XG to XG RED VPN With Multiple WAN interfaces

I guess, you cannot perform 4 tunnels, but 2. 

The point is, XG is using a Random Outbound IP, if not specify via CLI.

https://community.sophos.com/kb/en-us/122999

But this command relies on the destination.

So basically you cannot use it 4 times to bind it properly. 

Hi LuCar Toni,

Thanks by your response.

Well, I already suspected this, but I would like to confirm :)

I would be interesting has a option to bind it.

Best regards

Carlos

Hi Cenk Tezdiyar tahnk yu by your feedback.

Weel, and how can I do the following as LuCar told

Head office Port WAN 1 ------------ Branch office Port Wan 1

Head office Port WAN 2 ------------ Branch office Port Wan 2

I tried setup firewall rules on Head office allowing the specific traffic comming Branch office port Wan 1 to Head office Port WAN 1 to portas 3400 tcp and 3410 udp, but it seeems there are a global rule that allowing it. 

I cannot control this traffic.

Any tip!?

Regards

Carlos

You have to build up two tunnels.

Tunnel1: XG A is Server, XG B Client. 

Tunnel2: XG a is Client, XG B is Server. 

https://community.sophos.com/kb/en-us/125101

Client will Always connect. So Basically XG waits on all Interfaces for a Port 3400 connection. 

You have to Control the Client Site, which interface should be used "outbound". 

The KBA has a small note:

• If the RED server firewall have more than one WAN interface, a sys-traffic-nat rule is necessary to force a correct NAT for the RED server firewall. This can be done in the XG Firewall's console.
  
  

https://community.sophos.com/kb/en-us/122999

This will more or less build up a redundancy in most scenario. 

Hi LuCar,

Thanks again by your great sugestion.

But sys-traffic-nat, or even static route does not work as expected with RED connections.

Even using sys-traffic-nat or static route on client side, the RED connect by other WAN interface (outbound interface).  The RED connections does not respect this.

Best regards

Carlos

I recently deployed this setup.

Can you post your sys-nat rule? What did you insert into this rule? 

Hi LuCar,

Sure....

On Client Side

sys-nat rule

Network interfaces

On Server Side

As you can see the remote Ip address online is the IP address from Interface port B

regards

CArlos

Hi folks.

Any tip!?  :)

Regards

Carlos

I assume 45. is your other XG? 

Your other XG has one or two Interfaces? 

Did you already verify via tcpdump, that this rule is not hitting / working? 

LuCar

The 45. is my client side that I would like that Red Tunnel usage as outbound  :)

the Both XG had two WAN interfaces

Yes, with tcpdump on server side I can see traffic from my CLient side using the both WAN address, it seema Red Unnel ignore SNAT rule and choose randon the output interface.

Regards

Carlos

You need to setup this sys-nat rule from the Client side, because the client will actually start the connection. 

From Client, you are forcing XG to build up the Connection anyways with the GUI option. 

LuCar,

After several tests and contact with Sophos Support - Ticket  #8799470

I was informed that is not possible control the Client Outbound interface.

>> Hi Carlos as we discussed that in scenario of site to site RED tunnel it would not be possible to control outbound traffic on client side of RED tunnel.

This is really so bad to this scenario. :(

Regards

Carlos

LuCar,

After several tests and contact with Sophos Support - Ticket  #8799470

I was informed that is not possible control the Client Outbound interface.

>> Hi Carlos as we discussed that in scenario of site to site RED tunnel it would not be possible to control outbound traffic on client side of RED tunnel.

This is really so bad to this scenario. :(

Regards

Carlos

I am not quite sure about this answer. Currently i have no access to any ressources within Sophos but you should discuss this with Support. 

FloSupport Could you please review this case?

I am quite sure, this should be possible. 

Hi Carlos Cesario 

I've located your support case and reviewed the activities.

It was mentioned during your troubleshooting session a static route and a sys-traffic-nat route NAT policy were both created in an attempt to configure the outbound interface for RED tunnel establishment, however without success. Is this correct?

I'll also follow up with my team in the meantime to clarify the expected behaviour.

Hi FloSupport 

Yes, you are right.

After troubleshooting session, static route, sys-traffic-nat route NAT policy it was applyed with no success.

And according the support after double check it is not possible.

Regards

Carlos

Hello FloSupport 

Have you any news about this thread!!!?

Regards

Carlos

Hi Carlos Cesario 

Apologies for this inconvenience, I would advise creating a suggestion for this feature request on our Sophos Ideas page for visibility to our product team.

Regards,

Hi FloSupport 

This is so bad, anyway I willl create a feature request

Best regards

Carlos

Already there is an feature request for this

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/31790149-red-xg-to-xg-client-side-multiple-wan-link-fail-ov

Carlos

https://community.sophos.com/products/xg-firewall/f/vpn/96722/xg-to-xg-with-multi-wan/359076

Hi onward 

Thanks by this. 

It seems this already have a long time as discussion. As other missing features.

Regards
Carlos