Multiple IPSEC Tunnels with Combination of RSA and Preshared Keys.

You can move to V20.0 and use different PSKs per Tunnel while using Identifier. 

Hi.. many of our sites are using utm9(Branches) that are using initiating and our HQ(SFOS19) as respond with * since major of the sites are dynamic wanip. 
I've checked ipsec best practices by sophos.
Seems to suggest using rsa and configuring with ip type as dns to prevent config identity confusion with all these sites.

You can do both. SFOSv20.0 offers the option via PSK. 

In the End, i am the fan of RSA Keys anyway but it is also a good choice to work with Identifier in IPsec anyway. 

On SFOS i was able to do that selection but on UTM , there's no option to select DNS.
What i ended up doing is selecting hostname as an option instead. By default, it's on IPV4 address. if i tried to input anything other than ipv4, it would get the error msg.


I tried using email and hostname. nothing works. Tunnel just wouldn't go up.

So: Did you upgrade to V20.0 on SFOS? 

Otherwise this will not work. 

The identifier can be anything. Take Email Address and give each UTM something like "UTM1@domain.com" etc. Just to differentiate it later. Or give them Location names. 

What you need to do next (one time) is to setup the PSK one more time so SFOS can save it. 

I have yet to upgrade to V20. Given that i actually had 30 tunnels to be precise. Any issue , i won't be able to up those tunnels.
However, our private cloud has a managed fortigate that backhauls all of our branches . Fortigate ipsec seems to work so flawlessly without ipsec trouble. And how frustrating to know that sophos xg and utm9 couldn't even work properly despite being the same product.

So let me rephrase what happens: 
If you use a Wildcard on SFOS, SFOS can only have 1 PSK for all Wildcard Tunnels in V19.5 and below. 
But what you can do: You can override the tunnel all the time. 
Meaning: 

Tunnel 1 
Tunnel 2

You have PSK1 for Tunnel 1 and PSK2 for Tunnel2. 

If you select PSK1 for Tunnel1, it will build up the tunnel fine. PSK is only used for Phase 1 IPsec. Then in Phase 2 no PSK is needed and the tunnel is stable. What you are doing: You set PSK2 for Tunnel2 and bring Tunnel2 up. But SFOS will override PSK2 to Tunnel1. Which does not affect the active tunnel but on a reboot the tunnel1 will not come up, as the PSK2 is expected for all tunnels but UTM1 in Tunnel1 used PSK1.

In V20.0 you can use the identifier to tell SFOS which UTM needs which PSK. to do that, you setup the identifier and select the PSK one more time and the tunnels should come up. 

just a question, if identifier works . wouldn't it be able to solve the issue back in v19 with only 1 psk ?
Since every tunnel will have it's own unique identifier so that even it responds to multiple initiators that are *.
If it doesn't, how would it solve the issue that v19 wasn't able to.

If all tunnels use the same PSK, it should work in V19.0.

So if you change all UTMs to the same PSK, it will work. 

They are all on same PSK like i mentioned earlier. v19 is already not working. i don't see v20 going to solve the issue.

Try to update the PSK on both peers everywhere again. Likely it is not correct. Because this is likely the problem here. Or do you use Ipsec Remote access as well? This will also override the PSK. 

The psk are all the same. I've tried updating it. I believe is the responder is just confuse handling multiple initators with the same encryptions and psk. Despite having different subnets.

The psk are all the same. I've tried updating it. I believe is the responder is just confuse handling multiple initators with the same encryptions and psk. Despite having different subnets.