Release of v17 MR-2?

For users continuing to see IPsec site-to-site VPN issues on v17 MR-3, please contact Support and open a ticket to provide logs & report possible BUG. Once you do please provide me with your case ID so I can be sure that the case is escalated. 

For non-licensed users, please share or DM me the following information: 

• logfiles from the time frame when the Problem happens (/log/charon.log)
• screenshots of the Connection config
• screenshots of the Policy used in the Connection
• charon related coredumps from /var/cores (if any)

We appreciate all your feedback.

Thanks,
Karlos

For users continuing to see IPsec site-to-site VPN issues on v17 MR-3, please contact Support and open a ticket to provide logs & report possible BUG. Once you do please provide me with your case ID so I can be sure that the case is escalated. 

For non-licensed users, please share or DM me the following information: 

• logfiles from the time frame when the Problem happens (/log/charon.log)
• screenshots of the Connection config
• screenshots of the Policy used in the Connection
• charon related coredumps from /var/cores (if any)

We appreciate all your feedback.

Thanks,
Karlos

I've had case #7758347 open for a while trying to work on this. Unfortunately I replaced a Cisco ASA with a Sophos appliance already running v17 on the other side of the country. Debating whether or not to wait for a fix or go ahead and fly out there and go through the process of downgrading to 16, which essentially does a factory reset, or just stick the ASA back in place and ask Sophos for my money back. I have another identical Sophos UTM running at another datacenter in another state with v16 that isn't experiencing any of these issues.

Our issue is that every few hours one of our main ipsec tunnel will drop and doesn't come back up unless someone resets it on our end. My current workaround is that I have Solarwinds monitoring devices on the other end of the tunnel. When Solarwinds loses that connection it kicks off a script using Devolutions RDM to open an ssh session to the UTM and restart the VPN service. This obviously isn't a doable workaround for everyone.... and still causes a lot of issues for us since we have a lot of realtime data coming across that tunnel. So every time it drops is trouble.

MR2 and MR3 cause the tunnel to completely stop working. So right now I'm stuck on MR1 because that seems to be the only spot where the tunnel at least works. 17 GA had a bug that caused the UTM to become unresponsive and we kept having to do hard resets on it, by shutting off power to it from the PDU it's plugged into. But the tunnel seemed to be stable on GA. MR1 seemed to be where the IPSEC issues started for me. But I'm in between the rock (UTM becoming completely locked up) and the hard place (the tunnel randomly dropping).

Thanks Karlos,

My case id/Service request number is: 7819367 

Thanks,

-Scott

I want to add that we had to switch back to a cisco device at this remote location today because of lack of stability on the sophos.  If you need somethign from the system it will have to wait until tomorrow.  I did upload the charon.log file from yesterday as part of my case though.

-Scot

Hi Scott,

Thank you for that. Reviewed your case & as agreed upon, please give us a call next time the tunnel goes down so we can gather the necessary debug information we'd need to submit for escalation.

Best,
Karlos

I've done that several times if you look further back through the case. Support keeps asking me for the same thing. The tunnel goes down every few hours and I've gotten them in many times to look at it. I've sent them logs, the whole works. I can't keep wasting my time helping them debug their broken code. I've been trying applying the maintenance releases as they've come out and reporting back that they make things worse. I can't sit around all day wasting my time on this with support. I have a job to do that should not involve sitting waiting to see when the new appliance I just bought is going to fail.

Hi Ryan,

Thank you for that. Reviewed your case and as you've mentioned, understandably rolled back to MR-1 due to the instability issues. To escalate the case, it will be necessary to be on MR-3 so we can extract the debug information necessary to submit to our Escalation/Development team. 

We will update this thread for any progress on this issue.

Thanks for your patience.

Best,
Karlos

I can't reiterate Ryan's point here enough. Many of us have been working with firewalls and vpn concentrators for a long time. I can't remember the last time I was uncomfortable heading out of town because of such a device and whether it would require hands-on support.

Personally, after moving to MR3 and completely rebuilding my IKEv2 tunnel to Azure with a new IPSEC profile I've had good results. The pre-built Azure ipsec profile that came with one of these MR's doesn't work at all - doesn't even reflect the requirements M$ themselves have published.

I'm not touching mine until it seems stable enough to be ready to try redundant tunnels - at this point seems like it would just drag me into another week of pain.

That is simply not an option. The majority of our companies business depends on this one vpn tunnel being up and running. From what I'm told from our business team we lose roughly $1,000 every minute that it's down. Unfortunately the other end of the tunnel is managed by a company that we are partnered with, so we don't manage it and do not have any say on replacing it. They are running an ASA that does not support ikev2. They have that ASA scheduled for replacement but it's not for several more months. I cannot upgrade to MR3, break the tunnel, send our company into a financial tailspin, and likely lose my job. No thank you, I'll let another user with this issue take that bullet. I am not going to knowingly upgrade to a broken firmware version.

*edit*

The "fix" that sophos' engineers should be working on right now is a graceful downgrade path back to 16 that will leave your config intact. Get users off of this broken version until sophos has fixed it and thoroughly tested it.

Same issue here, and your comments resonate with me too.

I just wanted to add a few data points for the Sophos Engineers.

I've got two Sophos XG  135's that both connect via encrypted GRE tunnels back to the same cisco router at main data center. 

The one that the VPN  goes up and down more than a yo-yo is on a  PPPoE DSL link  that is in the middle of nowhere (4Mbps down  and perhaps 750 up) which shows slight packet loss from time to time (0%-3.0%)  VPN goes down  maybe 3-10 times a day. 80% of the time the connection will come back up, 20% some of the SA's remain down or all are down.    While I understand there is some packet loss, the cisco router(the replacement for the sophos on the remote end) still keeps the tunnel up and passes traffic.  Perhaps the Sophos is not that forgiving when it tries to recover compared to the cisco.

The other XG is at my house.   That is on a nice cable modem connection with Spectrum. I have 100Mbps down and 5Mbps(I think) up.  This connection perhaps drops its ip sec SA's maybe once or twice a week at most(some weeks not at all) and always come backs up without issue.  A lot better than the DSL connection. 

Cheers,

-Scott