Draytek Replacement Advice

bigdunc · 28 Nov 2021 at 13:35

Hi

I need to replace a Draytek 2952 due to IPSEC VPN issues that just stop passing traffic even though the VPN stays connected. I have spoken to Draytek support but they haven't got an answer to why it is happening. Can anyone recommend a good alternative?

Cheers

bigdunc · 29 Nov 2021 at 13:53

Anyone?

I have had a quick look at the Sophos XG, Sonicwall and Fortigate but not sure if they are good options or if I should be looking at something else

Cheers

brendy · 29 Nov 2021 at 14:03

bigdunc said:
Hi

I need to replace a Draytek 2952 due to IPSEC VPN issues that just stop passing traffic even though the VPN stays connected. I have spoken to Draytek support but they haven't got an answer to why it is happening. Can anyone recommend a good alternative?

Cheers

Daft question, its on its latest software release? They do release updates relatively often for most devices.

bigdunc · 29 Nov 2021 at 14:53

brendy said:
Daft question, its on its latest software release? They do release updates relatively often for most devices.

Yeah it's got the latest firmware on and the VPN stays connected, just traffic stops going over it. Can't ping anything on the other side of the VPN and we have to drop the VPN and let the tunnel come back up for things to work again

Trig · 29 Nov 2021 at 14:58

Nothing in the error logs I presume, from the devices at both sides..

ChrisD. · 29 Nov 2021 at 15:21

Is the keepalive function of the VPN configuration enabled?

bigdunc · 29 Nov 2021 at 16:42

Trig said:
Nothing in the error logs I presume, from the devices at both sides..

The VPN is to a Cisco ASA in Rackspace. They have confirmed the config is correct on the Draytek and all they can see in their logs is IPv6 traffic even though IPv6 is disabled on the Draytek which Draytek have confirmed

bigdunc · 29 Nov 2021 at 16:48

ChrisD. said:
Is the keepalive function of the VPN configuration enabled?

The VPN is set to 'Always on'. There is an option to 'Enable PING to keep IPsec tunnel alive' but Draytek say that shouldn't be enabled as it uses Dead Peer Detection to check the liveness of VPN

WJA96 · 30 Nov 2021 at 06:08

I would suggest running up a trial copy of Untangle. It’ll cost nothing but some time and it has really good VPN capabilities.

Alternatively the Mikrotik RB4011 or RB5009 are very strong VPN routers, but getting started with them is about as steep a learning curve as they come.