Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 2 subscribers
  • Views 4766 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN connection not working between sophos SG210 and pfsense

Ebin A

VPN connection not working between sophos SG210 and pfsense.It was working fine, but suddenly stopped working. No changes were made.It looks like phase 1 is connected, but phase 2 is failing. Any help is appreciated.

 

The following is log from Sophos.

 ERROR: "S_Tunnel x " #8: sendto on eth1 to xxx.xxx.xxx.xxx:500 failed in main_outI1. Errno 1: Operation not permitted

 added connection description "S_Tunnel x"
 
 
 received Vendor ID payload [XAUTH]
received Vendor ID payload [Dead Peer Detection]
received Vendor ID payload [RFC 3947]
enabling possible NAT-traversal with method 3
NAT-Traversal: Result using RFC 3947: no NAT detected
Peer ID is ID_IPV4_ADDR: 'x.x.x.x'
Dead Peer Detection (RFC 3706) enabled
ISAKMP SA established
 initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP {using isakmp#8}
 initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP {using isakmp#8}
id="2203" severity="info" sys="SecureNet" sub="vpn" event="Site-to-site VPN up" variant="ipsec" connection="Tunnel LV-SG" address="xx.xx.xx.xx" local_net="x.x.x.x" remote_net="x.x.x.x/24"
"S_Tunnel x" #9: sent QI2, IPsec SA established {ESP=>0xc8fd185b <0x251334f2 DPD}
 
"S_Tunnel =x" #10: sent QI2, IPsec SA established {ESP=>0xcfbbcfc2 <0x25f7b6c5 DPD}
ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0x251334f2) not found (our SPI - bogus implementation)
ignoring informational payload, type INVALID_PAYLOAD_TYPE
 


This thread was automatically locked due to age.
  • 0

    Please edit your post and replace the log lines as follows:

    1. Disable the IPsec Connection.
    2. Ensure that debug is NOT enabled.
    3. Start the IPsec Live Log.
    4. After the Live Log has populated a few lines, enable the IPsec Connection.
    5. Beginning with the line after the IPsec Connection was enabled, select about 60 lines that include when the connection died.
    6. Obfuscate IPs like 172.x.y.1, 118.x.y.88, etc.  Leave the date and time in place.  Replace the hostname with something like secure.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML