Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 29 subscribers
  • Views 7256 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

24hr internet disconnect caused by Azure S2S IPsec connection

Akilae
Hello,
I have a bit of a weird behavior of my S2S connection from my Sophos XG Home Firewall to the Azure Cloud. My internet connection drops every 24hrs to the minute for around 1 minute until it gets reconnected. So does the S2S IPsec connection.
I have already seen in the KB article that the reconnects are "normal" for the Azure S2S connection. Should this internet drop also be normal?
 
Note from the KB article:
Azure must re-key the IKE_SA by deleting the expired IKE_SA and creates a new connection, which leads to some seconds of down time.
 
Also after the reconnect the automatic reconnection to two peered subnets does not work anymore.
Any suggestions how I can change this behavior?
 
Best regards!


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Akilae

    In our tunnels to Azure VPN gateway I have found a few things that help.

    1. On the XG, try to keep the number of Remote Subnets (Azure side) to a minimum, only one such as the entire VNet if possible.  We had one tunnel where individual subnets (had six in the list) were used and the stability of the tunnel took a dive.
    2. Clone the built-in Azure IPsec policy.  Disable the rekey of the connection, so it only will rekey when Azure VPN gateway decides to.

    Those two things have helped us a ton!

     

    Nate

  • 0 in reply to NateP

    Thank you for the tip with the re-key deactivation. I thought I did that but it seems that somehow I ticked that checkbox on my cloned policy. Will test it again and check if it changed in behavior. Still, a internet reconnect must not happen if an IPSec tunnel changes state.