IPSITE Connect SLR5500 one way problem

[tobyswe]

Hi all

I have a strange problem with an IPSITE connect setup. We are running two repeaters, one master and one peer. We have a problem that manifests as follow.
if the channel is not active, i can not initiate a call from the Master side. If i open from the peer and answer within the hangtime , then it works. But after the hangtime it stops.
We first used ordinary IPSEC with different subnets. But now today we did a openVPN TAP configuration instead as it has solved the problem for others.
However its exactly the same problem.

If i take in the two repeaters in our lab and connect an ethernet cable in between, then it works. So its no problem with that, We have been experimenting with the PEER firewall open timer and beacon duration /beacon interval but we dont seems to find any solution.
With the new TAP VPN, all repeaters are in the same subnet, so no it should work. The routers are Teltonika RUTx11

The latency sometimes can be up to 50 -60 ms, however i have ran these kind of systems before without any problem even on latency above 100 ms.
What am i overlooking ?
Is it still a NAT issue, even if we use a TAP VPN ?
Its the first time im using Teltonika, but i seen other posts with people using that router so it should be fine.

Thankful for any help i can get.

Best regards
Toby

 

[EuropeanUser]

How are the firewalls configured? Do they let traffic pass both ways even when not previously established or related?

 

[ITWorx]

I agree with EuropeanUser - Start with the firewalls and make sure they are set up to pass traffic accordingly, and work your way from there.

 

[TampaTyron]

Can you connect to the master repeater with RDAC and look for any alarms? I would reduce the repeater RSSI from -100 to -60 (for testing) and make sure the subscriber (radio) admit criteria is "Polite to own color code" on all channels (or Always if you are brave).

TT

 

[jsx]

This sounds like a traffic or rule problem. The traffic/firewall rules should be checked to ensure they allow the traffic and correct ports.
I'd also check the VPN timeouts. I'm not familiar with those specific routers but generally with IPSEC if the lifetimes are not matched on each side and DPD is not enabled it's possible the tunnel keeps attempting to use a stale SA.
Double check the IP subnet masks and gateways on the repeaters.

 

[dickie757]

Try Wiregaurd as the VPN. Tailscale is a way to simplify setting it up.