- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
How to Solve - IKEV2 Out Of Memory Error In Logs
08/03/2020 
10 People found this article helpful
39,907 Views
Description
This article details the rare symptoms of IKEv2 Out of Memory error and how to resolve it.
Symptoms:
IKEv2 VPN Tunnel interfaces are not able to re-negotiate once SA lifetime expires. GUI Logs display IKEv2 Out of Memory error, a reboot is required to re-establish existing tunnel(s) once firewall runs out of memory. These symptoms are due to a misconfiguration caused by binding the VPN to an incorrect interface. The tunnel can never establish locally with this misconfiguration in place although the remote end of the tunnel may have hardware that shows the tunnel as up while the tunnel re-negotiates. After thousands of attempts to complete a successful phase one negotiation and the firewall has been left in this misconfigured state for an extended period of time the memory allocated for phase one negotiations will run out. The firewall can no longer process IKEv2 phase 1 negotiations in this condition until there is a restart or the misconfiguration is corrected.
Cause
The following conditions exist for this error:
1) VPN is bound to an incorrect interface for an extended period of time, more than one day.
2) The incorrect interface selected is not a WAN interface
3) The VPN tunnel has an all zero gateway (0.0.0.0) (Tunnel Interface)
4) More than one tunnel interface must exist, to impact other tunnel interface phase one negotiations.
Resolution
Check through any configured IKEv2 tunnel interface VPN and be sure the correct local WAN interface has been selected within the VPN tunnel configuration. There is no need to check tunnels known to be working as expected. A VPN tunnel can not establish when it has been bound to an incorrect interface so first check tunnels that were never active.
ISSUE ID:
215736
Related Articles
- How to force an update of the Security Services Signatures from the Firewall GUI
- How to upload security services signatures manually on Closed Environments?
- How to Create Gen 7 Settings File by Using the Online Migration Tool
Categories
- Firewalls > SonicWall SuperMassive E10000 Series
- Firewalls > NSa Series
- Firewalls > TZ Series
- Firewalls > NSsp Series
- Firewalls > SonicWall SuperMassive 9000 Series
YES
NO