Sophos XG VMs IPsec tunnel established but hosts behind the firewalls can't ping each other.

Hi,

Do you have any firewall rules in place?

ian

Hey BongBong, Welcome to Sophos Community.

Make sure that the Sophos XG-Home (172.16.16.16) has the VPN to LAN rule configured to allow inbound traffic from IPSEC VPN to the Firewall's LAN.

Also at times, the Windows firewall blocks ICMP packets,. So ensure that you're able to ping 172.16.16.50 from any other machine in the same LAN

Hello I did create the rule for VPN to LAN and LAN to VPN on XG @ 172.16.16.16
I have attached the rule that I created

Also I can confirm that I can ping the host to host behind the XG to each other as well.

Thanks in advanced!!

Alright. The rule seems proper. Take a packet capture on both firewalls (Diagnostics > Packet Capture) 

• In the BPF String --> host 172.16.16.50 and proto 1
• Make sure to enable the capture

Just send one ping packet -> "ping 172.16.16.50 -n 1" and refresh the capture on both the Firewall and share those snapshots. 

Ideally, the configuration of the firewall rules should fix this. 

Please ensure that IPSec VPN tunnel should be established and LAN-VPN and VPN-LAN firewall rule configured properly at both the firewall end. 

What is the firmware version? 

Please share the output of  "ipsec statusall" from both firewalls from the advance console. 

Please share the output of "tcpdump", "drppkt" from both firewalls from the advance console for the destination IP Address. 

Let's say that if you are ping destination host 172.16.16.50 from Source host 172.16.10.50 

Please capture "tcpdump" and "drppkt" for destination host 172.16.16.50 on firewall Sophos XG85

capturing tcpdump / drppkt using the following link.

https://support.sophos.com/support/s/article/KB-000037007?language=en_US

Hello Friends,

I finally able to fix the issue
I disabled most of the rules that created earlier and follow the steps in this sophos KB: 

https://support.sophos.com/support/s/article/KB-000035717?language=en_US

needed to create specific LAN to VPN && VPN to LAN on each firewall and voalah! 
Thank you all for your warm reception and assist!

Kind Regards,
Raymond