In this example, an IPSec connection is established between an XG and a 3rd-party

appliance, the connection is established and the traffic is flowing, but after
sometime the traffic stops flowing.

Investigating the issue, the ipsec statusall command shows that the IPSec SAs are
established and the ip xfrm state shows that the transformation sets for the VPN
are present.

In such a situation, chances are that the IPSec lifetimes are not matching between
the peers and one of them re-key the ESP encryption secrets before the other peer
allows it.

This example requires that both the peer administrators double-check that the
lifetimes are correct and are based only on lifetimes. Sophos XG doesn't support
traffic-based re-keying so the remote peer must not have it enabled (an issue
especially seen when the remote peer is a Cisco ASA or a Cisco Router).