Always-on VPN requires Airplane mode toggle if Phone was offline

Question

artooro OP

Created Dec ’20

Replies 1

Boosts 0

Views 1.4k

Participants 2

Steps to reproduce this issue (at least to some degree, see further explanation below) are:

Configure an Always-on IKEv2 VPN
While the phone is connected, shutdown it's Internet access (in my last test I just disconnected the modem from the router and had cellular disabled)
With the phone in sleep, leave it alone for an extended period, in my case I left it for 30 minutes with it's wi-fi not having access to the Internet
Re-enable Internet (I reconnected the modem to the router)

When this happens the phone will say "Connecting..." but doesn't quickly try to re-connect. If you leave the phone for about 5 minutes or so it will generally re-connect eventually.

While it's in a state of a working Internet connection but stuck at Connecting, in the console logs I see:

Code Block Dec 29 10:15:21 iPhone SpringBoard(SpringBoard)[60] <Notice>: vpn is unchanged, still enabled

But nothing else to indicate what could be done to improve it.

I have Dead Peer Detection Rate set to Medium.

This is an issue for customers in remote areas with poor cellular data and unreliable wi-fi, where the phones are not re-establishing their VPN connection causing them to miss incoming notifications and messages. Generally they turn Airplane mode on and off to trigger the VPN to re-establish.

Is there anything I can do to improve the reliability of re-connects, make them faster? etc?

Boost

Answer 1

Systems Engineer OP

Apple

Jan ’21

Is there anything I can do to improve the reliability of re-connects, make them faster? etc?

Generally, it sounds like you are running the right tests. The first place I would check, during this lag time of reconnection, is the server. If you are at least making it to the server you may just be experiencing high latency or there may be other server side errors going on here. Double check the logs on the server for more info. If you have to turn Airplane mode on and off it sounds like you do not have the required cellular path needed to connect your virtual interface for your tunnel. (For example, your pdp_ip0 interface only has v6 and you are trying to connect over v4). If you running this from a Personal VPN, then displaying the "Connecting..." message from NEVPNStatus to let the user know the current status of the tunnel until this issue resolves itself.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0