Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 14 replies
  • Answers 1 answer
  • Subscribers 26 subscribers
  • Views 3667 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

S2S - no connection to remote server

Philipp Marx

Hey,

I would like to connect to a remote server via VPN. The s2s connection works but Iam unable to reach the server on the other side (the remote site is one host only).

I can see that the outgoing traffic goes through the firewall rule LAN to WAN, if I will connect from the local subnet 172.20./16 to the remote server 172.20.200.49.

So whats missing / wrong? Do I have to create a further rule/route - where ?

Thanks in advance!



This thread was automatically locked due to age.
  • 0 in reply to Keyur

    Hi Keyur, 

    first, thanks for your time!!

    May be this graphic will help to understand the problem:

     

    The gateway VPN IPSec configuration is as follows: 

    The Firewall Rule LAN to VPN:

    VPN to LAN:

    Regards 

    Philipp

  • 0 in reply to Philipp Marx

    Hi  

    Thank for providing the details diagram.

    Is there any specific requirement to use a 10.200.206.0/24 network for VPN communication?

    We can get it to work by adding network 172.20.0.0/16 as Local subnet and 172.27.200.49/32 as a remote subnet in the IPsec VPN configuration.

    If routes are added for the network 172.20.0.0/16 in XG firewall and it's reachable (I am assuming it is).

    In LAN to VPN rule, you do not require to specify any network, keep it "ANY" for Source and Destination network.

    Second Scenario

    If you wish to NAT the traffic of the network 172.20.0.0/16 with 10.200.206.0/24

    In the IPsec configuration

    Local Subnet - 172.20.0.0/16

    Remote Subnet- 172.27.200.49/32

    Enable NAT- It will show 172.20.0.0/16 by default and NAT to select 10.200.206.0/24

    It will NAT outbound VPN traffic from 172.20.0.0/16 network to 10.200.206.0/24 network



    Y    ou can use troubleshooting guide- https://community.sophos.com/kb/en-us/123320

  • 0 in reply to Keyur

    Hello Keyur, 

    first scenario: 

    yes, that are requirements from our customer. But I will ask him if we could change the subnet. 

    second:

    The problem is if we change the local subnet to 172.20.x.x instead of 100.200.x.x the vpn connection will not come up. We could verify it with our customer that for the authentication we had to use the 100.200.x.x. network. Therefore the second scenario will not work. 

  • 0 in reply to Spencer James

    We switched from Sonicwall to XG last month. Therefore it was no problem to get a working VPN connection with these configuration details.