This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN in tunnel interface mode, crashes after a few hours

Hello, I have a very curious problem.

I implemented a Sophos XG 310 in a client and it was necessary to configure 9 VPNS in tunnel interface mode with branch offices, in each branch there is a SonicWall, the protocols used in the phases are weak, SHA1 and 3DES, this will be improved soon, when the customer exchanges all SonicWall for Sophos XG 125, thus redoing these VPNS.
Well, the case is that at the moment these VPNS have a strange problem, the tunnels keep working for about 6 hours and then they all fall and don't go up, I need to do this manually, in the XG logs I saw several messages like this "the received CHILD_SA proposals did not match: ESP: 3DES_CBC / HMAC_SHA1_96 / MODP_1024 / NO_EXT_SEQ, ESP: AES_CBC_256 / AES_CBC_192 / AES_CBC_128 / HMAC_SHA2_512_256 / HMAC_SHA2_4_HHA_EX_4"

It's a very curious thing, how can VPNS spend hours connected and then simply fall?

Has anyone here been through anything like this?

Thank you !

This thread was automatically locked due to age.

0 rfcat_vk over 5 years ago

Hi,

which version of XG are you running?
ian
Cancel
Vote Up 0 Vote Down

Cancel
0 IvanildoGalvão over 5 years ago in reply to rfcat_vk

XG310 (SFOS 18.0.1 MR-1-Build396)
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 5 years ago in reply to IvanildoGalvão

Hi,

can you rollback to v17.5.12 I think is the short term solution until v18.0.3 mr-3 arrives within the next couple of weeks.

i would suggest you start a support case while waiting.

ian
Cancel
Vote Up 0 Vote Down

Cancel
0 IvanildoGalvão over 5 years ago in reply to rfcat_vk

A little complicated, this equipment went into production from the beginning with this version "(SFOS 18.0.1 MR-1-Build396)"
Several firewall rules, DNATS and static routes were created.
Is it possible to return to version "17.5.12" without causing further problems to the customer's environment?

And is this drop in VPNS a known bug in the "(SFOS 18.0.1 MR-1-Build396)" version?

Thank you.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 5 years ago in reply to IvanildoGalvão

Hi,

no, it is not possible, the configuration is not backward compatible.

please create a support case.
ian
Cancel
Vote Up 0 Vote Down

Cancel
0 IvanildoGalvão over 5 years ago in reply to rfcat_vk

Yes, I already created, the case is with Sophos.

Thank you !
Cancel
Vote Up 0 Vote Down

Cancel