Site to Site VPN Authentication on reboots - Change PSK works

Question

I have multiple Sophos site to site VPN's back to a central router. Whenever any of the sites losing connection they all re-connect except for 1. The Sophos VPN logs show "Couldn't authenticate the local gateway. Check the authentication settings on both devices." 
 Every time this happens the only way to get the tunnel back is to change the PSK on both sides. 
 The PSK is never changing on either side. 
 What would cause me to need to re-create the PSK after it restarts?

Sreenivasulu Naidu · Accepted Answer

Brennan Kostyniuk , Prior to v20 on SFOS, all IPsec (S2S - PBVPN and RBVPN and Remote Access) tunnels that has common local and remote gateways ( "*" in the "remote gateway" field) should have same PSK. Changing PSK on any one of the connections or when new tunnel configured with existing common local and remote gateways (PortX, *) with a different PSK will overwrite the PSK of all the existing tunnels. 
 If your SFOS is on v20 or above and IPsec tunnel uses IKEv2, to overcome such limitation, you can use IDs filed (Local ID/ Remote ID) in IPsec config. This helps having different PSKs for different tunnels when remote gateway=* . Please try this and let us know if authentication issue resolves.

Site to Site VPN Authentication on reboots - Change PSK works

Top Replies