IPsec tunnel go down after some hours

Daniel Zulian said:

the tunnel goes up and works OK.

Hi Daniel Zulian

Try to delete the tunnel and re-create the tunnel and check tunnel works properly. Please Go to System-->Admininstration --->Backup and Firmware -->Firmware and share the status of the firmware shown on GUI?

I would suggest you go through the latest firmware version release notes available : 

docs.sophos.com/.../index.html

https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-firewall-v19-mr1-re_2d00_release-build-365-is-now-available

Thanks and Regards

Hi, sorry for the delay. This is the status of the firmware

I got a meeting with an Azure technician. He saw the Sophos configuration and didn´t find problems. But, apparently, Azure side receives "integrity=SHA256" (that´s good) and other times Sophos sends it as "unknown". And Azure don´t accept it, and finish the negotiation. 

Other problem Technician found, is Sophos is not accepting the Azure's reply of SHA256.

I let you the Azure's logs

Hi, sorry for the delay. This is the status of the firmware

I got a meeting with an Azure technician. He saw the Sophos configuration and didn´t find problems. But, apparently, Azure side receives "integrity=SHA256" (that´s good) and other times Sophos sends it as "unknown". And Azure don´t accept it, and finish the negotiation. 

Other problem Technician found, is Sophos is not accepting the Azure's reply of SHA256.

I let you the Azure's logs

Hi Daniel Zulian 

We have to check with IPSec VPN Policy and later overlapping subnets 

Please share the logs from Sophos XG with SSH and make sure you hide the Public IP.

Login to SSH of Sophos XG firewall go to option 5>3 share the output 

#cish 

console>show vpn IPSec-logs

console>exit

#tail -f /log/strongswan.log

On the other end, I found Cisco ISR 2511 end of life.

Regards

Daniel Zulian , I see that phase1 and phase2 rekey timers are set to same value (3600 seconds) on Cisco ISR; please set phase1 value hither than phase2 ( by an hour or more) and reinitiate the tunnel from ISR side; I assume ISR is set as Initiator of the tunnel; please monitor if the reported issue occurs; 

Hi Sreenivasulu Naidu, as Azure's technician has recommended, I set the timers  phase1 = 28800 and phase2 = 27000. (the snapshots are before this change). But the problem still persists. 

Thanks Bharat J, I try to get the credentials to SSH console and get the log.