Since 9.409-8 and 9 IPSEC/Cisco VPN not working

Hi,

there are two different ways the SHA2 hashes are truncated for L2TP / IPSec RemoteAccess VPN by various manufacturers. One way is the official RFC defined way to handle SHA2 and the other one is the GOOGLE way. In the GOOGLE way a truncation after 96 bits is happening.

If you have connections problems with a mobile device, Check the knowledge base article https://community.sophos.com/kb/en-us/125796 to get further information. Other customers have been able to solve their problem by adapting the policy ("SHA2 256" or "SHA 256 96bit" or by using the command line option.

We are working on a solution to support both ways at the same.

Greetings

Holger

Hi,

just found out that the knowledge base article is not complete - I will organize an update of the KBA.

Please try the following commandline and report if this solves your problem.

        cc change_object REF_IPsecPolicyCisco ipsec_auth_alg sha2_256_96

Thank you in advance

Regards,
Holger

Hello Holger,

The command fixed the problem for us.

Thank you
Juan Gaviria

Also helped here, thanks for that Holger :-)

Also helped here, thanks for that Holger :-)

Welcome,

a fix of the problem will be delivered with UTM 9.410. But I am glad to hear that this tweak solved your problem already.

Greetings

Holger