Sophos XG <-> Fortigate IPSec Site-to-Site tunnel with multiple subnets

Hi jjuergenn 

Thank you for reaching out to the community!

Is this second subnet added to the local networks at the remote site? 

Could you please provide the strongswan logs from the XG firewall? 

Thanks,

Hi Patel,

thanks for you answer.

Well so far we haven't found a way to add the second subnet on fortigate site. Be honest, we think this is not a issue on Sophos Firewall. It is mor or less a question whether it is in generell possible to route multiple subnet within one site-to-site tunnel betweeen Sophos and fortigate.

 

Thanks a lot for your support.

 

Regards, Juergen

 

Hi Patel,

thanks for you answer.

Well so far we haven't found a way to add the second subnet on fortigate site. Be honest, we think this is not a issue on Sophos Firewall. It is mor or less a question whether it is in generell possible to route multiple subnet within one site-to-site tunnel betweeen Sophos and fortigate.

 

Thanks a lot for your support.

 

Regards, Juergen

 

Hi Patel,

 

we followed this manual

https://www.sophos.com/en-us/medialibrary/PDFs/documentation/SophosFirewall/Pocket-Guides/Establish-IPsec-VPN-Connection-between-Sophos-and-Fortigate-with-IKEv2.pdf

strongswan log is attached

 

Regards, Juergen

4035.strongswan.zip

Hi jjuergenn,

Yes, it is possible to add multiple networks within one IPsec site to site tunnel on XG firewall. Please ensure that you add local and remote subnet at both firewalls. 

Thanks,

Hi Patel,

I can't see a Option on Fortigate site to add more than one subnet.

These guys having the same Problem

https://community.sophos.com/products/xg-firewall/f/vpn/113604/site-to-site-vpn-sophos-xg-to-fortigate

Unfortunately I do not understand the sotion/Workaround.

 

Regards, Juergen

Hi jjuergenn 

There are two networks added on the XG side under remote networks; you just have to figure out the way to add the second network in Fortigate sites' local network.

Thanks,

Hi Juergen, of course you can add More than one Phase2 subnet on the fortigate. You have to click on a small „+“ symbol in the phase2 Settings to add settings a second subnet. forum.fortinet.com/.../tm.aspx regards , Adrian