This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall-VPN-Tunnel ausgefallen

Hallo Zusammen,

wir haben eine XG 135 mit SFOS 18.0.0.379 im Einsatz. Wir betreiben damit einen Sophos Connect IPsec-VPN und ich vermute genau der wirft uns ständig Alarme ins Central (Kein weiterer VPN-Tunnel zu Zweigniederlassungen o.Ä.). Ich habe mal gehört, dass die XG bzw. Central an dieser Stelle etwas zu geschwätzig ist und dass man diese Meldungen zwar nicht beheben, diese aber ausblenden kann. Ich lasse mich sehr gerne eines besseren belehren, würde aber auch gerne Wissen warum diese Meldungen auftauchen und wie ich diese Verbannen kann, in welcher Form auch immer.

Den E-Mail-Warnhinweis habe ich sowohl auf "Nie" als auch auf "keine" gesetzt, was allerdings nicht das Problem behebt, dass die Alarmmeldungen im Central auftauchen.

Hat hier jemand jemand eine Idee, was ich hier tun kann?

Viele Grüße

Miu

This thread was automatically locked due to age.

0 emmosophos over 4 years ago

Hello Sophos User1640,

Thank you for contacting the Sophos Community!

You should have an option called "Never" if it is not showing try accessing as a Super Admin.

Regards,
Cancel
Vote Up 0 Vote Down

Cancel
0 Sophos User1640 over 4 years ago in reply to emmosophos

Hello Emmanuel,

thank you for the answer.

As I wrote I already tried this option without any changes...

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 4 years ago in reply to Sophos User1640

Hello there,

Are you receiving the same alert for the same IP?

Regards,
Cancel
Vote Up 0 Vote Down

Cancel
0 Sophos User1640 over 4 years ago in reply to emmosophos

Hello Emmanuel,

no, there are alerts for 5 differen IP's for yesterday. Most of them says connection terminated and the others says connection established.

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 4 years ago in reply to Sophos User1640

Hello,

Can you set these 5 alerts to Never, and monitor if you see the same Alert for the same later on.

I think this might be related to NC-62789 IPsec notifications Alerts when Sophos Connect/L2tp connects/disconnects

Regards,
Cancel
Vote Up 0 Vote Down

Cancel
0 Sophos User1640 over 4 years ago in reply to emmosophos

They are already set to Never (German: Nie)

Same behaviour.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to Sophos User1640

The "Never" will only set the Email Notification settings. The alert is still generated.

Which version of Sophos Connect do you use?

This should be already resolved: Or, and this could be another case: the alert occurs if the rekey event appears.

How did you configure Sophos Connect on XG?
Cancel
Vote Up 0 Vote Down

Cancel
0 Sophos User1640 over 4 years ago in reply to LuCar Toni

Hi LuCar Toni,
yes, this is just for Email Notifications :)
We're using Sophos Connect-Service 1.4.45.1015 with strongSwan-Service 5.8.0.

I can't find anything about NC-62789 or which versions of connect client are affected
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 4 years ago in reply to Sophos User1640

Hello,

For the email alerts, the only way to stop them, for now, is to disable the Notification email for the IPsec tunnel is up and the IPsec tunnel is down, from the XG.

There is a Feature Request coming in a future version to have a separate "Enable/Disable" button for Remote access (Sophos Connect) and another one for IPsec.

Also, try moving to 2.0 for Sophos Connect.

Regards,
Cancel
Vote Up 0 Vote Down

Cancel
0 Sophos User1640 over 4 years ago in reply to emmosophos

Thank you, I will rollout the new client and reply ASAP
Cancel
Vote Up 0 Vote Down

Cancel