XG Firewall and offsite AD Domain controller (site to site vpn) AD authentication ssl vpn

Hi, 

you need some CLI Rules for this.

https://community.sophos.com/kb/en-us/123334

Thanks a lot.

The site to site IPSec is already up and running.

I would then need access to the firewall at the datacenter correct to add the cli rules on that end as well.

Thx

Best

Martin

I can simply explain the issue here.

You have a local network A and a remote network b on the other site of your VPN.

XG will build up a route von local network A to remote network B. So basically everything works fine in this scenario. But xg does not build up a route for itself. So all modules, which tries to reach the remote network B does not know, it has to take the VPN tunnel to reach it.

So you will add the route by defining both CLI commends on your XG to teach XG how to reach the remote network B. 

So basically you do not have to do anything on the Datacenter site. Those commands have to deployed on the remote site. 

Perfect, I will try that tomorrorw and thanks a lot.

Best

Martin

Hey again,

sorry I gave the info my network eng and he is still not sure.

So we would need to add the server internal ip (which is in the branch office) with one cli command and then the server ip again and the main branch network correct

for example:

the sophos is in the main office and the server in the data center (branch)

192.168.100.1 sophos main office LAN

system ipsec_route add host <10.0.5.10> tunnelname <branch>

server 10.0.5.10 internal at the dc LAN

set advanced-firewall sys-traffic-nat add destination <10.0.5.10> snatip <192.168.100.1> 

thanks

Yes, this should be right.

In Case of the Tunnel, you are using has also 192.168.100.1 (or 192.168.100.0/24) in it.