Sophos Firewall: v19.0 GA: Feedback and experiences

Upgraded our XGS5500 Cluster this weekend to v19ga. Now we've got some serious problems with our IPSec Site to Site connections. Those connections are setup as tunnel connections with xfrm interfaces. We use BGP over those interfaces. The problem is that connectivity between our branch routers (XG125) and the main router for those tunnels is down every 30-50 minutes. VPN Tunnel is still up but the xfrm interfaces cant reach eachother. The only thing that is working is disableing the hole ipsec tunnel and reenabling it. Only then the xfrm interfaces can reach eachother for some time. I allready opened a support ticket but maybe some around here has had the same issue and a quick fix for me.

Have you checked the ipsec guide? DPD should only enabled on vpn initiator and phase 1 and phase 2 re-key shouldn't happen at same time. Maybe this is your problem?

Have you checked the ipsec guide? DPD should only enabled on vpn initiator and phase 1 and phase 2 re-key shouldn't happen at same time. Maybe this is your problem?

Yes DpD was turned on only on the initiating site. Fun fact support now told me it musst be turned on at both sites.... Meanwhile we had to role back to 18.5.3. I am currently installing and old xg450 and trying to reproduce the error.

Very interesting. My source is:

https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/122440/best-practice-for-site-to-site-policy-based-ipsec-vpn

yes that was my source too setting it up the first time. This configuration is running in 18.5.3 without any problems. Only on 19 the problems started.