This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-site (XG to XG) tunnel interface breaks during dynamic IP change

Hi folks,

Running an XG in my office I succesfully set up a RBVPN through tunnel interface between this XG and another XG in my branch offic
The office running with a static public IP while the branch office has a dynamic public IP changing every night.
The branch office's tunnel interface is set to 'initiate connection' and tunnel interface on headquarter site is 'respond only'.
Furtheron the Gateways adress on headquarter site is set to a DDNS provider.

The case here is, that after changing the IP during dyn-IP process in the night, the tunnel seems to get inconstident!
VPN IPsec connection tab tells me 'Active - green' and 'Connection - green' but no traffic is submitted.

Workaround so far - reconnect the tunnel and all works fine until next dyn-IP change.

This thread was automatically locked due to age.

Top Replies

njabi over 3 years ago +2 suggested

changed my branch office's 'Gateway type' to respond only and HQ to Initiate . Works like charm for some days...

0 FormerMember over 3 years ago

Hi, Thanks for reaching out to Sophos Community.

Which DPD action is selected under the Policy on both Branch and HQ firewall?
Cancel
Vote Up 0 Vote Down

Cancel
0 njabi over 3 years ago in reply to FormerMember

Hi Devesh,

I am using the default IKEv2 policy on both sides

XG on branch (dynamic IP with DDNS)

XG on HQ (static IP)
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 3 years ago in reply to njabi

Can you try to change the DPD action on HQ firewall to 'Hold' (Responder end) instead of Re-Initiate and verify whether the issue exhibits again or not

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 njabi over 3 years ago in reply to FormerMember

Hi Devesh,

I give it a try and text my feedback after the next days.
I tried to force the behaviour by renewing the ip-adress manually. Sometimes the connection is re-initiated by 'initiator', sometimes it is not.

But let's see what the next night brings with the adapted settings!
Cancel
Vote Up 0 Vote Down

Cancel
0 njabi over 3 years ago in reply to FormerMember

Hi Devesh,

first day after nightly ip-change - connection is green on both sides but no traffic is possible!
Reconnected the tunnel manually and it's up.

So - no difference by having your adviced changed option.
Cancel
Vote Up 0 Vote Down

Cancel
0 njabi over 3 years ago in reply to FormerMember

Good morning!

Yesterday tunnel was up after nighty ip change.
This morning traffic over tunnel interface is not floating. Had to reconect the tunnel.

Any chance for a workaround?
Cancel
Vote Up 0 Vote Down

Cancel
0 njabi over 3 years ago in reply to FormerMember

changed both sides to initiate mode, still facing issues!
Cancel
Vote Up 0 Vote Down

Cancel
0 njabi over 3 years ago

changed my branch office's 'Gateway type' to respond only and HQ to Initiate. Works like charm for some days...
Cancel
Vote Up +2 Vote Down

Cancel
0 FormerMember over 3 years ago in reply to njabi

Hi njabi, Glad to hear the issue seems to have resolved. While monitoring for the past few days, Have you verified whether the Dynamic IP kept changing or has it not ?
Cancel
Vote Up 0 Vote Down

Cancel
0 njabi over 3 years ago in reply to FormerMember

Good day - for sure it kept changing and will in the future, since it is a dynamic ip-adress by ISP.
IMO the responder should know whether the connection is down due to ip change, but connection kept stable after that and traffic is not going through.
Cancel
Vote Up 0 Vote Down

Cancel