Disconnection Ipsec with fritz

Question

After update to my xg firewall to v20 ipsec is become unstable. Randomly disconnection. openvpn client work without issue only ipsec have problem 
 Some info: this setup worked for 2 year without a problem (another bug on v19 but fixed). Sophos firewall on main branch and 2 remote location both with fritzbox 7530 
 
 strongswan.log show ike timeout and successive reconnection. Both line, both random. 5min, 10min, 60min ther no a real pattern. 
 Already try increase key time as the Troubleshoot but no change. 
 the sophos side have 2 wan. Already try switch one vpn to the other wan. no remarkable change 
 remote can ping external ip of the main without losing packet.

Thanks for any help

Lorena Zandona · Accepted Answer

Disabling DPD seem to be a little better After a little debug seems now ipsec tunnel restart when IKEv1 expire (non sure if is normal or not... im not so expert on this)

vamshi d · Answer

Hi Eva Hintz , We Suspect issue could be due to the increased IKE message size with the strongswan upgrade in 20.0 MR1.

Can you pls check with the workaround proposed in the KB.

https://support.sophos.com/support/s/article/KBA-000009744?language=en_US .
"As a workaround, reduce the number of DH groups in the IPsec profile to a minimum of four (the default IKEv2 has six) or keep the exact DH group used on the far-end IPsec gateway."

Regards,
Vamshi

Disconnection Ipsec with fritz

Top Replies