Connect two branches directly (SITE A \ SITE B)

i found this for same IP but i did not need IPSEC is it possible? Sophos XG Firewall: How to apply NAT over a Site-to-Site IPsec VPN connection – Techbast

Hi Geremia Battaglia 

For branch connectivity we required IPSec VPN or SSL site to site VPN

Below is the link for same subnet configured at HQ and BR.

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/VPN/SiteToSiteVPN/VPNConfigureSiteToSiteIPsecNAT/index.html

If you have DHCP server at HQ and want to reply DHCP request follow the below scenario: 

https://support.sophos.com/support/s/article/KB-000035839?language=en_US

If you have multiple WAN link you can configure failover with IPSec VPN  as per the below doc available : 

https://support.sophos.com/support/s/article/KB-000035828?language=en_US

Regards

Thanks Bharat. And i must use IPSEC? because my provider link our HQ and Branch like LAN (VRRP connection). If i bridge my my interface in LAN ZONE can it work?

Hi Geremia Battaglia, 

Yes, it will work. If you face any challenge please post it here.

Ok, yes i tested and it works my LAN is available on two side. but i cannot have same IP adress for my SOPHOS XG to my branch office. And how to redirect WAN traffic if my GW WAN failed on my HQ? how to redirect to my branch office?

Hi Geremia Battaglia, 

If you have multiple WAN links you can configure failover with IPSec VPN  as per the below doc available : 

https://support.sophos.com/support/s/article/KB-000035828?language=en_US

Thanks and Regards

I have a problem yes, IP SEC is up but no traffic pass through. i follow this: Configuring NAT over a Site-to-Site IPsec VPN connection - Sophos (XG) Firewall

but i cannot ping devices from branch and from HQ.

Hello Geremia,

you cannot have the same IPs on both sites. You can have the same network, but not the same IPs.

Having the "same network" on both sites needs a bridge between these different sites. As far as I understand you, you already have your ISP setting this up for you. Although a VRRP setup is a special form of routing.

Better solution (even with a dedicated 10 GBit link) is doing a normal routing setup between two seperate networks, each one on each site. This would not need a VPN, if the link is already setup by your ISP as above.

But to help you further, we would need far more info than you gave us here. At least a network diagram would help here.

This is our infrastructure.

We have 2 scenarios (problems) and must be work after :

1. ORANGE part: If our MAIN WAN failed our provider activate automatically the AUXILIARY WAN. (Not configured by us but our provider will.)

1a. So main problem is DC(B) (green part) for accessing internet must pass through the BLESS connection and use DC (A) for accessing internet.

1b. If Main WAN is unavailable, DC(A) (blue part) must pass through the BLESS connection and use DC (B) for accessing internet.

Already did:

A. Put our BLESS connection on WAN zone

B. Made an IPSEC

C. and work with WAN Link manager Active WAN/Backup WAN (seems to work)

2. If it is possible i want to conserve network 172.16.0.0/16 on both side.

2a. Because on LAN we have an hypervisor and we want to duplicate this one on DC(B) we cannot change IP of virtual machines.

2b. if it is possible, we want to conserve 172.16.1.1 as a gateway. for same as 2a. we cannot change gateway of all virtual machines if there are a problem.

Already did:

Configuring NAT over a Site-to-Site IPsec VPN connection - Sophos (XG) Firewall

A. Configure NAT INbound and NAT outbound using IPSEC but not working

-> i think is because WAN Link manager put the BLESS connection like a backup gateway.

3. DC(A) have  to communicate permanently with DC(B) for replication.

3a. Our Hypervisor (DC(A) side) must send replica to our Hypervisor2 (DC(B) side)

already did: 

The point 2 is not working so not test that part