alexromp

So after running pcaps from four spots along the connection chain between and including the remote client and the RRAS server, I think I managed to figure this out. We noticed that the UDP NAT entry for the tunnel keepalives would randomly just stop working based on the packet captures. It was on the Sophos XG that was protecting the RRAS server (it's in a perimeter network). I started combing the logs looking for other things that correlated with the timing of the tunnel drops. It could be anywhere from 30 seconds to 30 minutes when it would happen, so it took a few tries. But I found that one of the S2S IPsec tunnels to a vendor was resetting at the same time. Sophos has a somewhat undocumented "feature" where it resets all UDP connections when an IPsec tunnel comes up. No idea why. But anyway, the command to disable it is: set vpn conn-remove-tunnel-up disable You can't even tab-complete that command. It seems to be hidden in the CLI. Once we ran that, the disconnects stopped happening. Just putting this here in case some future person runs into a similar issue, or I can't remember how I fixed it and I find this myself.

Hmm, well the internal routing seems to work well with everything else. The tunnel itself just stops working but "appears" to be connected. All routes are still in place. Also if I leave a ping going, it usually doesn't drop. Was it a route to your VPN client range that needed to be fixed? For your ultimate fix, it doesn't sound like you're routing *through* the XG anymore. So are you just running something like a VpnGw1 VNG in Azure for the P2S IKEv2 tunnels, with an S2S route back to your XG to connect to the corporate resources? Seems like a bit of a workaround.

We're also running into the frequent disconnects on the AoVPN when using DNAT with the Sophos XG. Did you have that problem and were able to solve it, or did you not have it happen? We had the RAS server at one site and it never happened, but when we moved it to the datacenter behind an (what we thought was) identical Sophos, we started having the disconnect issues. I appreciate your help. I was going to DM you, but I'm too new to this site (just registered when I found this thread). Thanks!