IPSec Site to Site VPN Disconnection

Jason G  Please provide the complete configs used on SFOS side on IPsec page and on the ipsec profile, also on the DrayTek side configs. Also provide the /log/charon.log of SFOS; we need to understand who is disconencting the tunnel first. In case, if the disconnect is happening from Dreytek, why it happens etc.. 17802 message id just says the tunnel is disconnected that could happen either the connection is terminated by the Initiator or by the responder.

Please select None under PFS group (DH group) instead of “same as phase -I” on Phase 2 policy 

Please select None under PFS group (DH group) instead of “same as phase -I” on Phase 2 policy 

Nope. It's insecure...

Instead, I have reconfigured Sophos's key life to be higher than the DrayTek's key life. Will report back tomorrow.

I'm still getting the same termination issue. I have changed the DH group from 14 to 5 and Phase 2 Authenticate to SHA1 to test. Will report back tomorrow.

Please enable "Re-key connection" on IPSecVPN Policy 

Regards

Re-key connection on Respnder node is generally not recommended to ensure only Initiator does the rekey.

Jason G , I would like to see the logs on Dreytek and SFOS when the issue happens. The configs you posted on Dreytek and SFOS looks good to me; also, you mentioned Phase1 and Phase2 key values are higher than the values used on Dreytek - this is recommeded.

Also, the local n/w on Dreytek is 192.168.5.254/24 - although it does not create any issue, shouldn't this be 192.168.5.0/24 ?

Hi Sreenivasulu Naidu ,

I do not have the time to go through the logs and redact any sensitive information. I will have to contact Sophos support for this one.

Was hoping/praying for an easy answer by posting it on here.

Appreciate your time and effort.

Kind Regards,

unfortunately, we can't say anyting on this from the configs alone unless we get to see the logs of SFOS (/log/charon.log) at the minimum and the logs on Dratek side, this is needed even for the support to understand the issue.