XGS2100 (SFOS 20.0.2 MR-2-Build378) - Fritzbox 7490 VPN

Question

Hi, after updating to 20.0.2 the Site to Site VPN connection between our XGS (Host) and the Fritzbox is not working anymore. 
 Before the Update is was workking without any problems. 
 A downgrade to 20.0.0 is also impossible as the XGS always tells Firmware not valid. 
 Is there any Option to get that connection working again? 
 Best regards Martin

Vivek Jagad · Answer

Hi Martin Schneider , Thank you for reaching out to the community, please refer the useful KBAs/Docs below: - Sophos Firewall: IPsec troubleshooting and most common errors . - Log files for modules .

Mayur Makvana · Answer

Hello, 
 You may refer to the release note under: 
 https://docs.sophos.com/releasenotes/index.html 
 Below are the enhancement added to v20 MR 1. 
 
 The Sophos firewall holds two firmware. If you are currently on v20 MR 2, the backup firmware could be v20 MR 1 or v20 GA( You may review active and backup firmware on firmware tab). 
 I recommend collecting the strongswan debug logs while establishing the IPSec tunnel on non working firmware to get more clarity what's causing an issue with the tunnel establishment. 
 Login to the CLI and go to option number 5 and 3 (Advance shell). 
 #service strongswan:debug -ds nosync 
 #tail -f /log/strongswan.log (Try establishing the connection and keep this command running) 
 Once the logs are collected, you may refer below KBA to investigate or share it with us. 
 https://support.sophos.com/support/s/article/KBA-000006520?language=en_US 
 Use the below command to disable the debug after collecting the logs. 
 #service strongswan:debug -ds nosync 
 validate the service status using below: 
 #service -S