This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN IPSEC ISSUE

Hello,

Please should be informed that we established Connection VPN IPSEC on Friday 02 July 2021 between headquarter and other office and it worked perfectly however today we are unable to establish connection

i have check both side WAN connection are UP

here is a screenshot of Strongswan.log and charon.log

This thread was automatically locked due to age.

Parents

0 FormerMember over 4 years ago

Hi Rachid MAZOUZI,

Thank you for reaching out to Sophos Community.

There are no suspicious events in the above-shared screenshot. Request to follow the steps below and share session output again.

1. Login to SSH > 5. Device Management > 3. Advanced Shell and run below command

# tail -f /log/strongswan.log | grep -i "SIEGE_TO_SANAM"

2. Initiate connection of 'SIEGE_TO_SANAM' site-to-site tunnel.

As it's using NAT-T protocol I'd suggest configuring local and remote ID in the tunnel configuration at both ends.
Cancel
Vote Up 0 Vote Down

Cancel
0 Rachid MAZOUZI over 4 years ago in reply to FormerMember

It is working now thanks but we don't know the reason of disconnecting
Cancel
Vote Up 0 Vote Down

Cancel
0 Rachid MAZOUZI over 4 years ago in reply to FormerMember

the remote Firewall is Sophos XG 210 and where can i find Dead Peer Detection
Cancel
Vote Up 0 Vote Down

Cancel
0 Rachid MAZOUZI over 4 years ago in reply to FormerMember

the policy using is IKEv2
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to Rachid MAZOUZI

You can find 'Dead Peer Detection' in the IPsec policy under CONFIGURE > VPN > IPsec policies.

It would be great if you can share snapshots of both ends firewall.
Cancel
Vote Up 0 Vote Down

Cancel
0 Rachid MAZOUZI over 4 years ago in reply to FormerMember

the main sophos xg 330

the remote sophos xg 210
Cancel
Vote Up 0 Vote Down

Cancel
0 Rachid MAZOUZI over 4 years ago in reply to Rachid MAZOUZI

Hello please is there any suggestion regarding our issue ?
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to Rachid MAZOUZI

Assuming XG330 is configured to initiate the IPsec connection.

You may try to apply 'DefaultBranchOffice' IPsec policy at XG330 end and 'DefaultHeadOffice' at XG210 end. (If XG210 is an initiation then apply 'DefaultBranchOffice' at XG210 and 'DefaultHeadOffice' at XG330).

Request to share the strongswan.log output of the exact instance.

It would be great if you filter the log file only with hour.

# cat /log/strongswan.log | grep -i "2021-07-05 08"
Cancel
Vote Up 0 Vote Down

Cancel
0 Rachid MAZOUZI over 4 years ago in reply to FormerMember

after change the config to defaultbranchoffice and defaultheadoffice it is unable to connect both side
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to Rachid MAZOUZI

Hi Rachid MAZOUZI,

Log events show that the IKE message is being sent to the remote location(196.206.231.190), but there’s no response. I'd suggest reverting the tunnel configuration.

It would be great if you can share the log events of exact disconnection instances as they'd be helpful to narrow down the issue.

I'd also suggest opening a support case and share case ID via PM.
Cancel
Vote Up 0 Vote Down

Cancel
0 Rachid MAZOUZI over 4 years ago in reply to FormerMember

Thanks please how can i open case ID do you have an email to contacte ?
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to Rachid MAZOUZI

Refer to the article below to create a support case from the Support portal.

support.sophos.com/.../KB-000039516
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 FormerMember over 4 years ago in reply to Rachid MAZOUZI

Refer to the article below to create a support case from the Support portal.

support.sophos.com/.../KB-000039516
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data