XFRM showing 'not configured' after public IP changes on spoke

Question

Hello, 
 
 we are currently using Sophos Firewalls in a Hub-and-Spoke topology running SFOS 20.0. Some spokes are using WAN connections with dynamic IPs which will change from time to time. 
 On those units we can observe that the corresponding XFRM interface on the hub won't come up from time to time after the spoke changes its IP-address. DPD seems to be working just fine and the tunnel itself will reconnect after the ISP assigned the new IP to the spoke. However the XFRM will not come back to the 'Connected' state. To resolve this issue, we have to manually disable and re-enable the tunnel. 
 This is catastrophic since the spokes are using the hub as exit node in this topology. 
 The issue seems to be documented here already: 
 XFRM issue after provider IP-change 
 
 Are there any known fixes or workarounds for this issue? Would upgrading to 20 MR1 resolve the issue?

Mayur Makvana · Answer

Hi GJN , 
 Kindly create the support ticket to investigate on this. If your device is impacted with the NC-138822. We may provide work around or prefix after discussion with the concerned team. Kindly share with us the ticket number.

Raphael Alganes · Answer

Hello GJN , 
 Regret to hear about the issue you're encountering. 
 Likely, you're affected by issue NC-138822 - upgrading to MR1 would not fix the issue at the moment. 
 Recommend you open a support case for this to be further investigated. https://support.sophos.com/support/s/?language=en_US#t=AllTab&sort=relevancy 
 Kindly let us know of the caseID once you have it. We shall also track the progress of your case. 
 Many thanks for your time and patience and thank you for choosing Sophos. 
 Regards,

XFRM showing 'not configured' after public IP changes on spoke

Top Replies