Cannot read reply from the service

[cspwizard]

With latest 5.1.0 update I'm getting the error "Cannot read reply from the service" few times a day. Looks like the service hangs. When the issue occurs connection to VPN breaks.

Last messages in log prior restart:
snx-rs[691428]: #33[2m2026-02-26T14:14:23.816725Z#033[0m #33[33m WARN#033[0m #33[2msnxcore::tunnel::ipsec::connector#033[0m#033[2m:#33[0m OM session exchange failed: deadline has elapsed, reusing previous settings
snx-rs[691428]: #33[2m2026-02-26T14:14:53.266436Z#033[0m #33[33m WARN#033[0m #33[2msnxcore::ccc#033[0m#033[2m:#33[0m Disabling all certificate checks!!!
systemd[1]: Stopping snx-rs.service - SNX-RS VPN client...

[ancwrd1]

Does it work reliably with the older version? There were no recent changes related to the IKE sessions or IP renewal.
May be you can increase the ike-lifetime parameter to something like 864000 so it does not expire early.

[cspwizard]

previously I used ssl mode, ipsec also had issues. I'll check if ssl would make any difference for this issue if the lifetime setting wouldn't help

[ancwrd1]

Another thing to try, check the debug log and find what is the negotiated "OM IP lifetime", and may be force it to be shorter via ip-lease-time option.

[cspwizard]

Changing ike-lifetime made the tunnel to work all day without hanging, however the service hangs. So the next day I've to restart it. Last messages in the log was

OM session exchange failed: deadline has elapsed, reusing previous settings
Challenge code error: No session in reply, VPN server may be running out of OM licenses!

OM IP lifetime set during connection: OM IP lifetime: 900 seconds

[ancwrd1]

Could you please share more of the debug log? Those last lines are most likely from service restart.

[cspwizard]

2026-03-03T20:01:43.018760Z DEBUG isakmp::ikev1::service: Begin sending OM request
2026-03-03T20:01:43.018949Z DEBUG isakmp::transport::tcpt: Connecting to endpoint_ip:443
2026-03-03T20:01:43.266352Z DEBUG isakmp::transport::tcpt: Connected, starting TCPT handshake
2026-03-03T20:01:43.315377Z DEBUG isakmp::ikev1::service: End sending OM request
2026-03-03T20:01:43.315405Z DEBUG snxcore::tunnel::ipsec::connector: OM IP address: 10.0.116.197
2026-03-03T20:01:43.315408Z DEBUG snxcore::tunnel::ipsec::connector: OM IP netmask: 255.255.192.0
2026-03-03T20:01:43.315411Z DEBUG snxcore::tunnel::ipsec::connector: OM IP lifetime: 900 seconds
2026-03-03T20:01:43.315414Z DEBUG snxcore::tunnel::ipsec::connector: OM DNS servers: [10.226.0.5, 10.224.0.5]
2026-03-03T20:01:43.315416Z DEBUG snxcore::tunnel::ipsec::connector: OM search domains: ["~sub.sub.net", "~ sub.net"]
2026-03-03T20:01:43.315421Z DEBUG isakmp::ikev1::service: Begin ESP SA proposal
2026-03-03T20:01:43.335363Z DEBUG isakmp::ikev1::service: Negotiated transform id: EspAesCbc
2026-03-03T20:01:43.335440Z DEBUG isakmp::ikev1::service: Negotiated ESP auth algorithm: HmacSha256
2026-03-03T20:01:43.335448Z DEBUG isakmp::ikev1::service: Negotiated ESP key length: 32
2026-03-03T20:01:43.335618Z DEBUG isakmp::ikev1::service: End ESP SA proposal
2026-03-03T20:01:43.335660Z DEBUG snxcore::tunnel::ipsec::connector: ESP lifetime: 3600 seconds
2026-03-03T20:01:43.374535Z DEBUG snxcore::tunnel::ipsec::connector: Saved IKE session: pc.sub.net: 38703862-805c-441c-922e-ee45eaf2bb5e
2026-03-03T20:01:43.374718Z DEBUG snxcore::tunnel::ipsec::connector: New ESP SPI: 19c57d78, 43134fa0
2026-03-03T20:01:43.374760Z DEBUG snxcore::tunnel::ipsec::imp::tun: Rekey command received, new lifetime: 3600, reconfiguring ESP codec
2026-03-03T20:01:43.374801Z DEBUG snxcore::tunnel::ipsec::connector: Tunnel rekeyed
2026-03-03T20:11:53.018993Z DEBUG snxcore::tunnel::ipsec::connector: Start refreshing IPSec session
2026-03-03T20:11:53.019043Z DEBUG snxcore::tunnel::ipsec::connector: Using dummy MAC address: 7b3243444631
2026-03-03T20:11:53.019052Z DEBUG isakmp::ikev1::service: Begin sending OM request
2026-03-03T20:11:53.019218Z DEBUG isakmp::transport::tcpt: Connecting to endpoint_ip:443
2026-03-03T20:11:53.026846Z DEBUG isakmp::transport::tcpt: Connected, starting TCPT handshake
2026-03-03T20:11:53.045398Z DEBUG isakmp::ikev1::service: End sending OM request
2026-03-03T20:11:53.045437Z DEBUG snxcore::tunnel::ipsec::connector: OM IP address: 10.0.116.197
2026-03-03T20:11:53.045446Z DEBUG snxcore::tunnel::ipsec::connector: OM IP netmask: 255.255.192.0
2026-03-03T20:11:53.045452Z DEBUG snxcore::tunnel::ipsec::connector: OM IP lifetime: 900 seconds
2026-03-03T20:11:53.045461Z DEBUG snxcore::tunnel::ipsec::connector: OM DNS servers: [10.226.0.5, 10.224.0.5]
2026-03-03T20:11:53.045467Z DEBUG snxcore::tunnel::ipsec::connector: OM search domains: ["~sub.sub.net", "~ sub.net"]
2026-03-03T20:11:53.045476Z DEBUG isakmp::ikev1::service: Begin ESP SA proposal
2026-03-03T20:11:53.067448Z DEBUG isakmp::ikev1::service: Negotiated transform id: EspAesCbc
2026-03-03T20:11:53.067564Z DEBUG isakmp::ikev1::service: Negotiated ESP auth algorithm: HmacSha256
2026-03-03T20:11:53.067573Z DEBUG isakmp::ikev1::service: Negotiated ESP key length: 32
2026-03-03T20:11:53.067843Z DEBUG isakmp::ikev1::service: End ESP SA proposal
2026-03-03T20:11:53.067867Z DEBUG snxcore::tunnel::ipsec::connector: ESP lifetime: 3600 seconds
2026-03-03T20:11:53.095085Z DEBUG snxcore::tunnel::ipsec::connector: Saved IKE session: pc.sub.net: 38703862-805c-441c-922e-ee45eaf2bb5e
2026-03-03T20:11:53.095275Z DEBUG snxcore::tunnel::ipsec::connector: New ESP SPI: 15b84a7b, 4f07a09f
2026-03-03T20:11:53.095322Z DEBUG snxcore::tunnel::ipsec::imp::tun: Rekey command received, new lifetime: 3600, reconfiguring ESP codec
2026-03-03T20:11:53.095388Z DEBUG snxcore::tunnel::ipsec::connector: Tunnel rekeyed
2026-03-03T20:22:03.018783Z DEBUG snxcore::tunnel::ipsec::connector: Start refreshing IPSec session
2026-03-03T20:22:03.018831Z DEBUG snxcore::tunnel::ipsec::connector: Using dummy MAC address: 7b3243444631
2026-03-03T20:22:03.018840Z DEBUG isakmp::ikev1::service: Begin sending OM request
2026-03-03T20:22:03.019005Z DEBUG isakmp::transport::tcpt: Connecting to endpoint_ip:443
2026-03-03T20:22:03.030976Z DEBUG isakmp::transport::tcpt: Connected, starting TCPT handshake
-- at this point (next morning) connection inactive (i can't access remote resources) So I disconnect to reconnect
2026-03-04T05:55:31.620849Z DEBUG snxcore::server: Disconnecting current session
^C -- at this point ui show message that service is unavailable (Cannot read reply from the service, or smth similar) so I have to restart it
2026-03-04T05:55:43.535092Z DEBUG snx_rs: Application terminated due to a signal
2026-03-04T05:55:43.575865Z DEBUG snxcore::tunnel::ipsec::imp::tun: Cleaning up IPSec (tcpt) tunnel

last messages in the log on 2026-03-03 tunnel was still active with reachable resources

[ancwrd1]

@cspwizard please try the recent version 5.2.1, it has a possible fix for the non-responsive service.

[cspwizard]

No luck, still get the error "Could not read reply from service"

[ancwrd1]

Should be fixed now in main branch. I was able to reproduce it and find a problem.

[ancwrd1]

Now part of 5.2.2 release.