Hej,
now that MR-1 has appeared, I wanted to ask when MR-2 will appear? The problems and instabilities of IPSec in v17 (especially in connection with V16.5) are very annoying.
This thread was automatically locked due to age.
Hej,
now that MR-1 has appeared, I wanted to ask when MR-2 will appear? The problems and instabilities of IPSec in v17 (especially in connection with V16.5) are very annoying.
Just a quick update. I've been working with the GES team, but so far no changes. I was able to upgrade to MR3 and they got the tunnel to establish. It ran for almost a week and then started disconnecting every few hours. High availability completely breaks the tunnel.
The thing that still seems to work, even though it shouldn't, is that if I switch the ipsec profile from Main Mode to Aggressive Mode the tunnel becomes more stable and will only disconnect about once a day rather than every few hours. This is strange because the ASA on the other end is set to Main Mode, and the vpn profile is not even supposed to be compatible with Aggressive Mode. It actually makes the selection list on tunnel profile blank. So this appears to be a definite bug. We're discussing switching back to Cisco. This issue has become a deal breaker for us.
Anyone else had any luck?
We're in the same boat. Not an ASA but connecting to a Cisco Router at HQ. Disconnects multiple times a day. In our case the tunnel loses some of it's SA's that get established. Out of 9 SA's that are part of the tunnel only one or two show green in the vpn connection and the site goes down. A reconnect will re-establish it, but what a pain in the butt.
If anyone as a rock solid VPN connection to a cisco device I would love to know what configuration you're using.
-Scott
We're in the same boat. Not an ASA but connecting to a Cisco Router at HQ. Disconnects multiple times a day. In our case the tunnel loses some of it's SA's that get established. Out of 9 SA's that are part of the tunnel only one or two show green in the vpn connection and the site goes down. A reconnect will re-establish it, but what a pain in the butt.
If anyone as a rock solid VPN connection to a cisco device I would love to know what configuration you're using.
-Scott
Ryan,
Out of curiosity, do you have overlapping networks between local and remote side of the ipsec connection by chance? For for example:
Lets say at the branch office where the sophos is I've got a 192.168.100.X/24 as the local LAN subnet that's behind the XG. Then on the remote side of the ipsec(cisco at HQ) we've got a 192.168.0.0/16 setup on the cisco. I was just wondering if there's an issue with those overlapping subnets on either end of the connection. I've seen some posts on some of the Strongswan boards about this, but nothing that mentions that the SA's drop off, more of routing issues than anything else.
Thanks,
-Scott
The problem is many of use were waiting eagerly for v17 BECAUSE they brought in Strongswan with IKEv2 - a requirement for route-based tunneling and as such for HA tunnels (to Azure in my case). The only "downgrade" I'll consider, if this doesn't get worked out completely, is to pull the XG "down" from the rack and put something else in its place.
Nothing like that as far as I can tell. Some of our internal subnets do overlap with subnets that that company on the other end uses internally, but none of those are in this vpn profile. But because of that overlap we do have to nat everything on our end. I originally thought something with the nat'ing might be the cause, but after seeing so many others having the same issue that doesn't seem to be the case. But GES has looked over the nat and subnets and doesn't see any issues with the config as far as those are concerned.
The sad thing is that I flew out to our datacenter (it's on the other side of the country) fully prepared to bite the bullet and downgrade. Support talked me out of it and said that all of these issues should be fixed if I could just upgrade to MR3. I upgraded, they got stuff working, and I thought things were good... Until it stopped working again.
I know your comment was in reply to Matt, but I will reply as well. :-) yes I've seen this doc before. The only thing we're not doing on the cisco side of the config is that our cisco guy on my team has the ipsec connection setup in transport mode rather than tunnel. Not sure if that matters. I'm hoping dna will join in this discussion. (I do have a case open that was just escalated to Level 2) about this.
-Scott
Yeah we've kicked that idea around. I get nervous doing something like flashing a system if I'm not standing next to the thing ready to plug into it. I would be happy if Sophos would put out a downgrade option that just kept basic info like network settings intact. Our business runs 24/7 and we pull in a lot of realtime data from SCADA systems over this vpn. So just the downtime required for a downgrade is what we've been trying to avoid. If something went wrong with the downgrade process, the couple of grand for a trip out would probably be worth it to avoid as much downtime as possible. Everything on our network is set up for redundancy. Right now the Sophos is the only thing without HA. We've invested a lot of money into buying things that are supposed to prevent outages, so it's frustrating when one of those things is what's forcing us to shut down.