This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SG 230 and XG 125 Site2Site VPN always disconnect, just some of pair network, not all network

Ming Cheung over 5 years ago

I have SG230 and XG125 with both dual internet broadband,

SG and XG already upgraded to latest firmware,

they forms 9x5 network pair = 45 network pair,

but always intermittently disconnect with only 1 or 2 pairs inside, others still work

anyone had faced these problem?

This thread was automatically locked due to age.

Parents

0 Keyur over 5 years ago

Hi Ming Cheung

As per my understanding from the provided information, you have IPsec VPN connected between SG and XG firewall.

What do you mean by network pairs? Could you please provide more information for network pair and on your observation?
Cancel
Vote Up 0 Vote Down

Cancel
0 Ming Cheung over 5 years ago in reply to Keyur

Hi Keyur

local site SG230

192.168.20.0/24

198.162.1.0/24

X.X.X.X

X.X.X.X

X.X.X.X

X.X.X.X

X.X.X.X

X.X.X.X

remote site XG125

10.0.60.0/23

192.168.1.0/24

X.X.X.X

X.X.X.X

X.X.X.X

X.X.X.X

Sophos only allow to multiple 8 x 6 = 48

and almost only this pair intermittently disconnect, but others network pairs still pingable

I tested ping by Sophos build in tool to ping from source and destination, not from switches and PC behind

previously, always total disconnection before upgrade to latest firmware
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Ming Cheung over 5 years ago in reply to Keyur

Hi Keyur

local site SG230

192.168.20.0/24

198.162.1.0/24

X.X.X.X

X.X.X.X

X.X.X.X

X.X.X.X

X.X.X.X

X.X.X.X

remote site XG125

10.0.60.0/23

192.168.1.0/24

X.X.X.X

X.X.X.X

X.X.X.X

X.X.X.X

Sophos only allow to multiple 8 x 6 = 48

and almost only this pair intermittently disconnect, but others network pairs still pingable

I tested ping by Sophos build in tool to ping from source and destination, not from switches and PC behind

previously, always total disconnection before upgrade to latest firmware
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Keyur over 5 years ago in reply to Ming Cheung

Hi Ming Cheung

In the previous post, you have said you have 9*5 = 45 but the latest post you have mentioned Sophos allows 8*6 = 48 pairs. Anyways so as per my understanding few of the pairs are disconnected though it shows SA is established between them but you are not able to ping the IP of the remote branch.
Cancel
Vote Up 0 Vote Down

Cancel
0 Ming Cheung over 5 years ago in reply to Keyur

Hi Keyur

yes, SA is established, it shows green always, no red,

but it is just can not ping,

after tracert, it just can not go remote site's gateway,

but other normal network can
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to Ming Cheung

Hi Ming Cheung

Is SA shows green at both the end, SG and XG end?

Are you trying to ping from user system or from firewall console?

Please try to ping from the user system and take packet capture using tcpdump and check the traffic at SG and XG end.
Cancel
Vote Up 0 Vote Down

Cancel
0 Ming Cheung over 5 years ago in reply to Keyur

both always green

from both firewall console testing tool as well, client PC as well

regardless from client PC, ping from firewall testing tool also unpingable,

I think this should not related to client swtiches and PC
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to Ming Cheung

Hi Ming Cheung

If you are trying to ping from a user system and not able to ping while SA is green, I would recommend you to contact technical support and open a service request to investigate the issue further. Please PM us the service request number.
Cancel
Vote Up 0 Vote Down

Cancel