Smarthost via IPsec site-to-site Tunnel not working

Question

I can't find out why smarthost is not working on my Firewall v18.5MR3. The smarthost is located behind an IPsec site2site tunnel. 
 Under "Device Access", SMTP relay is enabled for VPN. 
 There is a firewall rule allowing port 25 any-to-any (auto added Firewall rule accross all Zones) 
 All other communication is working across this tunnel. 
 When sending emails to that smarthost, I get timeouts. However I can telnet on port 25 to the smarthost via the tunnel from other hosts in my network. 
 Any ideas what to look for?

EdmundSackbauer · Accepted Answer

I found this KB article which explains it nicely: support.sophos.com/.../KB-000035839

Vishal_R · Answer

Hi EdmundSackbauer May be comparing TCPDUMP, Conntrack ( connection details) during manual telnet time and during sending email time ( when connect gets timeout) may give some hint in case traffic is not following the same pattern in both the conditions.

For site-to-site VPN with PBVN to forward system-generated traffic over VPN, manual CLI IPSec route is needed along with configuring system-generated NAT.

If the site-to-site tunnel is RBVPN then the SD-WAN rule is required along with enabling the SD-WAN CLI command for system-generated traffic.

console> sh routing sd-wan-policy-route system-generate-traffic
SD-WAN policy route is turned on for system-generated traffic.

Smarthost via IPsec site-to-site Tunnel not working

Top Replies

Submitted a Tech Support Case lately from the Support Portal?