Release of v17 MR-2?

As far as VPNs go, I am having no issues with IPSec VPN in my test area, or with my own 105 at home all running MR2.

I also have a barebones unit running home (thats for a new site we are starting up, running a 3g dongle so I can at least bed in UPS's, switches, environmental monitoring until new line is physically installed in January) at 17 mr2, and thats fine too. All above units are talking fine to 17GA IPSec VPN

Both production firewalls are on 17 GA, but plan to upgrade over the weekend all being well.

What I would say about the IPSec VPNS is this, in the upgrade from 16.8 to 17, the VPNs became really unstable.

The fix I had was to recreate all the VPN connections, with custom policies. Been solid since.

I think its a little unfair to start shouting and screaming that things are broken, might be for individuals, but I for one am happy with MR2 so far. It seems more responsive too on my xg105w I run at home.

There are two tests I'll do tonite.  I will re-install MR2, with Sophos' own guidelines, and check if HTTPS traffic between both sites still kills the VPN.  Few weeks ago, I raised a ticket on this that was later closed unresolved.  Last time HTTPS traffic true the VPN was flowing nice in the Lab, but failed in real life.  Sophos support could not find the source of that problem.  We played with timing and modified some parameters because "main office profile" and "remote office profile" were not the same to start with !!!  But even with that fixed, VPN was unreliable.

I will also recreate a new custom rule with IKEv2.  Well the same I have now finally ...  Just to make sure there's no dead bodies in the closet.  Just for dead-peer-detection alone, IKEv2 is mandatory.

Your opinion is polite and respectful, but I wish to expose a different opinion about what I think is fair here.   I was able to kill MR2 IKEv2 VPN in nano seconds.  With standard parameters except for one.  So expressing frustrations loudly about a failing VPN implementation based on technologies that date back in the 80s for IKEv1, and 2005 for IKEv2 seems fair enough to me.  Particularly when we've been dragging reliability issues for so long.

I'll keep everyone informed about my results tomorrow hoping it helps some ...

There are two tests I'll do tonite.  I will re-install MR2, with Sophos' own guidelines, and check if HTTPS traffic between both sites still kills the VPN.  Few weeks ago, I raised a ticket on this that was later closed unresolved.  Last time HTTPS traffic true the VPN was flowing nice in the Lab, but failed in real life.  Sophos support could not find the source of that problem.  We played with timing and modified some parameters because "main office profile" and "remote office profile" were not the same to start with !!!  But even with that fixed, VPN was unreliable.

I will also recreate a new custom rule with IKEv2.  Well the same I have now finally ...  Just to make sure there's no dead bodies in the closet.  Just for dead-peer-detection alone, IKEv2 is mandatory.

Your opinion is polite and respectful, but I wish to expose a different opinion about what I think is fair here.   I was able to kill MR2 IKEv2 VPN in nano seconds.  With standard parameters except for one.  So expressing frustrations loudly about a failing VPN implementation based on technologies that date back in the 80s for IKEv1, and 2005 for IKEv2 seems fair enough to me.  Particularly when we've been dragging reliability issues for so long.

I'll keep everyone informed about my results tomorrow hoping it helps some ...