I'm posting here to see if I can find other with the same issue. We've used Cyberoam's for 5+ years and now have some XG's at clients. The site to site VPN is broken, we worked over and over again with Cyberoam, and now with Sophos, nothing changes. The VPN's do not re-initiate reliably. If I have a Cyberoam/XG at my main office and one at the remote office, if the power or Internet goes down at the branch or main the VPN does not re-establish until I manually click the connect button on the firewall. If there's a SonicWall at the branch it's solid becuase the SonicWall is always trying to connect if it isn't, there is no button to connect or disconnect, just to enable or disable. We see the same thing with Fortinet to XG.
It's crazy that the VPN doesn't work going from XG to XG. It's to the point now where my office has lost confidence in the device and is moving over to Fortinet, or anything else really. I also have IPsec tunnels to Cisco firewalls that don't work. Below is from a post I made on Reddit in the MSP community, I removed usernames.
- What is the issue/specifics on the VPNs? we're looking at rolling 3 XGs out to a customer with 3 locations in one city shortly and would like to avoid/watch for/work around this.
permalinkembedsavereportgive goldreply
- Well with the XG/Cyberoam, the IPsec tunnels have a button for "Active" and "Connection", the "Active" essentially means enable, the connection button connects the tunnel, which is the part that seems uncommon. The issues we have are that when a remote site looses Internet or power we have to log onto the firewall and click that connection button to bring the tunnel back up, we've beaten the issue to death with Cyberoam support over the last few years to no avail. It's funny to that it really only happens with XG to XG, a SonicWall at the remote office is fine since a SonicWall already tries to connect, it doesn't need manual intervention.
Just today for instance, I have a tunnel to a hospital here, they use Cisco. The tunnel was down and to bring it back up I had to login to the firewall and click the connect button. There is a setting called "Action When Peer Unreachable" which is set to "Re-initiate" which doesn't work.
It's strange because I don't see allot of people posting about it but we can't be the only ones. Again, I think the issue is how there tunnels work and the fact that they have a button to connect them (not enable, but connect). All the other devices I've seen don't have this.
permalinkembedsaveparenteditdisable inbox repliesdeletereply- We have 20+ cyberoams installed and have always had that issue with the VPNs no matter what policy options we've tried. They flat out do not re-initiate reliably. I've just signed up as a fortinet partner (Australia) so I could evaluate (luckily did not have any problems with this as I went through the Ingram micro fortinet bdm). The next firewall I put in will be a fortinet, so hoping for a much better vpn implementation.
permalinkembedsaveparentreportgive goldreply
- Thank you for that, i'll be kicking it to our rep in terms like "if we see this issue, we're returning them and done with sophos".
We had similar issues in a cisco RV120 ->fortigate (iirc) and there was basically a setting you had to use to tell it to keep the tunnel up even when idle
- Thank you for that, i'll be kicking it to our rep in terms like "if we see this issue, we're returning them and done with sophos".
- We have 20+ cyberoams installed and have always had that issue with the VPNs no matter what policy options we've tried. They flat out do not re-initiate reliably. I've just signed up as a fortinet partner (Australia) so I could evaluate (luckily did not have any problems with this as I went through the Ingram micro fortinet bdm). The next firewall I put in will be a fortinet, so hoping for a much better vpn implementation.
- Well with the XG/Cyberoam, the IPsec tunnels have a button for "Active" and "Connection", the "Active" essentially means enable, the connection button connects the tunnel, which is the part that seems uncommon. The issues we have are that when a remote site looses Internet or power we have to log onto the firewall and click that connection button to bring the tunnel back up, we've beaten the issue to death with Cyberoam support over the last few years to no avail. It's funny to that it really only happens with XG to XG, a SonicWall at the remote office is fine since a SonicWall already tries to connect, it doesn't need manual intervention.
This thread was automatically locked due to age.
