IKE message with invalid SPI

Hi Can carmack 

Please verify the IPsec policy configuration Security Parameter Index SPI is a part of IPsec SA.

Please refer to the article - https://community.sophos.com/kb/en-us/123600

Hi

Thank you for response.

Followed the guide but couldn't find any information about  SPI.
There is no IKE setting on Cyberoam side. maybe v1 default supported except v2.

Hi Can carmack 

Cyberoam Support IKE v1 and SPI are the configurations for Phase -1 and Phase -2 configuration of the IPsec policy.

I would request you to verify the Phase -1 and Phase -2 parameters in XG and Cyberoam firewall configuration, you may share the configuration screenshot for IPsec and IPsec policy.

2 site to site VPN connections are active;

• 1st one;

SideA

SideB

2 site to site VPN connections are active;

• 2nd one;

SideA

SideB

Hi Can carmack 

How many IPsec VPN tunnel configured in the Cyberoam and XG?

Are they connected to different remote WAN IP or the same WAN IP?

Policy configuration seems to be correct, I would recommend you to contact technical support and open a service request.

Hi Keyur

2 vpn connections, 4 different WAN IPs.

This small issue occured after firmware update on XG side.

Contacted support, no solution yet.

Waiting Senior support.

Hi Can carmack 

Thank you for your reply. Could you please PM us the service request number to check the history of the case?

Hi Can carmack 

Thank you for your reply. Could you please PM us the service request number to check the history of the case?

Hi Keyur 

I see new firmware update for Sophos XG.
Do you recommend?

Any update on the case?

Hi Can carmack 

You may upgrade the firmware version.

For the provided case ID in the DM, the support engineer has resolved the issue and share the required details over the email and close the case with your agreement.

Please let us know if you require any further assistance on the reported query/case