This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG to XG RED VPN With Multiple WAN interfaces

Hi folks,

Could someone has ideia if is it possible create a RED VPn between XG devices using multiple WAN interfaces in Branch and Head office ?

eg.

H.O WAN 1 ---------------RED TUN 1---------------------------- B.O WAN 1

H.O WAN 1 ---------------RED TUN 2---------------------------- B.O WAN 2

H.O WAN 2 ---------------RED TUN 3---------------------------- B.O WAN 1

H.O WAN 2 ---------------RED TUN 4---------------------------- B.O WAN 2

Best regards

Carlos

This thread was automatically locked due to age.

0 Carlos Cesario over 6 years ago in reply to LuCar Toni

Hi LuCar,

Sure....

On Client Side

sys-nat rule

Network interfaces

On Server Side

As you can see the remote Ip address online is the IP address from Interface port B

regards

CArlos
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Cesario over 6 years ago in reply to Carlos Cesario

Hi folks.

Any tip!? :)

Regards

Carlos
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 6 years ago in reply to Carlos Cesario

I assume 45. is your other XG?

Your other XG has one or two Interfaces?

Did you already verify via tcpdump, that this rule is not hitting / working?
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Cesario over 6 years ago in reply to LuCar Toni

LuCar

The 45. is my client side that I would like that Red Tunnel usage as outbound :)

the Both XG had two WAN interfaces

Yes, with tcpdump on server side I can see traffic from my CLient side using the both WAN address, it seema Red Unnel ignore SNAT rule and choose randon the output interface.

Regards

Carlos
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 6 years ago in reply to Carlos Cesario

You need to setup this sys-nat rule from the Client side, because the client will actually start the connection.

From Client, you are forcing XG to build up the Connection anyways with the GUI option.
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Cesario over 6 years ago in reply to LuCar Toni

LuCar,

After several tests and contact with Sophos Support - Ticket #8799470

I was informed that is not possible control the Client Outbound interface.

>> Hi Carlos as we discussed that in scenario of site to site RED tunnel it would not be possible to control outbound traffic on client side of RED tunnel.

This is really so bad to this scenario. :(

Regards

Carlos
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 6 years ago in reply to Carlos Cesario

I am not quite sure about this answer. Currently i have no access to any ressources within Sophos but you should discuss this with Support.

FloSupport Could you please review this case?

I am quite sure, this should be possible.
Cancel
Vote Up 0 Vote Down

Cancel
0 FloSupport over 6 years ago in reply to LuCar Toni

Hi Carlos Cesario

I've located your support case and reviewed the activities.

It was mentioned during your troubleshooting session a static route and a sys-traffic-nat route NAT policy were both created in an attempt to configure the outbound interface for RED tunnel establishment, however without success. Is this correct?

I'll also follow up with my team in the meantime to clarify the expected behaviour.
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Cesario over 6 years ago in reply to FloSupport

Hi FloSupport

Yes, you are right.

After troubleshooting session, static route, sys-traffic-nat route NAT policy it was applyed with no success.

And according the support after double check it is not possible.

Regards

Carlos
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Cesario over 6 years ago in reply to Carlos Cesario

Hello FloSupport

Have you any news about this thread!!!?

Regards

Carlos
Cancel
Vote Up 0 Vote Down

Cancel