Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 27 replies
  • Subscribers 28 subscribers
  • Views 6986 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Firewall v18 AWS site-to-site VPN connected but no traffic PING SSH

djb-sophos

Well, I have followed this step-by-step, exactly:

https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/125560/sophos-xg-firewall-v18-to-aws-vpn-gateway-ipsec-connection

....and while the VPN shows "UP" in both AWS and my Sophos VPN section, I cannot PING or SSH to my test EC2 instance. In the bottom screenshot you'll see I have PING and SSH allowed from anywhere (0.0.0.0/0). I've been at it for hours, first because I mistakenly followed the v17. Even with the v17 how-to, my VPN said it was up in AWS and Sophos VPN section. Then I found v18 and thought for sure I would have success. No such luck.

At one point I got stuck at the part where I couldn't find my "xfrm" interface until I realize that little vertical blue line meant I could expand my WAN interface, thanks to THIS ARTICLE. Again, I thought for sure I would have success. No such luck again, and now I'm at a loss. 

The only difference I've noticed between my setup and the setup in the link above, is in Step 9 and Step 10, I have "xfrm1" not "xfrm2".

Anyone know where I should start with troubleshooting?



This thread was automatically locked due to age.
  • 0 in reply to msiconolfi

    The link you sent is for v17, I have v18. But yes, I'll go through it and have a look. Sweat

  • 0 in reply to djb-sophos

    Hello,

    Please select Ping for the VPN zone.

    If not I will try to recreate your configuration, see if something might be missing.

    Regards,

  • 0 in reply to emmosophos

    Thanks, I actually checked them all and no change. I'm about to break it all down again for take 3 ...

  • 0 in reply to djb-sophos

    Hello djb,

    I have asked for a review of the RR.

    However, after checking, it seems that during the "Routing Options" Dynamic is selected instead of static. (That happened to me when I was following the RR)

    Additionally, remember to delete and recreate the site-to-site VPN connection, the Virtual Private Network, and Customer Gateway, as well as to update the Routing Table once you recreate them.

    Regards,

  • 0 in reply to djb-sophos

    DJB - I would highly recommend you reach out to support directly after you attempt to set this up again or you could engage our professional services team if you have the hours banked (or you could purchase an hour or 2 by reaching out to your partner or local sales team).  The advantage of the pro team is they are focused on deployment and educating our customers and reducing any frustration you may have with some more advanced setups like this one.  Support is focused on break/fix scenarios and are not for deployment and education scenarios.  I myself have this environment working in my lab and it works very well, but there are some gotcha's that can trip you up at various stages and its hard to troubleshoot over a forum!

  • 0 in reply to emmosophos

    thanks. I just looked at my existing setup, where it says it's connected but I cannot PING or SSH back and forth. I do have static configured. About to go through the document again. I just deleted my S2S VPN, Virtual Private GW, and Customer GW for starters.

  • 0 in reply to Brian Ritchie

    Thanks. I am about to go through the document and start from scratch again. Other than the IP addresses, it's a very static environment so I kind of expected, if I followed the document step-by-step, I'd have a working setup. I understand troubleshooting over a forum can be difficult, but off the top of your head can you remember any gotcha's I should be aware of?

  • 0 in reply to djb-sophos

    Hello,

    Make sure that on the AWS side the tunnel actually says UP.

    Virtual Private Network (VPN) >> Site-to-Site VPN Connections >> Tunnel Details >> Status (should say UP)

    Once the status is UP, the traffic should start to flow.

    Regards,

  • 0 in reply to emmosophos

    Same thing as the first 3 times. VPN shows "UP" on both ends but can't PING or SSH to my test EC2 linux box.

    Two things I noticed while going through the setup this time:

    1. Step 6 figure 2:"SHA2 with 96-bit truncation" is unchecked by default for me, so I checked it since that's what shows in the image

    2. Step 7 figure 4: Listening interface and LocalID for me have the same IP address - my WAN IP address of the Sophos Firewall
  • 0 in reply to djb-sophos

    Hello there,

    You can leave the Local ID empty for both ends, that is only needed if the XG is behind a NAT device, not seeing your real Public IP.

    Regards,