Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 29 subscribers
  • Views 7744 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Why no inbound traffic on an IPsec site-to-site VPN using pre-shared key between SOPHOS to Sonicwall

Charles Ross

Hello,

 

We have an IPSec site-to-site VPN which is Active and Connected but we're not getting any inbound traffic, we can't ping from the Remote to any Local IP's but it works the other way around.

Tried a bunch of different combinations of Policy settings, most do not connect and none allow us to receive inbound traffic. Searched the forums, made sure everything is setup correctly to the best of our knowledge, proper firewall rules are set.

Any help would be greatly appreciated,

Thanks in advance.

 

Local Firewall is a SOPHOS XG 105 and Remote is a Sonicwall TZ 400

Policy settings:

Firewall Rules:



This thread was automatically locked due to age.
  • 0

    This may be usefull

     

    one side of the tunnel should be in “Respond Only” mode and the other side should be in “Initiate the Connection”

    Dead Peer Detection one side of the tunnel has the DPD set to “Disconnect” and the other side needs to be set to “Re-Initiate”. 

     

    Double check the firewall policies on the non-Sophos end

  • 0

    Did you ever figure this out? I have the EXACT same issue - Xg210 and Sonicwall TZ300 - I can ping from xg to sonicwall no problem, but when I try Sonicwall to XG no ping, no IP resolve, nothing works. I've tried every setting I can find, Changed all the IPsec profile options, tried every combination of encryption, still no results. I've tripled verified my subnets and ip ranges/networks...no luck...

     

    Did you come across a solution?

  • 0 in reply to Travis McDonald

    Hi,

    always recommend to perform a tcpdump and drop packet capture.

    tcpdump -ni any icmp

    drppkt

    Both applies for advanced shell.

     

    And verify everything. Sometimes, the traffic does not arrive on XG, sometimes XG sends the correct traffic but does not get any reply etc.

     

    Cheers