Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 6 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 2056 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-Site VPN with Sophos XG using tunnel interface

U S

So I have configured a Sophos XG site-to-site vpn according to this document: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/VPNCreateRouteBasedVPN.html

But I am stuck with the following problem: SiteA: Branchoffice, LAN 192.168.198.0/24 SiteB: Headoffice, LAN 172.30.0.0/24 If I ping from Site-A to Site-B, tcpdump on Sophos-A shows this while ping goes through:

18:53:04.059527 Port1, IN: IP 192.168.198.244 > 172.30.0.3: ICMP echo request, id 46946, seq 0, length 64
18:53:04.059737 xfrm1, OUT: IP 192.168.198.244 > 172.30.0.3: ICMP echo request, id 46946, seq 0, length 64
18:53:04.069119 xfrm1, IN: IP 172.30.0.3 > 192.168.198.244: ICMP echo reply, id 46946, seq 0, length 64
18:53:04.069193 Port1, OUT: IP 172.30.0.3 > 192.168.198.244: ICMP echo reply, id 46946, seq 0, length 64

If I ping from Site-B to Site-A, tcpdump records the following on Sophos-B and ping does not go through:

18:53:21.509216 Port4, IN: IP 172.30.0.3 > 192.168.198.244: ICMP echo request, id 2025, seq 1, length 64
18:53:21.509354 xfrm1, OUT: IP >WAN-IP< > 192.168.198.244: ICMP echo request, id 2025, seq 1, length 64

How come that from Site-A to B it goes xfrm1, OUT: IP 192.168.198.244 (as expected) while from Site-B to A it's xfrm1, OUT: IP >WAN-IP<

I just don't get why it uses the WAN-IP from B to A but the other way round it takes the correct path?

Cheerz



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to LuCar Toni

    Why do I need NAT in this scenario when I have a specifed tunnel interface where the packets can get routed through without NAT?

  • 0 in reply to U S

    You do not need NAT; but you should check, why a NAT Rule is applied. 

  • 0 in reply to LuCar Toni

    Now I have removed NAT completely from Site-B and still get on Sophos-B:

    12:06:49.715759 Port4, IN: IP 172.30.0.3 > 192.168.198.244: ICMP echo request, id 10823, seq 3, length 64
    12:06:49.715813 xfrm1, OUT: IP --WAN-IP-- > 192.168.198.244: ICMP echo request, id 10823, seq 3, length 64

    While Site-A says:

    12:09:13.221607 xfrm1, IN: IP --WAN-IP-- > 192.168.198.244: ICMP echo request, id 10823, seq 3, length 64
    12:09:13.221672 Port1, OUT: IP --WAN-IP-- > 192.168.198.244: ICMP echo request, id 10823, seq 3, length 64

  • 0 in reply to U S

    Seems like another NAT is now hitting and MASQ the traffic. Or you need to flush the connection table. You can via Webadmin kill the connection or flush the entire table via CLI (will kill all connections : conntrack -F )