Sophos XG Azure Site-to-Site to Point-to-Site routing issue

Prob the case but the Point to site VPN is setup to use the default gateway on the VPN right?

Can you post your Firewall rules on Azure pls?

Anyreason why your not using SSL VPN? Sorry are you using XG Azure appliance?? Or out the box Azure VPN's?

Ta

JK

Hi John

hanks for your reply.. The P2S VPN by default is "force tunneled". Take a look at the config below when dialed in:

Route print shows:

 Firewall rules as follows:

SSL VPN is simply not secure enough for the client.

Darren

Dont know about not sucure but its the clients decisions i find. lol!

So do you use XG Azure Appliance then? Or standard Azure VPN? Either way do you have the used Subnets setup at each point as each point in the link will need to know the subnets you want routed.  So the Site to Site has to have the subnets used in the Site to Point and vice versa?? Have you got those in??

Sorry just trying to get my head round your setup, I can def advise Azure XG appliance as i know from experience Azure VPNs are a pain.

JK

Ours is not to reason why :-)

It's a dedicated box Caswell CAR3000 with 6x 1Gbe built in.

Darren

Ours is not to reason why :-)

It's a dedicated box Caswell CAR3000 with 6x 1Gbe built in.

Darren

OK, can you send your XG VPN config do you think?

You only have 1 route table there but can i assume it matches at each point then right??

Thanks

JK

sorry think ive missed something?? Are you going from XG on prem to Azure XG to end user point vpn??

Here you go: Hope this is what you're after

Really appreciate you taking the time to look at this.. :-)

Hi John..

Sorry my bad explanation.. It's on-prem XG t Azure Virtual Network Gateway then back out to the P2S client..

Darren

OK so your remote networks on XG add the point to site subnets too then on Azure S2S you need to then add the additional subnet to its local networks so the vpn there connects.  Then you need to do the same on the other side. point to site add the xg subnets on the azure end if you get what i mean..

As long as both sides on the Azure part has the subnet of both vpns it should work. sorry if im being vague, if you can wait till i get through my morning emails ill draw it on ur diag.

To add you will change the XG firewall rules to match.

JK

Splendid.. Really appreciate that.. I have tried adding the VPN pool address range ito the remote subnet of the IPSEC VPN and it refuses to accept it but I my be doing that incorrectly.. Drawing it into the diagram would be great thanks..

TIA

Darren

TBH never set BGP up so cant add to that, but the way i mentioned is the manual method to set that up without needing BGP.

When you added the extra Remote subnet on XG did you also add that into the S2S vpn setup on Azure as it has to match or the VPN wont connect.

Azure VPNs are very fiddly anyway, you would do yourself a favor if you could setup an Azure XG Appliance.....  Would def simplfy things....

Hi John..

Where would I add that in Azure? On the Virtual Network Gateway?

Darren