ping sourceip over Ipsec does not work - v18.5

Question

Hello, 
 Currently I migrate some devices from 17.5 and 18.0 to 18.5, until now it works as expected. 
 But Im having a bit problem, whit the previous versions "ping sourceip" command or " ping -i " in v18 from XG device console it works as expected. 
 
 But now in v18.5 ping sourceip (in cish) ou ping -a (in advanced console) does not work. The IPSEC tunnel it works as expected, all devices from BO and HO has access each other, but from XGS device I can&acute;t PING any device from BO . 
 
 Ping from XGS device

From device behind XGS

and traceroute from XGS with source IP it works!

Is there any new option to enable PING from device console ?

Regards 
 Carlos

FormerMember · Answer

Hi Carlos Cesario , 
 Thank you for reaching out to Sophos Community. 
 You need a source NAT policy to route firewall-generated traffic through an IPSec VPN tunnel. 
 Click here for more info on 'How to NAT Sophos Firewall generated traffic'.

FormerMember · Answer

Hi Carlos Cesario , 
 SNAT policy would be required to route Sophos(XG) Firewall initiated traffic through IPsec VPN. 
 Here is the command to add SNAT policy for the destination network. 
 console> set advanced-firewall sys-traffic-nat add destination 192.168.32.0 netmask 255.255.255.0 snatip 192.168.xx.237

ping sourceip over Ipsec does not work - v18.5

Top Replies