Hi, i upgraded our XGS2100 from 19.5.2 to 19.5.3 We had a solid VPN Connection to a customer, after upgrading the Connection fails from time to time and VPN Log shows. 2023-08-28 10:11:14 IPSec Deny Received IKE message with invalid SPI (19CBD566…

Why can't you view your site-to-site settings when you have a failover group active. Whenever I'm working with a SOPHOS engineer on an issue, the first thing they want to do is view the VPN settings, but they can't without taking the VPN tunnel offline…

Hello Everyone, I am enabling IPsec remote access VPN on my firewall XG, the problem is that every time when the clients establish the VPN connection, my clients are getting an Apipa IP address as a gateway and the traffic toward those two IP (172.1…

Hello community. I'm pretty green with setting up VPN's so I have been studying like mad over the last few days every Sophos article and video I could find to try and do this myself but I have hit a brick wall. I need to connect a remote workstation to…

Hey All, , So i had something interesting that got fixed today. On the old XG V17-19 when you create a IPSEC VPN, you didnt need to add a no NAT rule (I could be mistaken if some one can confirm this) But on the XGS, I had setup all the VPNs…

im having the problem with ipsec to a client with cisco firewall. The firewall cannot connect to the remote site but the policies and the satting are the same. This is how my setup is Local Public ip : 154.120.225.2 Local ID : set as the Public ip…

Dear Community, my name is david lorenz and I have a problem at one of our customers. At first I will describe my network situation. They have a HQ and a BO. The HQ has the network: 192.168.2.0/24 (Sophos XG210 with 192.168.2.1) The BO has the…

I have configured an IPSec VPN site-to-site connection between two sites, and after that, the ping traffic was going through between the sites. However, about 10 minutes later, when I pinged again to check, there were always a few initial packets that…

I currently have multiple tunnels on a SFV4C6MSP running on a cloud VM. I use this router to connect multiple IPsec tunnels to different customers. These tunnels are setup as tunnel interfaces. and they will work fine for weeks, or months before one…

Hello, Every 24 hours after the pppoe connection is reconnected, traffic stops passing through the tunnel. My side is configured as a branch, has a dynamic ip address and initiates an ipsec connection. After the wan ip address is changed, the tunnel…

Hello, I have IPSec site to site tunnel and I need to troubleshoot why at some point tunnel goes down and or traffic stops flowing. What means this part of log. At the moment tunnel is up and traffic is flowing. Other side has Fortinet firewall, my…

We are setting up a Site to Site IPSEc VPN between two Sophos XGS 116s. - Is it better to use a pre-shared key or an RSA key? - In the firewall rules, should we put some IPS policy? - In the VPN profile, do we use the IKEv2 protocol? Thanks André…

Dear Sophos Team, can we setup site to site VPN in same subnet?

I am using Unraid NAS on a remote site without public IP. It has support for Wireguard server. I assume there is also a wireguard client. Can this remote NAS connect to my Sophos XG appliance so I can remotely access the remote Unraid NAS? Is this called…

Hi, Since a few days I see the same LOG entry on all XG Firewalls with active IPSEC VPN configuration. (I have checked more than 8 firewalls). The attempts come from the same IP 213.109.84.251 on all machines. Nslookup on this address returns the domain…

Anyone in the community has configured Sophos to Smoothwall site-to-site vpn? we have issues establishing the VPN connection between two sites The Details for Phase 1 and Phase 2 are all matching we created firewall rules on both ends the status…

Hello, I need help with tunnel configuration. For now I have working ipsec connection to remote 3rd party firewall and sd-wan route to route traffic coming from my network (172.19.19.0/24) to destination ip addresses through tunnel interface. The…

Hi All, I inherited a SITE to SITE configuration that I believe is misconfigured. I am in hopes that I can get help to understand the best way to do this. It doesn’t seem right. Maybe I’m just missing a Failover group on the first site.? 1st XG125…

I have created ipsec tunnel to enable branch office to access head office, tunnel on both offices are 'up' but xfrm gateways on both sides which i have used in sdwan routing are 'down'. but by using diagnostic tool i can ping both xfrm interfaces but…

Hi, we have an XG135 in the headoffice and an XG87 in the branch office. in the headoffice we have two servers ( mail and something else ) that need to be reachable from the outside and we used the Server Accesss Assistant to create the correpsonding…

hi, we have the problem that an IPSec connection between SG and XGS shows Terminated status several times a day and then the status changes directly back to established and the connection continues to work without problems. What settings or logs should…

Hello, We have the following scenario: Two Sophos XG310 with active-passive high availability enabled. Since we configure high availability from time to time, the site-to-site ipsec VPN service just stops working, 80% of our tunnels are disconnected…

hi all, we encountered some limitation with sophos fw, under SFOS 19.5 with IPSEC configuration. There is no possibility to set null encryption under ipsec phase 2 part. Is there a way to bypass this limitation ?

Hi, I'm trying to enable an IPSec Site-to-Site connection with a remote location but have a few problems on the route side Here's my config : Sophos XG - SFOS 19.5.2 MR-2-Build624 Sophos LAN on 172.16.16.x (set as LAN in Hosts and services)…

Hello Team! In my environment, I have groups created in Active Directory to control remote access via VPN on the firewall. Turns out this VPN group I created in AD, in the firewall's webadmin when looking up the user, is listed in the Other group…