This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

LAN traffic not passing through IPSec Tunnel

i have XG18 firewall at head office where i have local network configured at port A and interface IP is 192.168.3.50/24
It has WAN configured at Port 2

i have another XG18 firewall at branch office where local network at Port A is 192.168.1.1/24

i have created the IP Sec tunnel between the two. Firewall rules have been created and IPsec tunnel shows connected.

i can ping the PC at head office 192.168.3.x from console of branch office firewall.

But i am not able to ping 192.168.3.100 from 192.168.1.100. There is no data transfer.

i am using Defaultbranchoffice IPSec policy at Branch office side and defaultheadoffice policy at head office side.

please suggest.

This thread was automatically locked due to age.

Parents

0 FormerMember over 4 years ago
Hi Sophos User4045,

Thanks for reaching out to the Community!

Is ping allowed on the VPN zone on the head office firewall?

Run packet capture while running continuous ping from 192.168.1.00 on the head office and branch office with "host 192.168.1.100 and icmp" and provide the screenshots.

Check out the following KBA for more info on packet capture:

Monitor traffic using Packet Capture Utility in the Sophos XG Firewall GUI

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 FormerMember over 4 years ago
Hi Sophos User4045,

Thanks for reaching out to the Community!

Is ping allowed on the VPN zone on the head office firewall?

Run packet capture while running continuous ping from 192.168.1.00 on the head office and branch office with "host 192.168.1.100 and icmp" and provide the screenshots.

Check out the following KBA for more info on packet capture:

Monitor traffic using Packet Capture Utility in the Sophos XG Firewall GUI

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Sophos User4045 over 4 years ago in reply to FormerMember

hi,

yes, ping is allowed in the VPN zone in Head office.

this is screen shot of Head office

below is of branch office
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 4 years ago in reply to Sophos User4045

Hello there,

If the issue persists, SSH into the XG of the BO and in the Advanced Shell (5>3) run the following command:

# ip route get 192.168.3.50

Also, confirm the SA is up by running

#ipsec statusall

You should see an entry with Child: and both of the subnets the Local and Remote.

Regards,
Cancel
Vote Up 0 Vote Down

Cancel