Hi, we have a Sophos XG210, SFOS 19. We set a site-to-site VPN tunnel to SAP with the parameters they gave us.
Locally, we have the network 10.X.X.X and 192.168.X.X (we are migrating to all class A), and SAP 10.100.0.0/22 & 10.100.4.0/27.
The tunnel works OK. We have connection between local hosts and remote servers in the SAP cloud. But, after some hours the tunnel goes down (I don´t know if it is important, but we are implementing SAP, there is only test traffic, not working officialy with SAP).
The status apears ACTIVE (green) but CONNECTION in YELLOW. If I restart the connection, the tunnel goes up and works OK.
If click in the information appears near "connection" item, I see that:
The problem is only with network class A. In the log console appers this message:
I don´t know if the problem is in SAP side, or maybe I need to configure a more specific network in my site (no /8)
Daniel Zulian said: the tunnel goes up and works OK.
Hi Daniel Zulian
Try to delete the tunnel and re-create the tunnel and check tunnel works properly. Please Go to System-->Admininstration --->Backup and Firmware -->Firmware and share the status of the firmware shown on GUI?
I would suggest you go through the latest firmware version release notes available :
Thanks and Regards
"Sophos Partner: Infrassist Technologies Pvt Ltd".
If a post solves your question please use the 'Verify Answer' button.
Hi, sorry for the delay. This is the status of the firmware
I got a meeting with an Azure technician. He saw the Sophos configuration and didn´t find problems. But, apparently, Azure side receives "integrity=SHA256" (that´s good) and other times Sophos sends it as "unknown". And Azure don´t accept it, and finish the negotiation.
Other problem Technician found, is Sophos is not accepting the Azure's reply of SHA256.
I let you the Azure's logs
Hi Daniel Zulian
We have to check with IPSec VPN Policy and later overlapping subnets
Please share the logs from Sophos XG with SSH and make sure you hide the Public IP.
Login to SSH of Sophos XG firewall go to option 5>3 share the output
console>show vpn IPSec-logs
#tail -f /log/strongswan.log
On the other end, I found Cisco ISR 2511 end of life.
Daniel Zulian , I see that phase1 and phase2 rekey timers are set to same value (3600 seconds) on Cisco ISR; please set phase1 value hither than phase2 ( by an hour or more) and reinitiate the tunnel from ISR side; I assume ISR is set as Initiator of the tunnel; please monitor if the reported issue occurs;
Hi Sreenivasulu Naidu, as Azure's technician has recommended, I set the timers phase1 = 28800 and phase2 = 27000. (the snapshots are before this change). But the problem still persists.
Thanks Bharat J, I try to get the credentials to SSH console and get the log.