Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 6 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 2056 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-Site VPN with Sophos XG using tunnel interface

U S

So I have configured a Sophos XG site-to-site vpn according to this document: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/VPNCreateRouteBasedVPN.html

But I am stuck with the following problem: SiteA: Branchoffice, LAN 192.168.198.0/24 SiteB: Headoffice, LAN 172.30.0.0/24 If I ping from Site-A to Site-B, tcpdump on Sophos-A shows this while ping goes through:

18:53:04.059527 Port1, IN: IP 192.168.198.244 > 172.30.0.3: ICMP echo request, id 46946, seq 0, length 64
18:53:04.059737 xfrm1, OUT: IP 192.168.198.244 > 172.30.0.3: ICMP echo request, id 46946, seq 0, length 64
18:53:04.069119 xfrm1, IN: IP 172.30.0.3 > 192.168.198.244: ICMP echo reply, id 46946, seq 0, length 64
18:53:04.069193 Port1, OUT: IP 172.30.0.3 > 192.168.198.244: ICMP echo reply, id 46946, seq 0, length 64

If I ping from Site-B to Site-A, tcpdump records the following on Sophos-B and ping does not go through:

18:53:21.509216 Port4, IN: IP 172.30.0.3 > 192.168.198.244: ICMP echo request, id 2025, seq 1, length 64
18:53:21.509354 xfrm1, OUT: IP >WAN-IP< > 192.168.198.244: ICMP echo request, id 2025, seq 1, length 64

How come that from Site-A to B it goes xfrm1, OUT: IP 192.168.198.244 (as expected) while from Site-B to A it's xfrm1, OUT: IP >WAN-IP<

I just don't get why it uses the WAN-IP from B to A but the other way round it takes the correct path?

Cheerz



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to LuCar Toni

    Now I have removed NAT completely from Site-B and still get on Sophos-B:

    12:06:49.715759 Port4, IN: IP 172.30.0.3 > 192.168.198.244: ICMP echo request, id 10823, seq 3, length 64
    12:06:49.715813 xfrm1, OUT: IP --WAN-IP-- > 192.168.198.244: ICMP echo request, id 10823, seq 3, length 64

    While Site-A says:

    12:09:13.221607 xfrm1, IN: IP --WAN-IP-- > 192.168.198.244: ICMP echo request, id 10823, seq 3, length 64
    12:09:13.221672 Port1, OUT: IP --WAN-IP-- > 192.168.198.244: ICMP echo request, id 10823, seq 3, length 64

Children