Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 2 replies
  • Answers 2 answers
  • Subscribers 27 subscribers
  • Views 4791 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Establishing Ipsec vpn site to site between Sophos Xg135 and Cyberoam CR25ing

Mahammed Mahad

Salutations to the Community,

I have been trying to connect two branches of the company I work for using IPsec site to site. On Head office I have Cyberoam CR25ing and Sophos XG135 on the other office. I have tried suggestions such as https://community.sophos.com/kb/en-us/123600   and https://community.sophos.com/kb/en-us/123138  and  https://community.sophos.com/kb/en-us/127997  to no avail.

I would highly appreciate  for an advice on this.



This thread was automatically locked due to age.
  • 0

    Hi Mahammed,

    There should be a policy mismatch between the two IPSec profiles on each end. You can look at the IPSec log in the log viewer and if you see a line that has, "invalid proposal" then you need to match the two policies. 

    Thanks

  • 0 in reply to sachingurung


    That knowledgebase gets you 80% of the way to a working vpn, depending on your firmware and setup. I tried that over and over and it failed repeatedly because I didn't yet know the following bits.

    Once you do that knowledgebase step by step... then I did this

    community.sophos.com/.../123600

     

    once you have done all of that, and still can’t connect, you want to do 2 things. First, on the cyberroam go to VPN ->policies (you will see a rundown of all the columns for each ipsec policy, be sure to ADD column to see all, OR you can choose to click on the policy your vpn is using.

    on the Sophos go to VPN -->IPSEC Policies and look at the policy the vpn is using

    THESE two policies need to be IDENTICAL. What I did was on the sophos, I created a new policy and made it exactly like the Cyberroam, since “branchheadoffice” policy did not match the ‘branch remote office’ policy.

    as you’re doing this, you can see which part of the process is failing if you SSH into your sophos, open advanced terminal (option 5, option 3) and look at the log tail -f /log/charon.log (this will tell you where in the negotiation you’re seeing a failure)

    So after making the two policies IDENTICAL, and changing the sharedkey to be identical, and all of that, I still couldn’t connect until, on the Sophos, I set the key exchange to IKE V1.

    Suddenly the vpn could finally connect and all started working.

    Hope that helped.