Disconnect after 30600 Seconds, but cannot find this value

Hello Sreenivasulu, 

I cannot find these two lines in the charon.log.

I understand that these 30600 seconds are calculated? right?

Hi Gerald Werner ,The .scx file Phase-1 key lifetime is calculated as 0.85 times the SFOS Phase-1 key lifetime value. This ensures that the Sophos Connect Client always initiates/handles the rekeying process, preventing any rekey collisions (which may cause traffic drops). 

Are  you using MFA with SCC?  The tunnel may go down during the Phase-1 rekeying when the OTP request is made.  
https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RemoteAccessVPN/RAVPNTroubleshooting/index.html#:~:text=MFA%20causes%20remote%20access%20IPsec,implemented%20as%20approximately%20four%20hours.

Regards,
Vamshi

Hi Gerald Werner ,The .scx file Phase-1 key lifetime is calculated as 0.85 times the SFOS Phase-1 key lifetime value. This ensures that the Sophos Connect Client always initiates/handles the rekeying process, preventing any rekey collisions (which may cause traffic drops). 

Are  you using MFA with SCC?  The tunnel may go down during the Phase-1 rekeying when the OTP request is made.  
https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RemoteAccessVPN/RAVPNTroubleshooting/index.html#:~:text=MFA%20causes%20remote%20access%20IPsec,implemented%20as%20approximately%20four%20hours.

Regards,
Vamshi

Adding to what Vamshi has stated above, this 0.85 indicates that the client is enforced to initiate rekey 15% earlier than the firewall's rekey time.

Okay, these are interresting facts. Thank you very much for all your help!