This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Rock Solid Site2Site crashed after upgrading from 18.5.3 to 19.5 GA on Both Sides

Hi,

I had a S2S VPN between a XGS2100 (18.5.3) and XG125 (19.0.1)

After upgrading both Sites for 19.5 GA the VPN connection crashes 2-3 times a week.
The VPN is up and connected, but no traffic is routed from S2S, only a manual disconnect and reconnect will fix this.

Where do i start to fix a random S2S VPN error / routing error / etc... ?

Can i switch strongswan into debug mode for a week and wait for the next bug?

Or is there any way to find this inside the normal logs?

Thanks

Jürgen

This thread was automatically locked due to age.

Top Replies

LuCar Toni over 1 year ago in reply to JuergenB +1

V19.5 can potentially cause problems with the engine. If you want to investigate this issue further, you can create a support case and DEV can take a look at your setup to find a matching bug id. If you…

0 JuergenB over 1 year ago in reply to LuCar Toni

No, there is no change in the profile during the update process.

I only see new IKEv2 Profiles, i think they are new and maybe they are more stable in 19.5 than the old default profiles.
I might swap the profile for my VPN Tunnel HO-BO and use IKEv2
Cancel
Vote Up 0 Vote Down

Cancel
0 Alok over 1 year ago in reply to JuergenB

Hi Juergen,

We had default HO/BO profile for IKEv1 so far and only one IKEv2 profile.

The customer uses same (IKEv2) profile for HO and BO both locations, which leads to re-key collision in some cases and hence we have introduced a new default IKEv2 profile for HO and BO with similar fine tuning of re-key timer/DPD action etc.

If you are running IKEv1 based HO/BO profile its fine, recommendation is to switch to new IKEv2 HO/BO policy if you are currently using Default IKEv2 policy on both end.

Hope this helps.

-Alok
Cancel
Vote Up 0 Vote Down

Cancel
0 JuergenB over 1 year ago in reply to Alok

I used default IKEv1 on both sides and it was stable until 19.5

So i will switch to IKEv2 and see.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alok over 1 year ago in reply to JuergenB

Thanks for reply, there is no issue if you keep using IKEv1policy in v19.5.

We may need to get this investigated, if you have already opened support case let me know the case ID.
Cancel
Vote Up 0 Vote Down

Cancel
0 bobbylam over 1 year ago in reply to Alok

Hi JuergenB,

If you can open support access to both your devices and PM me the access IDs, I can get this investigated by our engineering team.
Cancel
Vote Up 0 Vote Down

Cancel
0 apijnappels over 1 year ago in reply to Alok

Sorry for hijacking this thread a bit, but since my firewalls don't have the 19.5 yet could someone just share screenshots of the HO/BO IKEv2 policies?

Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vivek Jagad over 1 year ago in reply to apijnappels

Hey apijnappels ,

Here is the screenshot and also check the TIP on the bottom right for DPD settings:

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Log a Support Case | Sophos Service Guide
Best Practices – Support Case

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel
0 JuergenB over 1 year ago in reply to Vivek Jagad

I changed the S2S to IKEv2 using the default HO/BO Value.

cost me a few nerves, because the firewall was down for a few minutes.
Cancel
Vote Up 0 Vote Down

Cancel