Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 9 replies
  • Subscribers 5 subscribers
  • Views 10544 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

S2S VPN goes down after 24hrs

BobbyDigital

All,

I am currently on Firmware version 9.403-4 and I am experiencing a weird issue with my IPSEC site to site. after being up for 24hrs or a little more the connection drops. No changes, no nothing to the firewall policy or anything. 

If fails with the following error : initial Main Mode message received on x.x.x.x:500 but no connection has been authorized with policy=PSK

Now that error is weird because it was connected and working with no problems the entire day. 

Also, so far the only way for me to resolve the issue is to REBOOT the sophos firewall.

Any assistance would be greatly appreciated.



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to BobbyDigital

    Please insert pictures of the Edits of your IPsec Connection, Remote Gateway,  the Policy in use and of the top four sections on the 'Advanced' tab.  Also, the same information for the pfSense.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    I may be facing a similar issue on my box... After 2 or 3 days I am no longer able to VPN into my box. I also found that the logs for IPsec completely stopped after IPsec stopped responding. Only way to fix the problem is rebooting as well. Sophos support enabled debugging for IPsec and naturally the problem didn't happen for 2 weeks. 3 day days after we disabled debugging and closed the case IPsec dropped dead again.

    By any change have seen any port scans or other attempted intrusionsd on your system around the same time IPsec fails? About 50% of the time my IPsec is failing there's a port scan originating from Shodan.

Unfiltered HTML