Can only setup a 3DES-SHA1/3DES-SHA1 IPsec tunnel to Sonicwall device. I can't get it to work with AES256-SHA1/AES256-SHA1. Why?

Joe,

you should share some vpn logs while the AES encryption protocol is used. The other idea is to open a ticket with Support and ask them to investigate.

Let us know.

I have had a similar problem with an ipsec connection between Xg and a utm.

For me the following topic had the solution: https://community.sophos.com/products/xg-firewall/f/vpn/89213/ipsec-vpn-with-utm-not-passing-traffic/325743#325743

I am not sure if sonicwall got a simular option for the (96 bit) version of the policy but maybe you can try that.

I tried this and it made no difference.

We have another site with a newer Sonicwall and I had no issues at all, with either creating the tunnel or passing traffic -- it works like it's supposed to.

I suspect it's something up with the Sonicwall itself, and not with the Sophos.

similar experience.  My XG will only use on particular configuration when connecting to my SonicWALL device.  I've called tech support on this more than once.  The only help they offer is to walk through nearly every combination of settings to verify that I am using the only combination that works. At that point, because its working they consider it solved.  No urgency in seeking to find out why more secure options are not working.

We are running XG vs SonicWall using AES256/sha1 and its working with no issues at all.

XG is 16.05 with MR6.

SonicWall is not ours so i don't know the firmware version on the SonicWall.