IPsec Connection down

malachite said:

The main office has a public static IP while the branch offices have no public IP.

In this case, you have to use DDNS services where there is no static or public IP.

Thanks and Regards

In remote office Firewall logs I see

"parsing IKE message from xxxx.xxxx.xxxx.xxxx[500] failed"

Yes, seems Port 500 is blocked or not allowed from the remote end ISP router configuration

Regards

Thank you  for response, I'm going to allow port UDP500 and UDP4500 for remote offices; but I don't understand why no problem with zyxel at head office.

Is it for tunnel between Sophos xgs116 (SFOS 19.0.1 MR-1-Build365)  and Sophos XG85 (SFOS 17.5.17 MR-17-Build837) ?or with Sophos xgs116 (SFOS 19.0.1 MR-1-Build365) and  2 Fritzbox.?

Issue might be with Default policy 

Regards

Hello, just an update. I checked all my configuration and find only 2 router with UDP port blocked. At this time my vpn are up with IKEv2 profiles. Resolved at this moment the fritzbox problem but randomly the vpn goes down.

Now I'm searching to set IPSEC with RSA as in https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/122440/best-practice-for-site-to-site-policy-based-ipsec-vpn but the XG85 don'activate the connection

malachite said:

Now I'm searching to set IPSEC with RSA as in https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/122440/best-practice-for-site-to-site-policy-based-ipsec-vpn but the XG85 don'activate the connection

Try this link: https://support.sophos.com/support/s/article/KB-000035717?language=en_US 

The error is "All the connections shared between end points must have the same authentication methods and credentials"

Please show us screenshots of your tunnel definitions in HQ and branch office. You could obfuscate parts of the IPs for security reasons.

I show you the VPN configuration between the main office (HO_1) and one of the secondary offices (BO_1). The configuration is the same for the other secondary offices where the Sophos XG85 is located.
At this moment the vpn connection is established correctly but I encounter two problems:
1) if the VPN falls it does not go up; I am forced to change the Preshared key to manually re-establish the Tunnel
2) if I change the authentication method from Preshared key to RSA key
on the secondary office device I cannot activate the connection and I receive the error previously reported ("All the connections shared between end points must have the same authentication methods and credentials")