IPsec to IPsec communications

Hi Lyubomir Todorov

Please check if the Scenario is the same as per the below link :  

https://support.sophos.com/support/s/article/KB-000038320?language=en_US

If the scenario is as per the above link for the rule VPN-VPN , please check the issue with one test rule as per the below snapshot  and try your remote users are able to access the branch network :  

You can create a test rule VPN-LAN rule if the remote user is not able to access the internal resource as per the below snapshot :  

If above firewall rules works means you have to define the source and destination network properly.

Hope this might help 

I have already tried that 

My configuration is looking exactly like this 

As I mentioned - There is no problems with VPN-to-LAN or vice versa 

Hi Lyubomir Todorov, 

Please check traffic flow with tcpdump and drop packet capture 

console>tcpdump 'host <destination IP> and proto ICMP

console>drop-packet-capture 'host <destination IP> and proto ICMP

Thanks and Regards 

Nothing... just clear as sunny day

Hi Lyubomir Todorov, 

Just to clear my misunderstanding may I know which Sophos XG VPN service is not working properly is it IPSec site to site,  IPSec site to siteover SSL VPN , IPSec VPN for remote users, SSL site to site, SSL VPN for remote user , L2TP VPN or PPTP VPN ?

Thanks and Regards 

We're using IPsec Remote Access for our Home Office employees 

They are using a specific software which requires PC to PC communication. So when they are in the Office (LAN to LAN) everything works fine even when one of them is Home Office (VPN to LAN and LAN to VPN) also works fine BUT when both employees are at their Home (VPN to VPN) communication isn't working.

As I said - They are using IPsec Remote Access 

Check the Webadmin Packet Capture. You should see the IPsec Packets there. 

Yes, I can see everything else but nothing from VPN to VPN 
It's acting like a BUG... i don't know... I have everything configured 

The traffic coming from VPN to VPN is not matching any Rule, but I have a Rule for this as you can see in my previous post

Hi Lyubomir Todorov 

Please navigate to monitor and analysis-->diagnotics --->Packet capture and click on Configure and add host 172.16.77.1 and proto ICMP and click on save and click on Refresh 

From CLI check the traffic hitting the Sophos XG or not : 

console>tcpdump 'host <destination IP> and proto ICMP

console>drop-packet-capture 'host <destination IP> and proto ICMP

How many user are facing the issue ?

Thanks and Regards

Hi Lyubomir Todorov 

Please navigate to monitor and analysis-->diagnotics --->Packet capture and click on Configure and add host 172.16.77.1 and proto ICMP and click on save and click on Refresh 

From CLI check the traffic hitting the Sophos XG or not : 

console>tcpdump 'host <destination IP> and proto ICMP

console>drop-packet-capture 'host <destination IP> and proto ICMP

How many user are facing the issue ?

Thanks and Regards

Any new ideas?

Can you try a VPN to VPN Rule without any kind of network objects? 

I tried every possible Rule configuration
I even tried VPN to Any

I even tried a connection from SSLVPN to IPSECVPN and again it doesn't work

VPN traffic does not match any of the rules as shown in the screenshot below
I'm desperate and I don't know what else to try

Try a packet capture without the BPF String or with BPF String icmp.