Release of v17 MR-2?

For users continuing to see IPsec site-to-site VPN issues on v17 MR-3, please contact Support and open a ticket to provide logs & report possible BUG. Once you do please provide me with your case ID so I can be sure that the case is escalated. 

For non-licensed users, please share or DM me the following information: 

• logfiles from the time frame when the Problem happens (/log/charon.log)
• screenshots of the Connection config
• screenshots of the Policy used in the Connection
• charon related coredumps from /var/cores (if any)

We appreciate all your feedback.

Thanks,
Karlos

Thanks Karlos,

My case id/Service request number is: 7819367 

Thanks,

-Scott

I want to add that we had to switch back to a cisco device at this remote location today because of lack of stability on the sophos.  If you need somethign from the system it will have to wait until tomorrow.  I did upload the charon.log file from yesterday as part of my case though.

-Scot

Hi Scott,

Thank you for that. Reviewed your case & as agreed upon, please give us a call next time the tunnel goes down so we can gather the necessary debug information we'd need to submit for escalation.

Best,
Karlos

Hi Scott,

Thank you for that. Reviewed your case & as agreed upon, please give us a call next time the tunnel goes down so we can gather the necessary debug information we'd need to submit for escalation.

Best,
Karlos

I've done that several times if you look further back through the case. Support keeps asking me for the same thing. The tunnel goes down every few hours and I've gotten them in many times to look at it. I've sent them logs, the whole works. I can't keep wasting my time helping them debug their broken code. I've been trying applying the maintenance releases as they've come out and reporting back that they make things worse. I can't sit around all day wasting my time on this with support. I have a job to do that should not involve sitting waiting to see when the new appliance I just bought is going to fail.

I can't reiterate Ryan's point here enough. Many of us have been working with firewalls and vpn concentrators for a long time. I can't remember the last time I was uncomfortable heading out of town because of such a device and whether it would require hands-on support.

Personally, after moving to MR3 and completely rebuilding my IKEv2 tunnel to Azure with a new IPSEC profile I've had good results. The pre-built Azure ipsec profile that came with one of these MR's doesn't work at all - doesn't even reflect the requirements M$ themselves have published.

I'm not touching mine until it seems stable enough to be ready to try redundant tunnels - at this point seems like it would just drag me into another week of pain.

Matt Webb said:

I can't reiterate Ryan's point here enough. Many of us have been working with firewalls and vpn concentrators for a long time. I can't remember the last time I was uncomfortable heading out of town because of such a device and whether it would require hands-on support.

Personally, after moving to MR3 and completely rebuilding my IKEv2 tunnel to Azure with a new IPSEC profile I've had good results. The pre-built Azure ipsec profile that came with one of these MR's doesn't work at all - doesn't even reflect the requirements M$ themselves have published.

I'm not touching mine until it seems stable enough to be ready to try redundant tunnels - at this point seems like it would just drag me into another week of pain.

 

I completely agree with this assessment of the way Sophos support deals with issues. They lay the responsibility on the user for their terrible products.  I have been, and continue to be, in the same situation where logs are requested and sent but no suggested action or resolution ever comes in return.  Logs are requested several times even though they have been provided.  I've even been told they cannot help me with out logs...for a case where the device was not able to be accessed!  Also, I've never experienced a tech support policy of providing logs as a requirement for a case to be escalated.  In most cases based on my 20 years of network experience, escalation is based on priority, how many users are affected, etc...but Sophos says they won't escalated cases without logs...weird.

At best, on some issues I have been given temporary workarounds that are indicated by tech support to be resolved issues.  THERE IS A HUGE DIFFERENCE BETWEEN A WORKAROUND AND SOLUTION.  At least to most IT professionals this is the case, but not so with Sophos Tech Support.

The vast majority of my issues with my XG unit go unresolved and I just move on as best as I can.