This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-Site VPN Problem Invalid SPI

Hi,

We are using Sophos Firewall XG310 , SFOS v20. It's been 4 month we have established Site-to-Site VPN, and today suddenly our connection is Down with many "Received IKE message with invalid SPI (D3EED417) from the remote gateway" log messages as shown below.

We didn't have any configuration change before.

Here's our configuration (Sophos)

Remote Site configuration ( VM Ware NSX)

Any suggestion ?

This thread was automatically locked due to age.

Top Replies

Sreenivasulu Naidu 8 months ago +2 verified

Hi Trio Fandi , In your configs, both IPsec gateways (SFOS and NSX) are set with same Phase1 and Phase2 rekey timers; it is recommended to use lower values of Phase1 and Phase2 rekey timers on Initiator…

Parents

+1 Sreenivasulu Naidu 8 months ago

Hi Trio Fandi,In your configs, both IPsec gateways (SFOS and NSX) are set with same Phase1 and Phase2 rekey timers; it is recommended to use lower values of Phase1 and Phase2 rekey timers on Initiator IPsec gateway; if your SFOS is Initiator, adjust P1/P2 timers to less than the P1/P2 values used on far end gw (responder) or vice-versa.
Cancel
Vote Up +2 Vote Down

Cancel
0 Trio Fandi 8 months ago in reply to Sreenivasulu Naidu

Hi Sreenivasulu Naidu

Initiator are NSX side. So, should we set higher in SFOS ?

Note : I don't have privileged to adjust NSX side
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Trio Fandi 8 months ago in reply to Sreenivasulu Naidu

Hi Sreenivasulu Naidu

Initiator are NSX side. So, should we set higher in SFOS ?

Note : I don't have privileged to adjust NSX side
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Sreenivasulu Naidu 8 months ago in reply to Trio Fandi

Yes please. Higher values for both P1 and P2 to be used on SFOS side (Responder).
Cancel
Vote Up 0 Vote Down

Cancel
0 Trio Fandi 8 months ago in reply to Sreenivasulu Naidu

I've tried to set policy as you suggest :

1. Adjust P1/P2 timer

2. Change to IKEv2

Result is connection status now Established, but in NSX site still Down. So, I ask NSX team to further check it.

Thanks
Cancel
Vote Up 0 Vote Down

Cancel