Disconnect after 30600 Seconds, but cannot find this value

Question

We use Remote acces VPN with our XGS2100 (SFOS 20.0.2 MR-2-Build378) and Sophos Connect client. 
 All VPN Connections disconnect after 30600 seconds oder 8,5 hours. 
 In the Profile we do not have any lifetime or margin set to this value. 
 Phase 1 Key life is 36000, Re-key margin is 360 
 Phase 2 key life is 3600 
 Dead oear detection is on 60 secons, wait for response up to 240 seconds. 
 Idle session tume is on 14400 secons. 
 So there is no single entry set to 30600. 
 If we do "export connection" and view the .scx file there is an entry: "rekey_time" : 30600, 
 and this is probably the problem. 
 Where does this come from?

vamshi d · Answer

Hi Gerald Werner ,The .scx file Phase-1 key lifetime is calculated as 0.85 times the SFOS Phase-1 key lifetime value. This ensures that the Sophos Connect Client always initiates/handles the rekeying process, preventing any rekey collisions (which may cause traffic drops). Are you using MFA with SCC? The tunnel may go down during the Phase-1 rekeying when the OTP request is made. https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RemoteAccessVPN/RAVPNTroubleshooting/index.html#:~:text=MFA%20causes%20remote%20access%20IPsec,implemented%20as%20approximately%20four%20hours . 
 Regards, Vamshi

Srisakthi S · Answer

Adding to what Vamshi has stated above, this 0.85 indicates that the client is enforced to initiate rekey 15% earlier than the firewall's rekey time.

Disconnect after 30600 Seconds, but cannot find this value

Top Replies