Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 26 subscribers
  • Views 2440 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN IPSEC, XG with AWS VPC

IvanildoGalvão

Greetings everyone.

I set up a Sophos XG106 site-to-site IPSEC VPN for AWS, the tunnel has gone up, it's online, but I can't ping, or access any other service from the machines hosted on AWS.

I followed this tutorial: https://community.sophos.com/kb/en-us/133057

Any idea ?



This thread was automatically locked due to age.
Parents
  • 0

    Hi there,

    Please make sure there VPN communication-related firewall rules are in place.

    Please use packet capture utility- https://community.sophos.com/kb/en-us/123189 to check the outgoing and incoming traffic.

    Please also check when you initiate the traffic behind the XG firewall, are you able to receive the packets at AWS end.

  • 0 in reply to Keyur

    Sophos XG is behind a routed modem, which gives you a private IP via DHCP, 192.168.1.3.

    The public IP arrives directly at the modem's WAN interface.
    As far as I know, the ideal would be for the public IP to arrive directly at the WAN interface of the Sophos XG and thus avoid any modem filter.

    What do you think ?

  • 0 in reply to IvanildoGalvão

    Hi there,

    When traffic sending out from the XG WAN interface which is private IP and would be NAT when traffic exists from the Modem Interface taking public IP if the tunnel is getting connected the traffic should be reaching to XG and AWS and that is why I have requested to check packet capture at Sophos XG and AWS end.

Reply
  • 0 in reply to IvanildoGalvão

    Hi there,

    When traffic sending out from the XG WAN interface which is private IP and would be NAT when traffic exists from the Modem Interface taking public IP if the tunnel is getting connected the traffic should be reaching to XG and AWS and that is why I have requested to check packet capture at Sophos XG and AWS end.

Children
  • 0 in reply to Keyur

    Apparently, Sophos XG sends the packets through the tunnel, but receives no response.
    We performed a tracert on a Windows Server VM hosted on AWS, destined for the internal network behind Sophos XG, the VM gets lost in the first hop, apparently does not know which gateway to use.
    But the VPC is configured correctly and with the proper static routes, I don't know what it can be.

  • 0 in reply to IvanildoGalvão

    Hi there,

    If the packet from AWS is not being sent out, please verify the configuration or any other method to check the drop packet to rectify the issue at AWS side.