IPSec VPN status - what it means really?

Question

Hi, 
 Sometimes customer calls me, like please, check VPN site-to-site status, looks like it is down. I login to either XGS-136 directly or Sophos Central, check the status and it shows both LEDs green. Also clicking on INFO shows up and running. 
 But there are cases, when VPN is down, also cases, when whole remote site is down for whole day, but Sophos on central side still showing all green. What is this connection status green light there for? If it is not a bug, then...what am I missing?

FFin · Answer

You could check the VPN Logs for details - usually the appliance haven&rsquo;t noticed the other site being down. Might depend on your key lifetime and dead peer detection settings. 
 I&rsquo;ve seen a few times connection being green on both ends but no traffic is passing - that&rsquo;s for sure a bug.

LuCar Toni · Answer

The Name : Is this matching to your "green" Ipsec connection? This is a matching SPI: SPI means, it is "network to network" SA. If you click on the "!" next to the green connection dot, you see the same SPIs. 
 They are "established", which means, the firewall holds them as active and uses them : Hence we are using it as "green". 
 You are saying, this peer is offline? Could the Key Lifetime of this VPN Profile very high, so the rekeying is not applied often?

IPSec VPN status - what it means really?

Top Replies