VPN IPSEC ISSUE

Hi Rachid MAZOUZI,

Thank you for reaching out to Sophos Community.

There are no suspicious events in the above-shared screenshot. Request to follow the steps below and share session output again.

1. Login to SSH > 5. Device Management > 3. Advanced Shell and run below command

# tail -f /log/strongswan.log | grep -i "SIEGE_TO_SANAM"

2. Initiate connection of 'SIEGE_TO_SANAM' site-to-site tunnel.

As it's using NAT-T protocol I'd suggest configuring local and remote ID in the tunnel configuration at both ends.

It is working now thanks but we don't know the reason of disconnecting

You can check IPsec events in the log viewer to get the timestamp of tunnel disconnection.

Later you can filter strongswan.log with the timestamp using the below command:

# cat /log/strongswan.log | grep -i "2021-07-05 14:21"

or

# cat /log/strongswan.log | grep -i "2021-07-05 14"

Hello Yash as you advised me i took some screenshoot of downtime moment

and i checked the timstamp on the strongswan log

hi the probleme it occured again

Which firewall is at the remote location?

Could you please post a snapshot of 'Dead Peer Detection' configuration from IPsec policy(applied on SIEGE_TO_SANAM tunnel)?

the remote Firewall is Sophos XG 210  and where can i find Dead Peer Detection

the policy using is IKEv2

You can find 'Dead Peer Detection' in the IPsec policy under CONFIGURE > VPN > IPsec policies.

It would be great if you can share snapshots of both ends firewall.

the main sophos xg 330

the remote sophos xg 210

Hello please is there any suggestion regarding our issue ?

Assuming XG330 is configured to initiate the IPsec connection.

You may try to apply 'DefaultBranchOffice' IPsec policy at XG330 end and 'DefaultHeadOffice' at XG210 end. (If XG210 is an initiation then apply 'DefaultBranchOffice' at XG210 and 'DefaultHeadOffice' at XG330).

Request to share the strongswan.log output of the exact instance.

It would be great if you filter the log file only with hour.

# cat /log/strongswan.log | grep -i "2021-07-05 08"

Assuming XG330 is configured to initiate the IPsec connection.

You may try to apply 'DefaultBranchOffice' IPsec policy at XG330 end and 'DefaultHeadOffice' at XG210 end. (If XG210 is an initiation then apply 'DefaultBranchOffice' at XG210 and 'DefaultHeadOffice' at XG330).

Request to share the strongswan.log output of the exact instance.

It would be great if you filter the log file only with hour.

# cat /log/strongswan.log | grep -i "2021-07-05 08"

after change the config to defaultbranchoffice and defaultheadoffice it is unable to connect both side

Hi Rachid MAZOUZI,

Log events show that the IKE message is being sent to the remote location(196.206.231.190), but there’s no response. I'd suggest reverting the tunnel configuration.

It would be great if you can share the log events of exact disconnection instances as they'd be helpful to narrow down the issue.

I'd also suggest opening a support case and share case ID via PM.

Thanks please how can i open case ID do you have an email to contacte ?

Refer to the article below to create a support case from the Support portal.

support.sophos.com/.../KB-000039516