Summary

On Windows endpoints running Versa Secure Access (VSA) client 7.10.3, the software update download to 7.10.4 can fail if the client connects to an IPsec full tunnel while the download is still in progress. The download stalls and then fails. The same update completes normally over DTLS, or when the download is started after the tunnel is already connected.

Applies To

• Versa Secure Access client for Windows, version 7.10.3
• Upgrade / auto-update from 7.10.3 to 7.10.4
• IPsec tunnel with full-tunnel routing

Symptoms

• The user clicks Download on the software update prompt while the client is still connecting.
• A few seconds later the client finishes connecting and the IPsec full tunnel comes up.
• The download stops making progress and fails after a timeout (roughly two minutes in observed cases).
• Retrying in the same sequence (download first, then the tunnel connects) fails the same way.

Conditions

The issue occurs only when all of the following are true:

1. The client is running 7.10.3.
2. The tunnel uses IPsec with full-tunnel routing.
3. The update download starts before the tunnel is connected, and the tunnel comes up while the download is still in progress.

The following update flows are not affected:

• Download starts and completes while the client is disconnected.
• Download starts and completes while the client is already connected.
• Download starts while connected and the client is then disconnected.
• Any flow using a DTLS tunnel.

Cause

In 7.10.3, full-tunnel routing for IPsec was handed to the Windows Remote Access Connection Manager (RasMan) stack. When the IPsec full tunnel comes up, all traffic is moved into the tunnel, including the update download connection that was already open over the local internet path. That in-progress connection is interrupted, and the download fails.

In 7.10.4, this behavior was removed. Full-tunnel routing for IPsec is now handled by the Versa Secure Access client itself, and an in-progress download is no longer interrupted when the tunnel connects.

Resolution

This issue is resolved in Versa Secure Access client 7.10.4. Because the problem occurs on 7.10.3 during the download itself, use one of the workarounds below to complete the upgrade to 7.10.4. Once endpoints are on 7.10.4, later updates are not affected.

Workarounds (7.10.3 only)

Option 1: Start the download after the tunnel is connected (recommended)

1. If the update prompt appears while the client is still connecting, do not click Download yet.
2. Wait until the client shows Connected.
3. Start (or retry) the software update download. It completes without interruption.

Alternatively, let the download complete fully while the client is disconnected, then connect.

Option 2: Use DTLS instead of IPsec

As a temporary measure, connect over DTLS instead of IPsec until endpoints are upgraded to 7.10.4. DTLS connections are not affected by this issue.

Additional Information

If the download still fails after following the workarounds above, contact Versa Networks Technical Support and provide the VSA client logs from the affected endpoint.