How to remove SNAT settings applied to an IPSSEC VPN tunnel

Just to be sure, you do not have a expired Base License? 

You should maybe restart the tunnel as well, if you removed the NAT in Ipsec. 

hello

you cant make any change on sophos ipsec tunnels WITHOUT restarting the tunnel

so yes the tunnel has been restarted several times 

anything new i add to my  firewall link nat rule works

just not the one server that was mapped in the tunnel config previously 

We are fully licensed, using ssg hardware

thanks

Check the base license, because if this license is expired in certain scenario - the firewall will start to NAT everything. 

Otherwise i would recommend, if possible, to recreate the tunnel, if the NAT is still in place. You could check the Packet capture in Webadmin to verify, which NAT rule is applied. 

And check, if you have a NAT configured on CLI: console> show advanced-firewall 

license is "subscribed" 

show advance-firewall is blank

the  problem machine is using the correct firewall rule  

all traffic should be natted behind   10.60.0.10 

this problem machine is still trying to NAT using the 1:n rule 

so it is trying to appear as   10.65.0.170    (this is the configuration that was on the ipsec tunnel) 

show advanced-firewall  is listing nothing 

license is "subscribed" 

show advance-firewall is blank

the  problem machine is using the correct firewall rule  

all traffic should be natted behind   10.60.0.10 

this problem machine is still trying to NAT using the 1:n rule 

so it is trying to appear as   10.65.0.170    (this is the configuration that was on the ipsec tunnel) 

show advanced-firewall  is listing nothing 

it has taken 2 weeks of being on xg to get this far to get the tunnels back to working (almost) as when we had UTM

i dont want to rebuild the tunnels if i can absolutely avoid it 

have logged a support ticket i guess will have to wait for them

What is in the packet capture? 

not a lot , if just shows   0 and 0  for fw rule and nat id 

before the tunnel was reconfigured and the 10.65.x.x network was removed though, we confirmed this behaviour by ssh to the remote server and confirmed it was coming from   the ip 10.65.0.170 

is there anywhere else a rule table other than  advanced-firewall 

as this rule was set ON the ipsec tunnel 

if i look at this ducment 

Sophos Firewall: Route Sophos Firewall-initiated traffic through an IPSec VPN tunnel

that mentions the making of route and the  advanced.firewall rule  this is different to setting a 1:n policy directly on the tunnel is it not ?