Multiple IPsec Gateways with different PSK

Question

Hallo Community, 
 I am fairly new to the world of Sophos and I started with setting up an Firewall XG (SFOS 18.0.3 MR-3) for my extended home network. As I have multiple locations with VPN-Clients and different rules how they use my services I set up multiple IPsec gateways with different settings. But since all VPN-Clients are behind dynamic NAT-IPs , all gateway have the same local listen address and an %any as remote . 
 If I set up a PSK for one gateway, the settings are applied and connection is possible . If I try to set up a different PSK for another gateway, the settings are applied and I am able to connect too BUT the PSK from the first gateway is overwritten by the new settings . This happens to all PSKs for any gateway since there all have the same local address for listening and an * as remote address. 
 I have already read this Post since this is exactly the same issue I have too: https://community.sophos.com/products/xg-firewall/f/vpn/85051/pre-shared-keys-changing 
 My question here is: Is there any other solution for this without to set a specific remote address? 
 
 Thank you!

LuCar Toni · Accepted Answer

It is actually quite easy: In IPsec, you have SAs, which will be build up for each tunnel. As you move towards a Wildcard tunnel, you cannot difference between two different tunnel configs. 
 Tunnel A has PSK 1 
 Tunnel B has PSK 2 
 If you give XG the option to know, which Source will use Tunnel A Config, it can use PSK1. But if XG has two Wildcard tunnel configs, those configs will mix up and XG cannot know, which tunnel needs which PSK. 
 There are solutions (like UTM), which workaround this with something like PSK Probing. This is not a standard by any means and not implement into XG. 
 There is a way to resolve this, as you already stated. You can difference those tunnels by using the identifies. (Remote / local identifies). But this is not implemented in XG right now. 
 The main question would be: As XG moves towards Routebased VPN: Wildcard certificates is not supported in this technique. So if you want to integrate RB tunnels, you need to rethink this and maybe move to DDNS solutions.

Multiple IPsec Gateways with different PSK

Top Replies

Submitted a Tech Support Case lately from the Support Portal?