Share via

vpn time out sophos

soporte 1 Reputation point
2021-06-04T19:35:47.59+00:00

hola,

tengo una vpn en azure y un firewall sophos xg v18, esta vpn esta configurada en ike1 ya que la plantilla azure ike2 de sophos no funciono. una vez es establecida esta vpn se cae la conexion cada 8 horas y tengo que activarla en sophos para que se vuelva a abrir el tunel, el ping extendido de ambos lados actualmente no es la solucion porque igual cae. Yo cambie el tiempo de vida a 24 horas e igual tiene el mismo comportamiento.

Esta vpn no esta realizando trafico constante por los momentos.

Que tipo de trafico es valido para que el tunel no se cierre?
cuando hago un tracert al equipo con la vpn off el tunel muestra ruta desde mi servidor hasta mi firewall y luego pierde la ruta hasta el servidor cliente.

actualmente en sophos la configuracion es

vpn site to site
sophos: respond only.
main mode
ike1
Vida clave
28800
Segundos
Grupo DH (grupo de claves)
Margen de cambio de clave
90
Segundos
Aleatorizar el margen de reintroducción por
100
%

Cifrado
AES256
Autenticación SHA1
Fase 2
Grupo PFS (grupo DH)
Ninguno
Vida clave
27000
Segundos

Cifrado
AES256
Autenticación

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,798 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. msrini-MSFT 9,291 Reputation points Microsoft Employee
    2021-06-07T12:27:52.587+00:00

    @7736 stand,

    I would suggest to find the reason why the connection dropped in the first place. Also try to configure Sophos in both responder/ initiator mode.

    Only with the Sophos logs, I can comment as what is changed and what needs to be tweaked to fix the issue.

    General recommendation is to check if it is due to the rekey or SA lifetime in terms of KB expiration and try to tweak the parameters

    0 comments
  2. soporte 1 Reputation point
    2021-06-07T12:47:22.597+00:00

    thanks team

    On Saturday I changed parameters of the vpn, the documentation indicates that in phase 2 27700 life was placed and sophos was respond only, changing these parameters to 3600 in phase 2 and initiator, the vpn was stable until today.

    Thank you

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.