VPN IPSEC ISSUE

Hi Rachid MAZOUZI,

Thank you for reaching out to Sophos Community.

There are no suspicious events in the above-shared screenshot. Request to follow the steps below and share session output again.

1. Login to SSH > 5. Device Management > 3. Advanced Shell and run below command

# tail -f /log/strongswan.log | grep -i "SIEGE_TO_SANAM"

2. Initiate connection of 'SIEGE_TO_SANAM' site-to-site tunnel.

As it's using NAT-T protocol I'd suggest configuring local and remote ID in the tunnel configuration at both ends.

It is working now thanks but we don't know the reason of disconnecting

You can check IPsec events in the log viewer to get the timestamp of tunnel disconnection.

Later you can filter strongswan.log with the timestamp using the below command:

# cat /log/strongswan.log | grep -i "2021-07-05 14:21"

or

# cat /log/strongswan.log | grep -i "2021-07-05 14"

Hello Yash as you advised me i took some screenshoot of downtime moment

and i checked the timstamp on the strongswan log

hi the probleme it occured again

Which firewall is at the remote location?

Could you please post a snapshot of 'Dead Peer Detection' configuration from IPsec policy(applied on SIEGE_TO_SANAM tunnel)?

the remote Firewall is Sophos XG 210  and where can i find Dead Peer Detection

the policy using is IKEv2

You can find 'Dead Peer Detection' in the IPsec policy under CONFIGURE > VPN > IPsec policies.

It would be great if you can share snapshots of both ends firewall.

the main sophos xg 330

the remote sophos xg 210