Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG <-> XG IPsec tunnel not working anymore

Dear Community. 

We had a working setup between two XG, running on 18.0.5 MR-5-Build 586, that both have a public IPv4. Between we had a working IPSec Tunnel and I could easyly access resources on the different network. It worked until this morning when XG would not pass traffic through the tunnel.

The setup looks like this:

Internal net (branch1) <--> XG1 | WAN <---- Tunnel -----> WAN | XG2 --> Internal net (branch2)

and the tunnel looks like this

XG1 = 10.10.82.1 (xfrm7) <----> 10.10.82.2 (xfrm7) = XG2

There are firewall and static routing rules in place and it did worked until today.

What I currently can do:

Ping from branch 1 to tunnel IP of XG1 but not to tunnel IP of XG2

Ping from branch 2 to tunnel IP of XG2 but not to tunnel IP of XG1

I monitored dropped packages from cli while pinging the other side but there are no dropped packages. I turned off the IPSec tunnel and later on rebooted the XG but without any change. I also tried to reboot XG with old firmware 18.0.4 MR-4 just to make sure, I have no FW problem. Nothing changed. I did not see any errors in the log viewer for Firewall or System facility.

Currently I am lost. Does anyone have a suggestion?

Regards,

Christian



This thread was automatically locked due to age.
Parents
  • Ok, it is a routing problem on XG1/Branch1:

    10:33:23.666533 tun0, IN: IP 10.81.234.10 > [ip_host_branch2]:: ICMP echo request, id 63339, seq 8918, length 64

    10:33:23.666558 Port2, OUT: IP [publicIP_XG1] > [ip_host_branch2]: ICMP echo request, id 63339, seq 8918, length 64

    The Port2 should be xfrm7... my static rule is ignored on XG1...  The precedence for routing us Static route, VPN route, SD-WAN policy route.

Reply
  • Ok, it is a routing problem on XG1/Branch1:

    10:33:23.666533 tun0, IN: IP 10.81.234.10 > [ip_host_branch2]:: ICMP echo request, id 63339, seq 8918, length 64

    10:33:23.666558 Port2, OUT: IP [publicIP_XG1] > [ip_host_branch2]: ICMP echo request, id 63339, seq 8918, length 64

    The Port2 should be xfrm7... my static rule is ignored on XG1...  The precedence for routing us Static route, VPN route, SD-WAN policy route.

Children