IPSec Routing (tunnel interface) - XG to SG/UTM connection

UTM does not support IPsec Tunnel Interfaces. UTM only allows Policy Based Tunnels. 

You could failover to RED site to site Tunnel.

Thats weird considering UTM creates a VTI for ipsec routing as clearly shown in the routing table...

UTM builds a ipsec0 interface. VTI would mean, there is a XFRM interface per tunnel, which is not the case in UTM. It uses a workaround to bind it to a physical interface, but it is not VTI/XFRM. 

Alright, got it.

So what type of tunnel is "compatible" with the UTM from the XG? A site-to-site (vs the tunnel interface)?

I believe when I tried with the site to site I couldn't get the routing figured out, how would the routes get added without the interface?

If you have Site to Site (Policy based) you need to add the remote and local subnet. This will do the routing for you. 

Or you do a RED site to site tunnel. There are some tutorials how to do both. 

If you have Site to Site (Policy based) you need to add the remote and local subnet. This will do the routing for you. 

Or you do a RED site to site tunnel. There are some tutorials how to do both. 

S2S configured on the XG, the UTM is using the only type of Ipsec is has available (with defined subnets on both sides). Routes are not present on the XG.

What's next?

Can you show us your config on both sides? And keep in mind, how routing on SFOS works: community.sophos.com/.../routing-in-xgv18-with-sd-wan-pbr

Again, the tunnel establishes with the correct SA which is not any ANY-ANY SA.

Yeah so you are using a policy based tunnel, not a XFRM Tunnel. 

Alright, the ping doesn't work between the firewalls, but the SA establishes. I realize the subnets are hidden, but the SA establishes. What can I check next?

Where is the client and what is this client pinging? 

Do a tcpdump on UTM and do a packet capture (webadmin) on SFOS. Do you see the traffic flowing? 

We have tried pinging from numerous clients on the SFOS side (workstations, from the firewall while specifying a source IP, etc). See the attached packet captures.

The UTM does not show any ICMP activity (command run tcpdump -i any)

So likely the policy is to blame. Can you show us the ipsec policies on both appliances? The one with Phase 1/2. 

Hi Aaron Becker

Please try the below link to configure site to site IPsec VPN connection between Sophos Firewall and UTM 

https://support.sophos.com/support/s/article/KB-000036746?language=en_US 

Regards