Sophos Firewall

Discussions L2TP Remote Access - Mikrotik (Client) Sophos XG (Server)

Sophos Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 8 replies
Subscribers 27 subscribers
Views 4234 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

L2TP Remote Access - Mikrotik (Client) Sophos XG (Server)

Birules over 6 years ago

I am configuring L2TP for VPN with routed link. I'm not succeeding, in packet capture I get the following message:

I enabled all XG side encryptions but I was unsuccessful.

My rules ACL:

I do not understand what may be happening! For a FW Nex-Gen is leaving something to be desired :( :( I hope my opinion is wrong

This thread was automatically locked due to age.

Parents

0 rfcat_vk over 6 years ago

Hi,

your ACL configuration is wrong, with that configuration very little will pass through the firewall regardless of firewall rules eg no web proxy no secure access to the XG GUI.

Are you suing the XG logviewer to determine the failure reasons?

Where is the Mikrotik located?

What version of XG are you running?

Ian
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 rfcat_vk over 6 years ago

Hi,

your ACL configuration is wrong, with that configuration very little will pass through the firewall regardless of firewall rules eg no web proxy no secure access to the XG GUI.

Are you suing the XG logviewer to determine the failure reasons?

Where is the Mikrotik located?

What version of XG are you running?

Ian
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Birules over 6 years ago in reply to rfcat_vk
The log is nothing...

Log TCP Dump:

Mikrotik is in the branch
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to Birules

You need to allow VPN on the WAN and you do not need DNS on the WAN.

The VPN terminates on the WAN interface not the internal interface.

Ian
Cancel
Vote Up 0 Vote Down

Cancel

0 Birules over 6 years ago in reply to rfcat_vk

Maybe I don't understand ...

Where do I allow VPN for WAN?

The ACL print was wrong, now I'll send it the way it is.

Thank you

0 rfcat_vk over 6 years ago in reply to Birules

Hi,

the GUI -> VPN -> L2TP (remote access).

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Birules over 6 years ago in reply to rfcat_vk

Obviously hehe ... L2TP is enable and my user in add members

VPN >> L2TP (remote access)

Configuration:

In remote host, I put the branch IP to test with cross NAT enabled and then disabled but it did not work.

**The settings were already done ...
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to Birules

Please try searching some of the threads in this link

https://search.sophos.com/#q=mikrotik&t=All&sort=relevancy

Also hopefully a mod/support person will review your request.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Birules over 6 years ago in reply to rfcat_vk

Hi,

Tks for reply. I'll continue my research.
Cancel
Vote Up 0 Vote Down

Cancel