Release of v17 MR-2?

Same with me.! Brand new hardware, shipped with 17mr3, first one ever and i nearly dropped XG that fast, but downgrade works perfectly so I'll stick around

Interesting. I will say that beyond re-creating the tunnels I had to fiddle around with a few different ipsec profiles before I found an encryption set that worked with Azure. I had also created a custom profile in Azure via powershell to ensure it matched what I had configured on the XG. I get a tunnel down/up notification daily but connectivity doesn't seem interrupted, indicating the issue (for me anyway) in this regard is related to the monitoring/notification in the XG.

Any way you shake it it seems unreasonable to me that we should even be having these discussions about an enterprise next-gen firewall running GA or MR software. Beta sure, but not production.

How did you figure this out?? I do recall the Sophos support engineer a few weeks ago running strongswan commands for hours on my firewall over ssh and I didn't know what that is but I thought it was just a funny command for a WAN or something.

I just booked a flight to go out and downgrade the UTM's in our datacenter this weekend. I'm done sitting around waiting on support to offer a solution. Really disappointed in Sophos. 

You'll want to get familiar with these commands: https://wiki.strongswan.org/projects/strongswan/wiki/IpsecCommand

And also you'll be reviewing the charon.log file in /logs frequently until you can get the thing to be stable.

Hi Ryan,

I have followed-up with your Support Ticket and the case owner will reach out to you today. If you haven't done so yet, please send over your logs from the ASA, if possible.

Thanks,
Karlos

The only issue I have had with V17 MR1,2 and 3, is recreating the VPN profiles/encryption each time, but then stable.

This has been XG to XG for our Norwich to London site to site, but I also have a 105w running at home that has VPN to both sites. All 3 have been solid.

Wont make a load of you happy on here, but I am having nothing but good support from the support guys. Having met some of the guys that have the XG in their blood, I know this will be frustrating for them, and they are doing what they can.

I do have a virtualised environment too for testing with as much detail as I can including VPNs etc. I dont know anything about cisco gear but are there any options for those with Cisco kit to simulate the routers/firewalls so you are not exposing real world kit/connections??

Karlos,

I do not have access to the logs on the ASA. The ASA is managed by another company, and their security is dictated by Homeland Security. They will give me a verbal description of what they are seeing on their side in the logs, but getting something like actual logs is like pulling teeth. The one thing that I know is that this vpn tunnel worked when I was running an ASA on my side, it worked from another SG310 running UTM 9, it worked from another SG310 running XG 16. The only thing that it has issues with is XG 17.

I will add that the company that manages the ASA has been working with Cisco support since this began and Cisco has checked everything with their configuration, and Cisco support did review their logs and has said that they were unable to find any issues on their end.

To all others that have issues with this, by chance are you using any special characters in your PSK? I had them in my PSK all along before I gave up and downgraded to 16.5.. (still using special characters with no issues in 16.5...).. I just came across this thread community.sophos.com/.../361180 in which Support said that they cause issues and were supposed to be fixed in MR-2. (Ticket NC-23039) was supposed to be fixed in MR-2 but I don't see any mention of it in the release notes of MR-2 or MR-3 even.