Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 14 replies
  • Subscribers 30 subscribers
  • Views 3488 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

RED Traffic on IPSec VPN: XG210 17.5.8 and FortiGate 61E

Chacha Kairu

Hi team,

Need your assistant on something here.

My current setup is that i have an IPSEC VPN connecting XG>FortiGate which is working OK. But now i cannot reach RED network (Remote site network) from FortiGate network and vise versa. Am clueless on how to approach this. 

Please help. I'm new to Sophos

Thanks            



This thread was automatically locked due to age.
Parents
  • 0

    Hello Chacha,

    Have you configured the RED network on your IPSec VPN? For traffic to flow over an IPSec tunnel, the necessary SA will need to be established.

    Under Configure > VPN > IPsec connections, did you include the RED network in the local subnet field? Please note on the FortiGate side it will need to be in equivalent local subnet field as well.

    If you do have this configured, the next step would be to confirm that the SA's are established correctly. This can be done by clicking on the little blue "i" icon next to the connection status circle. It is circled in red in the below image.

     

    It will present the following page. Please ensure that the subnets listed match what is configured.

    If the above looks correct, then the next step would be to perform a packet capture to verify what is happening to the traffic. The following knowledge base article covers how to use the packet capture feature.

    https://community.sophos.com/kb/en-us/123189

    Bryan Yang
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

  • 0 in reply to OhGeez

    Appreciate Yang for quick response.

    Yes i have added RED network to IPSEC tunnel as shown below

    An the link appears to be up but nothing seem to reach either side.

    Thanks

  • 0 in reply to Chacha Kairu

    Chacha,

    are you able to ping from Fortinet the red network? And vice-versa?

    Use the traceroute command to understand where the traffic is going through. Use also tcpdump.

    Regards

  • 0 in reply to lferrara

    Hi lferrara,

    Forti > XG and vise versa is OK. The only issue is RED > Forti and vise versa.

    Will try your suggestion for further investigation.

    Thanks

  • 0 in reply to Chacha Kairu

    The RED Tunnel is simply a Interface. Would guess, there is a firewall rule missing? 

    Which Zone type is your RED? 

  • 0 in reply to LuCar Toni

    Toni,

    I have created a separate Zone for RED.  

    I have toyed with them policies enough times but I can't seem to get the VPN traffic through the RED

    Thanks

  • 0 in reply to Chacha Kairu

    Kairu, can I have a look at your XG config?

    Send me a pm.

  • 0 in reply to Chacha Kairu

    Hi Chacha Kairu,

    Do a traceroute from a client in the RED Network to a client in the Fortinet network and vice versa. Examine the hop after the last hop that is answering. Verify that the traffic is routed through the tunnel and not send elswhere.

    Examine the routes on the XG and Fortigate.

    On the XG Firewall:

    - The RED network/zone must be able to communicate with the zone VPN and LAN. The zones LAN,VPN must be able to communicate with the RED network/zone.

    - The fortigate network must be defined in the red connection.

    On XG and Fortigate Firewall:

    - There RED network must be defined in the IPSec tunnel.

    On the Fortigate Firewall

    - There must be a Policy on the fortigate that allows communication with the RED network and vice versa. 

Reply
  • 0 in reply to Chacha Kairu

    Hi Chacha Kairu,

    Do a traceroute from a client in the RED Network to a client in the Fortinet network and vice versa. Examine the hop after the last hop that is answering. Verify that the traffic is routed through the tunnel and not send elswhere.

    Examine the routes on the XG and Fortigate.

    On the XG Firewall:

    - The RED network/zone must be able to communicate with the zone VPN and LAN. The zones LAN,VPN must be able to communicate with the RED network/zone.

    - The fortigate network must be defined in the red connection.

    On XG and Fortigate Firewall:

    - There RED network must be defined in the IPSec tunnel.

    On the Fortigate Firewall

    - There must be a Policy on the fortigate that allows communication with the RED network and vice versa. 

Children