Strange connectivity drops after some time over ipsec site2site

[hade94]

Hi guys,

I've encountered a strange phenomenal at a customer site.

There is a IPSec Site2Site connection to a sophos utm firewall located in the hq. The device at the remote office loses connection to the main site after some time. After restarting the opnsense (23.7.2-amd64), the in and outbound state in the firewall=>diagnostics=>session page show "ESTABLISHED:ESTABLISHED" in both directions.

When the connection fails, the outbound session is in state "CLOSED:SYN_SENT" while the inbound state is still in "ESTABLISHED:ESTABLISHED" state. Also the outbound session is associated with the "Default allow LAN IPv6 to any rule" while the inbound is associated with "Default allow LAN to any rule". Beside the fact that the device has only an ipv4 address internally. After all, pings and other protocols like https are working.

Any idea what is wrong?