Release of v17 MR-2?

For users continuing to see IPsec site-to-site VPN issues on v17 MR-3, please contact Support and open a ticket to provide logs & report possible BUG. Once you do please provide me with your case ID so I can be sure that the case is escalated. 

For non-licensed users, please share or DM me the following information: 

• logfiles from the time frame when the Problem happens (/log/charon.log)
• screenshots of the Connection config
• screenshots of the Policy used in the Connection
• charon related coredumps from /var/cores (if any)

We appreciate all your feedback.

Thanks,
Karlos

I've had case #7758347 open for a while trying to work on this. Unfortunately I replaced a Cisco ASA with a Sophos appliance already running v17 on the other side of the country. Debating whether or not to wait for a fix or go ahead and fly out there and go through the process of downgrading to 16, which essentially does a factory reset, or just stick the ASA back in place and ask Sophos for my money back. I have another identical Sophos UTM running at another datacenter in another state with v16 that isn't experiencing any of these issues.

Our issue is that every few hours one of our main ipsec tunnel will drop and doesn't come back up unless someone resets it on our end. My current workaround is that I have Solarwinds monitoring devices on the other end of the tunnel. When Solarwinds loses that connection it kicks off a script using Devolutions RDM to open an ssh session to the UTM and restart the VPN service. This obviously isn't a doable workaround for everyone.... and still causes a lot of issues for us since we have a lot of realtime data coming across that tunnel. So every time it drops is trouble.

MR2 and MR3 cause the tunnel to completely stop working. So right now I'm stuck on MR1 because that seems to be the only spot where the tunnel at least works. 17 GA had a bug that caused the UTM to become unresponsive and we kept having to do hard resets on it, by shutting off power to it from the PDU it's plugged into. But the tunnel seemed to be stable on GA. MR1 seemed to be where the IPSEC issues started for me. But I'm in between the rock (UTM becoming completely locked up) and the hard place (the tunnel randomly dropping).

That was not the case for me Matt. This was a new install. I was not running 16 at any point on this UTM. I have also recreated the tunnel many times with support, and continue to have the issue. 

Is StronSwan that bad ?  I would like to hear.

On paper, I would say it is sexy.  At least I like this part:

• Storage of RSA private keys and certificates on a smartcard (PKCS #11 interface) or protected by a TPM 2.0

Now is there a TPM in a XG210 ? I will have to check.

What I realize over time, is Sophos uses open source at many places.  For example, AP55C runs OpenWRT. https://openwrt.org/

Paul Jr

I don't think it's good or bad... it have been so badly implemented !!!

Many of us here tried to run IPSEC vpn between sophos in fresh v17 and it doesn't work !

haw can it be possible to don't release 4 version without ANY improvements of a problem, so simple to reproduce ????

Same with me.! Brand new hardware, shipped with 17mr3, first one ever and i nearly dropped XG that fast, but downgrade works perfectly so I'll stick around

Interesting. I will say that beyond re-creating the tunnels I had to fiddle around with a few different ipsec profiles before I found an encryption set that worked with Azure. I had also created a custom profile in Azure via powershell to ensure it matched what I had configured on the XG. I get a tunnel down/up notification daily but connectivity doesn't seem interrupted, indicating the issue (for me anyway) in this regard is related to the monitoring/notification in the XG.

Any way you shake it it seems unreasonable to me that we should even be having these discussions about an enterprise next-gen firewall running GA or MR software. Beta sure, but not production.

How did you figure this out?? I do recall the Sophos support engineer a few weeks ago running strongswan commands for hours on my firewall over ssh and I didn't know what that is but I thought it was just a funny command for a WAN or something.

I just booked a flight to go out and downgrade the UTM's in our datacenter this weekend. I'm done sitting around waiting on support to offer a solution. Really disappointed in Sophos. 

You'll want to get familiar with these commands: https://wiki.strongswan.org/projects/strongswan/wiki/IpsecCommand

And also you'll be reviewing the charon.log file in /logs frequently until you can get the thing to be stable.

Hi Ryan,

I have followed-up with your Support Ticket and the case owner will reach out to you today. If you haven't done so yet, please send over your logs from the ASA, if possible.

Thanks,
Karlos

Karlos,

I do not have access to the logs on the ASA. The ASA is managed by another company, and their security is dictated by Homeland Security. They will give me a verbal description of what they are seeing on their side in the logs, but getting something like actual logs is like pulling teeth. The one thing that I know is that this vpn tunnel worked when I was running an ASA on my side, it worked from another SG310 running UTM 9, it worked from another SG310 running XG 16. The only thing that it has issues with is XG 17.

Karlos,

I do not have access to the logs on the ASA. The ASA is managed by another company, and their security is dictated by Homeland Security. They will give me a verbal description of what they are seeing on their side in the logs, but getting something like actual logs is like pulling teeth. The one thing that I know is that this vpn tunnel worked when I was running an ASA on my side, it worked from another SG310 running UTM 9, it worked from another SG310 running XG 16. The only thing that it has issues with is XG 17.

I will add that the company that manages the ASA has been working with Cisco support since this began and Cisco has checked everything with their configuration, and Cisco support did review their logs and has said that they were unable to find any issues on their end.