Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 15 replies
  • Answers 2 answers
  • Subscribers 30 subscribers
  • Views 6720 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site to Site VPN with Draytek Router

Tharindu Premarathne

Hi Guys,

Can anyone tell me how to configure IPsec VPN between Draytek and Sophos xg. I already create the IPSec policy and the connection but VPN is not established. I double-checked the Phase 1 and 2 parameters with the guy who configured the Draytek router, the phase 1 and 2 parameters are fine.

In the Draytek router, he configured the Dial-out VPN not a site to site 



This thread was automatically locked due to age.
  • 0 in reply to charles kavazy

    Forgot to mention that we have two remote sites, both with the same IPsec policy. One of them will connect for a while, sometimes for an hour so but will eventually go down. The other one won't connect at all. Very odd.

  • 0 in reply to charles kavazy

    OK, so you're dialling from the DrayTek to the Sophos. The settings I use are listed below.

    On the DrayTek:

    • Call direction; Dial Out
    • Always On: enabled
    • Type of server: IPsec, IKEv2
    • Authentication method:  Pre-SharedKey
    • IPsec Security method: High, AES with Authentication [Phase 1: AES256_SHA256_G14; Phase 2: AES256_SHA256; Phase 1 lifetime: 28800; Phase 2 lifetime: 3600; PFS enabled]
    • From the first subnet to remote network, you have to do: Route

    On the XG, VPN profile:

    • Connection type: Site to site
    • Gateway type: respond only

    On the XG, IPsec policy:

    • Key exchange: IKEv2
    • Re-key connection: disabled
    • Phase 1: DH Group: 14; Encryption: AES256; Authentication: SHA2 256
    • Phase 2: PFS Group 14; Encryption: AES256; Authentication: SHA2 256
    • Dead peer detection: disabled

    The settings I've given are slightly different in that the encryption is stronger, and I would suggest updating it as best practice and future-proofing. G14 is much stronger than G5, performance good, so if it's an option, it's strongly advised. However, it's probably not the solution to the issue here (although obviously I can vouch I have made the above configuration work!)

    Your screenshot from the XG doesn't have the Key life, Re-key margin and randomise re-keying options greyed out. They should be (on SFOS 18 certainly) as they only apply on dial out. I suspect at least part of the problem is that the XG has re-keying of the connection enabled, and that would explain why sometimes you see a tunnel and it goes down. Essentially, re-keying a dial in connection will cause the XG to kill the connection when it hits the randomised re-key time.

    If you check/update those settings, does it help at all?

  • 0 in reply to Noel Slevin

    Thanks for these settings Noel. The issue is now resolved, but only by switching to a different broadband line at head office. Difficult to know what is the issue on the original line but I will update if I get anything useful back from our internet provider. Thanks again.

  • 0 in reply to charles kavazy

    OK, have you checked your firewall settings on the XG to make sure you don't have anything redirecting ports 500 or 4500 elsewhere, e.g. a VPN server? Sounds like capturing the traffic using tcpdump on the XG is the best thing to do, so you can verify if traffic is hitting it. I wouldn't bother with the GUI log viewer - tcpdump will give you far more useful information.