This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSEC Tunnel - connection down - ipsec sa expired

Hi all,

do you have any idea how to solve:

This is an auto-generated message from Sophos Monitoring Tool to inform the IPSec Connection status change.
IPSec Connection xxxx between 10.10.10.0/24 and 192.168.112.0/24 is down.
Time: 14:44:37
Reason: The IPSec SA expired.

Cheers

Tobias

This thread was automatically locked due to age.

Parents

0 sixteen again over 8 years ago

A SA timing out ...is to be expected, since they're time limited to begin with. Real issue: is new SA set up automatically?

In my experience, it wasn't. I ended up setting XG to "respond only" and the remote cisco IOS router an IP SLA ping to generate traffic so new SA gets set up.

also see:

https://community.sophos.com/products/xg-firewall/f/vpn/84082/xg-sfos-16-01-2-ipsec-unable-to-initiate-connection-but-connects-if-set-to-respond-only
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 sixteen again over 8 years ago

A SA timing out ...is to be expected, since they're time limited to begin with. Real issue: is new SA set up automatically?

In my experience, it wasn't. I ended up setting XG to "respond only" and the remote cisco IOS router an IP SLA ping to generate traffic so new SA gets set up.

also see:

https://community.sophos.com/products/xg-firewall/f/vpn/84082/xg-sfos-16-01-2-ipsec-unable-to-initiate-connection-but-connects-if-set-to-respond-only
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Tobias van der Plas over 8 years ago in reply to sixteen again

thanks for the answer - respond only unfortunately does not work, as the initiating endpoint (kerio control) would not be able to negotiate a matching proposal - any possibility to have sophos xg automatically reconnect when the tunnel expires?
Cancel
Vote Up 0 Vote Down

Cancel