TCP Retransmissions, Reset and Dup packets through IPSec tunnel , Slow access thorugh tunnel

First of all, you should track this issue with a support case. 

Second: You could try the following workarounds: 

Disable IPsec Acceleration: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/CommandLineHelp/DeviceConsole/SystemCommands/index.html#command-ipsecacceleration

Disable Hardware Acceleration: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/CommandLineHelp/DeviceConsole/SystemCommands/index.html#firewall-acceleration

If one of both helps, please raise a Support case to get this into the system. 

I have a ticket number already, but in a different email i will post that here, once i have access. 

I will check disabling the above tomorrow and update here. Hopefully it helps. 

But one question remains: 

When same user connected through SSL VPN and then goes to same S2S tunnel, gets no issue, doesn't the IPSec acceleration effect in this case?

I have a ticket number already, but in a different email i will post that here, once i have access. 

I will check disabling the above tomorrow and update here. Hopefully it helps. 

But one question remains: 

When same user connected through SSL VPN and then goes to same S2S tunnel, gets no issue, doesn't the IPSec acceleration effect in this case?

Could be potentially something like a MTU issue. 

Within your network you likely use MTU Sizes of 1500.

SSLVPN uses 1400 MTU Size. So if the client sends the packet with MTU of 1400, it could actually resolve this.

Try to reduce the MTU of your Client on LAN to 1400 and see, if the issue resolve itself in LAN. Then going forward you could potentially investigate the Application, if there is something like DF (Dont Fragment) Pakets be used. 

This issue got resolved after we downgraded to 18.5 version. 

referred to below url:

community.sophos.com/.../version-19-0-0ga-breaking-ipsec-vpn-s

So we do not know, what caused this issue and you only have a workaround? The problem is, if Sophos cannot investigate your application and what is happening, Sophos can likely not fix your particular issue. 

Hi Lucar,

obviously I don’t expect Support to troubleshoot my application.

so i am saying 19.0 have a bug with ipsec accelerator,  isn’t it? We should enable that check what’s causing the issue?

we did reduced MSS to 1300 till 900 as well but still same issue.

I think we may be seeing the same issue on one firewall

we see reset packers but there is not dropped packets being shown.

we have a support case open but have not found where the reset is coming from.