This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPsec Site-to-Site VPN passes no traffic after updating to 9.406-3

Greetings, folks.

"Successfully" updated 1 x SG230 and 2 x SG115 to 9.406-3 this morning only to get reports that the site-to-site VPN was not working. Sure enough, no traffic is being passed across the IPsec VPN tunnels. The log files were showing errors suggestive of configuration mismatches, e.g, "max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal". I tore down and re-created the remote gateways and IPsec connections.

After redoing the VPN configurations, the tunnels show connected and Live Log shows no errors whatsoever. The connections get their usual 'refreshes', everything is green and active. Alas, absolutely 0 bytes of data go back and forth. Accessing server shares, DNS, AD, etc., is not happening.


The client is being very good about things so far, but I need to fix this and I simply have no idea of where to start. The configuration is correct, the firewall rules are in place to allow traffic on all services and yet 0 traffic. All from one reboot to the next.

Ideas?



This thread was automatically locked due to age.
Parents
  • From which version did you upgrade? Version before 9.405? If so, you may suffer from the MTU DHCP bug where your provider sends a way too low MTU for your WAN connection (usually 1500).


    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • apijnappels said:

    From which version did you upgrade? Version before 9.405? If so, you may suffer from the MTU DHCP bug where your provider sends a way too low MTU for your WAN connection (usually 1500).

    We upgraded from 9.504. As well, the units are on fixed IPs with MTU @ 1454 (the usual for Japan PPPoE connections). That WAN interfaces themselves work just fine. Only the VPN side of the connections are borked.

Reply
  • apijnappels said:

    From which version did you upgrade? Version before 9.405? If so, you may suffer from the MTU DHCP bug where your provider sends a way too low MTU for your WAN connection (usually 1500).

    We upgraded from 9.504. As well, the units are on fixed IPs with MTU @ 1454 (the usual for Japan PPPoE connections). That WAN interfaces themselves work just fine. Only the VPN side of the connections are borked.

Children
No Data