Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 3 subscribers
  • Views 7060 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to Site IPSec tunnel disconnects one every 24 hours, why?

ErikFranzen

Site-to Site IPSec tunnel disconnects one every 24 hours, why?

I have two questions related to IPSec VPN.

I have two Sophos UTM using home license, version 9.403 with an IP sec tunnel between. I have changed IPSec VPN settings to use own certificates instead of RSA key. I have set Pre Shared Key Settings on the advanced tab to use the same email-address on both ends.

utm1.mydomain.com is the initiator and utm2.mydomain.com is the responder. I am using DNS in UTM to resolve IP-address to internal addresses. utm1.mydomain.com resolves to 192.168.1.1 and utm2.mydomain.com resolves to 192.168.2.1.

Since the IPSec set up for the initiator must use the public IP-address of the responder, I have created bastion2.mydomain.com in the initiator to be set to the responders public IP.

Question 1: The responder is using dynamic DNS and I have not found any way to make the initiator UTM look up the public IP address for bastion2.mydomain.com using public DNS since UTM is configured with all other internal DNS records for my domain. How can I sort this out automatically? Today I configured the public IP address for bastion2.mydomain.com in UTM internal DNS statically since the public IP-address of bastion2.mydomain.com is seldom changed.

Creating a DNS host network definition does not work since the UTM is handling other hosts for the domain in its own DNS.

Question 2: After switching to use own certificates instead of RSA key the tunnel disconnects once every 24 hours. To reconnect the tunnel, I log in into the initiator and toggle “Enable probing of preshared keys” setting on the Advanced tab. After doing that, the tunnel reconnects automatically. How can I get solve this?

The tunnel is currently using AES-256 PFS (ACC). I have also tried AES-256 PFS with compression on. Same problem exists.



This thread was automatically locked due to age.
Parents
  • 0

    Erik, you have three different questions there.

    Let's work on "Site-to Site IPSec tunnel disconnects one every 24 hours, why?" here.  Please move the other questions each to its own thread.

    Is the disconnect at the same time every day?  Does the tunnel immediately re-establish?  Please insert a picture of the Edit of the IPsec Policy used.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0

    Erik, you have three different questions there.

    Let's work on "Site-to Site IPSec tunnel disconnects one every 24 hours, why?" here.  Please move the other questions each to its own thread.

    Is the disconnect at the same time every day?  Does the tunnel immediately re-establish?  Please insert a picture of the Edit of the IPsec Policy used.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • 0 in reply to BAlfson

    I found one error. It was my certificate, I have created my certificates using an emailaddress as VPN-ID which was not the same as I inserted in the Preshared Key Settings under the advanced tab. Changing preshared key settings in the advanced tab and selecting "Enable probing of preshared keys" on both peers solved this issue. However, according to the manual I should not need to select "Enable probing of preshared keys" on the initiator, so it is a bit strange. Therefore I suspect this issue is not 100 % solved yet.

    My ISP (the initiator is connected via LTE) is resetting the network each 23 hours. After the reset, the tunnel will not automatically reconnect.

    I suspect that this can be related to my certificates and the preshared key. I have now recreated my certificates using Distinguished Name as the VPN-ID and I see if it reconnects in the next 24 hours period.

    I am not sure of how UTM handles a Distinguished Name as the VPN-ID. Will the UTM evaluate (look up) the IP-address behind the hostname (utm1.mydomain.com and utm2.mydomain.com) in the Common Name part of the certificate?

Unfiltered HTML