose your vendor and model) to generate the CPE-side configuration, and compare it with what's running on the device.

  • The IKE version matches (IKEv2 recommended).
  • Shared secrets match for each tunnel:
    oci network ip-sec-psk get --ipsc-id $IPSC --tunnel-id $TUNNEL
  • Encryption, authentication and DH groups are within Oracle's supported set. Custom phase 1/2 settings can be pinned on the tunnel.
  • The CPE object's public IP is the device's real outside IP. If the device is behind NAT, set the CPE IKE identifier to match what it sends.

3. Routing type

Routing Check
BGP (recommended) BGP state UP. ASNs and inside tunnel IPs match. The CPE advertises on-premises prefixes.
Static Static routes on the IPSec connection list all on-premises CIDRs
Policy-based Encryption domains on the CPE match OCI's configuration exactly

4. DRG and VCN routing

Traffic can be "up" on the tunnel and still go nowhere:

  • The VCN subnet route table sends the on-premises CIDR to the DRG.
  • The DRG route table for the VCN attachment includes routes from the IPSec attachment (through import distributions), and vice versa.
  • Security lists or NSGs allow the on-premises CIDR.
  • The on-premises firewall allows the VCN CIDR, and the on-premises routing points the VCN CIDR at the CPE.

Use Network Path Analyzer with an on-premises source CIDR and a VCN destination to find the blocking hop.

5. Flapping

  • DPD settings too aggressive for a lossy ISP link.
  • Asymmetric traffic between the two tunnels without BGP. Prefer BGP with consistent AS path or MED settings to choose the primary tunnel.
  • The CPE rekeys with different proposals than the original negotiation.

Monitoring

Alarm on the VPN metric for tunnel state in the oci_vpn namespace (one alarm per tunnel), and on packets dropped. Get notified when either tunnel drops, not only when both are down.

Tip

For production hybrid connectivity, consider FastConnect as primary with IPSec VPN as a backup path, both on the same DRG.

Related fixes