IPSec site-to-site Reauthentication

Question

How do I enable reauthentication for site-to-site IPSec connections ? 
 
 Sophos XGS3100, SFOS 19.5.3 MR-3-Build652

Bharat J · Answer

Hi osterhagen 
 Sophos Firewall only supports time-based rekeying. If you configured traffic-based rekeying on the third-party remote firewall, change it to time-based rekeying. 
 
 Set the initiator's phase 1 and phase 2 key life values lower than the responder's. 
 Set the phase 2 key life lower than the phase 1 value in both firewalls. 
 
 Example values are as follows:

Key life 
 Firewall 1 
 Firewall 2

Phase 1 
 12600 seconds 
 10800 seconds

Phase 2 
 5400 seconds 
 3600 seconds

Regards

IPSec site-to-site Reauthentication

Top Replies