Hello Sophos Community,
I had some issues last night with one of my IPsec tunnel created on my Sophos USG450. the issues is like this, during one upgrade from one of the support department the connection suddenly stooped. When i checked the logs i see that the tunnel restarted but from the 6 SA i had configured in the tunnel only 5 went up and the 6 (it was the SA that upgrade was involved) was not going up. I attached a printscreen with what i found in the logs.
Can somebody explain or point some cases why this has appeared?
"S_REF_Sitxxxx_5" #1136960: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP to replace #1135012 {using isakmp#1135008}
"S_REF_Sitxxxx_4" #1136961: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP to replace #1135013 {using isakmp#1135008}
"S_REF_Sitxxxx_3" #1136962: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP to replace #1135014 {using isakmp#1135008}
"S_REF_Sitxxxx_2" #1136963: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP to replace #1135015 {using isakmp#1135008}
"S_REF_Sitxxxx_1" #1136964: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP to replace #1135016 {using isakmp#1135008}
"S_REF_Sitxxxx_5" #1136960: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
"S_REF_Sitxxxx_5" #1136960: sent QI2, IPsec SA established {ESP=>0xcf1df1ae <0x85f57516 DPD}
"S_REF_Sitxxxx_4" #1136961: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
"S_REF_Sitxxxx_4" #1136961: sent QI2, IPsec SA established {ESP=>0x4534f1f6 <0xc19e3d4d DPD}
"S_REF_Sitxxxx_3" #1136962: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
"S_REF_Sitxxxx_3" #1136962: sent QI2, IPsec SA established {ESP=>0xdba9c8fe <0x059ba55a DPD}
"S_REF_Sitxxxx_2" #1136963: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
"S_REF_Sitxxxx_2" #1136963: sent QI2, IPsec SA established {ESP=>0xba0a06a5 <0xbd6fc0da DPD}
"S_REF_Sitxxxx_1" #1136964: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
"S_REF_Sitxxxx_1" #1136964: sent QI2, IPsec SA established {ESP=>0xbb1d1f85 <0xc6f27693 DPD}
Also after 1 hour i received again a call that they loosed again the connection but when i checked again the tunnel, all 6 SA where up( Tunnel was up) but ping to the customer network was not working. I must reset the tunnel again for the connection to work. I checked the logs and didn't see any logs that the tunnel had some issues or something.
Thank you!
This thread was automatically locked due to age.