IPSec VPN site-to-site does not reconnect after reboot

Another VPN Site-to-Site was up for 2 weeks, then one side power failed, and after comming back up does not only fail to re-connect automatically, but will not connect at all! LOG is just saying, IPSec could not connect or something like this.

WEIRD: 2 days later connected without a problem!!!???

What's going on? How do you suggest to diagnose?

Hi Andrej Pirman , 

Both the site you have Sophos XG Firewall?

Please share the IPSec VPN policy you have applied on each site?

What you have set Gateway type where there was power failure? What is the current firmware Sophos XG ?

Please share the above information with a snapshot 

Thanks and Regards

No, this 3 locations have Draytek 2926 on site 1 and 3, while location 2 has XGS-136:

• VPN from 2 to 1 works fine.... except once every 2 months does not reconnect after some failure.
• VPN from 2 to 3 works OR does not work, depending. One week works, another week does not connect at all despite of numerous manual retries and reboots. The day later it connects just fine.
• IPSec Policy is THE SAME for both VPN connections
• Gateway tape is "Initiate Connection" on both VPN connections
• Also VPN parameters on both Drayteks are exactly the same, same PSK also

Hi Andrej Pirman

Suspecting issue with IPSec VPN Policy at Draytek router.

Can you share the VPN Policy configure at the Draytek router?

Please check the logs with the below command if IPsec VPN is not getting established 

console>tcpdump 'host <static public IP of Draytek router> and port 500 

console>dr  'host <static public IP of Draytek router> and port 500 

console> show vpn IPSec-logs

tail -f /log/strongswan.log

Please refer the link : https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/123740/sophos-xg-firewall-troubleshooting-site-to-site-ipsec-vpn-issues 

Thanks and Regards

Hi Andrej Pirman

Suspecting issue with IPSec VPN Policy at Draytek router.

Can you share the VPN Policy configure at the Draytek router?

Please check the logs with the below command if IPsec VPN is not getting established 

console>tcpdump 'host <static public IP of Draytek router> and port 500 

console>dr  'host <static public IP of Draytek router> and port 500 

console> show vpn IPSec-logs

tail -f /log/strongswan.log

Please refer the link : https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/123740/sophos-xg-firewall-troubleshooting-site-to-site-ipsec-vpn-issues 

Thanks and Regards