Troubleshooting VPN Connectivity

Reset a dead peer for L2TP VPN on USG or EdgeRouter

This fix is for a VPN connection that was working, but is not working currently. For L2TP VPNs only. To our knowledge this is only prevalent on Windows computers.

Direct the affected person to go to ipinfo.tw in their browser on the affected device - this will have their WAN IP for the following steps
SSH into router
Run sudo swanctl --list-sa | grep -B 2 ###.###.###.### replacing the #s with the Public WAN IP of the person having the issue.
Take note of the line that says remote-access: #XXXX, ESTABLISHED and jot down the number after the #.
Run sudo swanctl --terminate --ike-id XXXX where XXXX is the number from the previous step
You should receive a message terminate completed successfully.
The client should be able to reconnect to the VPN now

Disable IPv6

If the dead peer isn't present when running the above commands, check to see if the client computer is preferring IPv6. This is known to cause connectivity issues in at least one instance, and the fix was not obvious.

While troubleshooting, we observed that the client computer was showing an IPv6 address on https://ipinfo.tw, where it normally shows an IPv4 address. The client was not able to connect to the VPN while IPv6 was enabled.

After disabling IPv6 for their primary network card (the WiFi in this case, but ethernet if it's hard-wired) in "Change adapter options" --> The adapter --> Properties --> uncheck IPv6, the VPN connection could then establish.

Additional information

The following document details troubleshooting instructions for the end user. This can be distributed to the customer: