Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 10 replies
  • Subscribers 40 subscribers
  • Views 3984 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPsec tunnel go down after some hours

Daniel Zulian

Hi, we have a Sophos XG210, SFOS 19. We set a site-to-site VPN tunnel to SAP with the parameters they gave us. 

Locally, we have the network 10.X.X.X and 192.168.X.X (we are migrating to all class A), and SAP 10.100.0.0/22 & 10.100.4.0/27. 

The tunnel works OK. We have connection between local hosts and remote servers in the SAP cloud. But, after some hours the tunnel goes down (I don´t know if it is important, but we are implementing SAP, there is only test traffic, not working officialy with SAP). 

The status apears ACTIVE (green) but CONNECTION in YELLOW. If I restart the connection, the tunnel goes up and works OK.

 If click in the information appears near "connection" item, I see that: 

The problem is only with network class A. In the log console appers this message: 

I don´t know if the problem is in SAP side, or maybe I need to configure a more specific network in my site (no /8)



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Bharat J

    Hi, sorry for the delay. This is the status of the firmware

    I got a meeting with an Azure technician. He saw the Sophos configuration and didn´t find problems. But, apparently, Azure side receives "integrity=SHA256" (that´s good) and other times Sophos sends it as "unknown". And Azure don´t accept it, and finish the negotiation. 

    Other problem Technician found, is Sophos is not accepting the Azure's reply of SHA256.

    I let you the Azure's logs

  • 0 in reply to Daniel Zulian

    Hi Daniel Zulian 

    We have to check with IPSec VPN Policy and later overlapping subnets 

    Please share the logs from Sophos XG with SSH and make sure you hide the Public IP.

    Login to SSH of Sophos XG firewall go to option 5>3 share the output 

    #cish 

    console>show vpn IPSec-logs

    console>exit

    #tail -f /log/strongswan.log

    On the other end, I found Cisco ISR 2511 end of life.

    Regards

    "Sophos Partner: Networkkings Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Daniel Zulian

    Daniel Zulian , I see that phase1 and phase2 rekey timers are set to same value (3600 seconds) on Cisco ISR; please set phase1 value hither than phase2 ( by an hour or more) and reinitiate the tunnel from ISR side; I assume ISR is set as Initiator of the tunnel; please monitor if the reported issue occurs; 

  • 0 in reply to Sreenivasulu Naidu

    Hi , as Azure's technician has recommended, I set the timers  phase1 = 28800 and phase2 = 27000. (the snapshots are before this change). But the problem still persists. 

    Thanks , I try to get the credentials to SSH console and get the log. 

Unfiltered HTML