IPSec Site to Site VPN Disconnection

Hi Jason G 

You may refer to the following KB for troubleshooting

• Sophos Firewall: Troubleshooting site-to-site IPsec VPN issues and https://www.draytek.com/support/knowledge-base/5201 
• Check with local-id and remote-id if not added to the IPSec VPN Policy and check it is same on both the devices 
• Make sure you are working on the latest firmware version of Sophos as well as DrayTek router.
• Change Sophos XG (Initiator ) & a DrayTek (Responder) router might help

Thanks and Regards

Hi Bharat,

I have already looked at those 2 links you provided. It does not address the issue I'm experiencing, and the local-id and remote-id are the same at both ends.

To clarify the issue, the current configuration works between an XG and an XG, there's no disconnections. With the DrayTek however, the connection is terminated after X amount of time, then re-establishes itself after X amount of time. This appears to occur throughout the day.

I still believe this is caused by re-keying. But I've followed the recommendations as stated below.

3. Phase 1 and phase 2 re-key shouldn't happen at same time

On any VPN gateway, phase 1 SA (a.k.a IKE SA) and phase 2 SA (a.k.a IPsec / CHILD SA) should not be re-keyed at the same time, otherwise, the VPN will be disconnected on every phase 1 re-key.

Phase 1 and phase 2 will be re-keyed at the same time, if phase 1 key life can be divisible by phase 2 key life, for example, phase 1 key life is 43200 seconds, and phase 2 key life is 3600 seconds. (43200 / 3600 = 12).

No need to worry about it on the Sophos Firewall, as the Sophos Firewall provides the option of "Re-key margin", and the default setting of phase 1 keylife is fine.

Jason G  Please provide the complete configs used on SFOS side on IPsec page and on the ipsec profile, also on the DrayTek side configs. Also provide the /log/charon.log of SFOS; we need to understand who is disconencting the tunnel first. In case, if the disconnect is happening from Dreytek, why it happens etc.. 17802 message id just says the tunnel is disconnected that could happen either the connection is terminated by the Initiator or by the responder.