Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 9 replies
  • Answers 3 answers
  • Subscribers 27 subscribers
  • Views 814 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Branch Office VPN host not reachable

Adekunle Williams

Hi Expert!

I did a VPN connection to to another Sophos XG firewall. The Head Office VPN can reach the host (Branch Office) through can pinging but from Branch Office, stating destination host unreachable.

From the Branch Office XG firewall, We have 2 WAN ports and 2 LAN ports were bridge and then point to a Vmware workstation for other host to connect. like i said i can reach all host on the VM from Branch Office but reaching HO has become a big issue for me. please can anyone help out?

Below here is the Details

From HO - We have 1 WAN and 1 DHCP LAN

Firewall Rules from HO to DC

Pinging from HO_LAN 172.16.16.34 to DC_LAN 192.168.10.9

Trace from HO (172.16.16.34) to DC (192.168.10.9)

From DC (BO) - We have 2 WAN, and LAN port were bridge with routing on 192.168.10.1. All host are connected to a VM and also NAT from Sophos Firewall.

Firewall rule from DC to HO

Pinging from DC (BO 192.168.10.9) to HO ( 172.16.16.34)

Trace from 192.168.10.9 (DC) to HO (172.16.16.34)

I do not know if this is a routing issue or or i am having issue from the bridge of LAN port which makes it not to connect or ping from DC (BO). Please I will really appreciate anyone to help me out on this.



This thread was automatically locked due to age.
Parents
  • 0

    Possible you have the 172.16.16.0/24 at the branch location too..

    Because it is the initial used configuration-interface ... this error occurs sometimes.


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • 0 in reply to dirkkotte

    i tried all steps. still stating unreachable.

  • 0 in reply to Adekunle Williams

    after checking your screenshots, i found the subnet 172.16.16.0/24 at booth locations.
    If PORT1 in BO is not connected/used. You should remove the IP from this interface (or clear the interface-config at all)


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • 0 in reply to dirkkotte

    Thank you. currently i am using 172.16.16.0/24 at both end. configure everything correctly using the same link (https://soph.so/TrenKz) sent to me. still not working.

  • 0 in reply to Adekunle Williams

    ok, but if you follow the link (and create double-NAT) you should NOT ping 172.16.16.34 to reach a device at the "other-side".

    Because the subnet (172.16.16.0/24) is local and "directly connected", the traffic stay local.

    Corresponding to the guide ... you should ping an "alias-IP" like 172.16.22.34 ... which is routed to the other side and the other side do NAT 172.16.22.34 back to 172.16.16.34.

    A really bad configuration.

    First you should try to change the IP-range at one side ... it is more simple (mostly) than NAT and DNS manipulations...


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

Reply
  • 0 in reply to Adekunle Williams

    ok, but if you follow the link (and create double-NAT) you should NOT ping 172.16.16.34 to reach a device at the "other-side".

    Because the subnet (172.16.16.0/24) is local and "directly connected", the traffic stay local.

    Corresponding to the guide ... you should ping an "alias-IP" like 172.16.22.34 ... which is routed to the other side and the other side do NAT 172.16.22.34 back to 172.16.16.34.

    A really bad configuration.

    First you should try to change the IP-range at one side ... it is more simple (mostly) than NAT and DNS manipulations...


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

Children
No Data
Unfiltered HTML