Hej,
now that MR-1 has appeared, I wanted to ask when MR-2 will appear? The problems and instabilities of IPSec in v17 (especially in connection with V16.5) are very annoying.
This thread was automatically locked due to age.
Hej,
now that MR-1 has appeared, I wanted to ask when MR-2 will appear? The problems and instabilities of IPSec in v17 (especially in connection with V16.5) are very annoying.
For users continuing to see IPsec site-to-site VPN issues on v17 MR-3, please contact Support and open a ticket to provide logs & report possible BUG. Once you do please provide me with your case ID so I can be sure that the case is escalated.
For non-licensed users, please share or DM me the following information:
We appreciate all your feedback.
Thanks,
Karlos
I want to add that we had to switch back to a cisco device at this remote location today because of lack of stability on the sophos. If you need somethign from the system it will have to wait until tomorrow. I did upload the charon.log file from yesterday as part of my case though.
-Scot
I've done that several times if you look further back through the case. Support keeps asking me for the same thing. The tunnel goes down every few hours and I've gotten them in many times to look at it. I've sent them logs, the whole works. I can't keep wasting my time helping them debug their broken code. I've been trying applying the maintenance releases as they've come out and reporting back that they make things worse. I can't sit around all day wasting my time on this with support. I have a job to do that should not involve sitting waiting to see when the new appliance I just bought is going to fail.
I can't reiterate Ryan's point here enough. Many of us have been working with firewalls and vpn concentrators for a long time. I can't remember the last time I was uncomfortable heading out of town because of such a device and whether it would require hands-on support.
Personally, after moving to MR3 and completely rebuilding my IKEv2 tunnel to Azure with a new IPSEC profile I've had good results. The pre-built Azure ipsec profile that came with one of these MR's doesn't work at all - doesn't even reflect the requirements M$ themselves have published.
I'm not touching mine until it seems stable enough to be ready to try redundant tunnels - at this point seems like it would just drag me into another week of pain.
I just wanted to add a few data points for the Sophos Engineers.
I've got two Sophos XG 135's that both connect via encrypted GRE tunnels back to the same cisco router at main data center.
The one that the VPN goes up and down more than a yo-yo is on a PPPoE DSL link that is in the middle of nowhere (4Mbps down and perhaps 750 up) which shows slight packet loss from time to time (0%-3.0%) VPN goes down maybe 3-10 times a day. 80% of the time the connection will come back up, 20% some of the SA's remain down or all are down. While I understand there is some packet loss, the cisco router(the replacement for the sophos on the remote end) still keeps the tunnel up and passes traffic. Perhaps the Sophos is not that forgiving when it tries to recover compared to the cisco.
The other XG is at my house. That is on a nice cable modem connection with Spectrum. I have 100Mbps down and 5Mbps(I think) up. This connection perhaps drops its ip sec SA's maybe once or twice a week at most(some weeks not at all) and always come backs up without issue. A lot better than the DSL connection.
Cheers,
-Scott
I just wanted to add a few data points for the Sophos Engineers.
I've got two Sophos XG 135's that both connect via encrypted GRE tunnels back to the same cisco router at main data center.
The one that the VPN goes up and down more than a yo-yo is on a PPPoE DSL link that is in the middle of nowhere (4Mbps down and perhaps 750 up) which shows slight packet loss from time to time (0%-3.0%) VPN goes down maybe 3-10 times a day. 80% of the time the connection will come back up, 20% some of the SA's remain down or all are down. While I understand there is some packet loss, the cisco router(the replacement for the sophos on the remote end) still keeps the tunnel up and passes traffic. Perhaps the Sophos is not that forgiving when it tries to recover compared to the cisco.
The other XG is at my house. That is on a nice cable modem connection with Spectrum. I have 100Mbps down and 5Mbps(I think) up. This connection perhaps drops its ip sec SA's maybe once or twice a week at most(some weeks not at all) and always come backs up without issue. A lot better than the DSL connection.
Cheers,
-Scott
Hi Scott,
Scott_D_L said:The one that the VPN goes up and down more than a yo-yo is on a PPPoE DSL link that is in the middle of nowhere (4Mbps down and perhaps 750 up) which shows slight packet loss from time to time (0%-3.0%) VPN goes down maybe 3-10 times a day. 80% of the time the connection will come back up, 20% some of the SA's remain down or all are down. While I understand there is some packet loss, the cisco router(the replacement for the sophos on the remote end) still keeps the tunnel up and passes traffic. Perhaps the Sophos is not that forgiving when it tries to recover compared to the cisco.
can you please PM me more details about your Sophos XG which is sitting in the middle of nowhere. I am particularly interested in the IKE version you are using.
And indeed, its correct that it may be that Sophos is currently not that forgiving when it comes to bigger/longer packet loss situations. This will further improve with MR5 and later.
On the other hand it depends also on the configuration how hard Sophos XG will try to reestablish a connection. 'Keying tries' and dpdaction are the two main values to be adjusted correctly in the Policy.
I'll say for me this is not the case. Both ends have stable, high bandwidth fiber connections. I also have been monitoring the outside interface of the Cisco ASA on the other end of the tunnel using Solarwinds on the Sophos UTM side, and see no slowdown or packet loss when these drops are happening. I have my tunnel set to reinitiate, and the rekey setting is 0 which is supposed to give it unlimited retries.
Also not the case for me either. With 17mr3 I had these ikev1 issues but I have a stable 175 Mbps down and 30 Mbps up on my end, and the other end has at least that maybe more. During troubleshooting I was Running a continuous ping with my laptop hooked directly to the modem for 2 days, no packet loss. I also had my ISP run a ping from their end. No packet loss 48 hours, but tunnel went down at least 50 times.
