Guest User!
You are not Sophos Staff.
Hello,
good day,
We have an XG 230 with the version SFOS 18.0.5 MR-5 and have created an IPsec connection in a failover group. The switch between active and passive works. If the primary internet line is then active again, the automatic failback function unfortunately does not work.
How can we solve this problem?
Hi admin_idl,
Thank you for reaching out to Sophos Community.
Assuming 'Automatic failback' is enabled in the Failover group.
Ensure that the failover rule condition(CONFIGURE > Network WAN link manager) for both the gateways are set to check ping/TCP connectivity with public IP(google DNS/8.8.8.8,4.2.2.2) instead of gateway IP.
If this doesn't help then check dgd.log and strongswan.log debug events to narrow down the issue.
==> Login to SSH > 5. Device Management > 3. Advanced Shell
=> Run below command to put strongswan service in debugging.
# service strongswan:debug -ds nosync
=> Run below command to check dgd.log and strongswan.log events.
# tail -f /log/dgd.log /log/strongswan.log
=> To stop debugging
# service strongswan:debug -ds nosync
# service -S | grep strongswan
=> Share the session output here or in PM.
Try to create the failover group again with the default failover rule conditions and check if failback works or not.
Hi admin_idl,
Thank you for reaching out to Sophos Community.
Assuming 'Automatic failback' is enabled in the Failover group.
Ensure that the failover rule condition(CONFIGURE > Network WAN link manager) for both the gateways are set to check ping/TCP connectivity with public IP(google DNS/8.8.8.8,4.2.2.2) instead of gateway IP.
If this doesn't help then check dgd.log and strongswan.log debug events to narrow down the issue.
==> Login to SSH > 5. Device Management > 3. Advanced Shell
=> Run below command to put strongswan service in debugging.
# service strongswan:debug -ds nosync
=> Run below command to check dgd.log and strongswan.log events.
# tail -f /log/dgd.log /log/strongswan.log
=> To stop debugging
# service strongswan:debug -ds nosync
# service -S | grep strongswan
=> Share the session output here or in PM.
Try to create the failover group again with the default failover rule conditions and check if failback works or not.
