Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 2 replies
  • Subscribers 26 subscribers
  • Views 501 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to (remote) access a "far-gateway" VPN network?

hirschQ

Hi @all,

I'm going crazy about this and I'm thankful for every hint^^

There is a main router firewall (Cisco ASA) which provides a lot of S2S VPN's. The ASA will be replaced by Sophos XG in future. Because of the big amount of zero-documented S2S's, tons of policies, and a few DMZ networks, we decided to replace the ASA step by step.
For now the sophos is a SSLVPN Gateway for remote access and its working for all ASA networks with correspondent ASA Firewall rulesets, but not for ASA provided S2S Tunnel ressources (later called ASA-S2S-net). Sophos seems to be the root cause. This is my setup:

Sophos is installed as non-gateway firewall and got a route to LAN:
Sophos 10.222.0.1 -> Core Switch 10.222.0.254 -> ASA 10.1.0.1

To use Sophos for Remote Access SSLVPN I entered a public IP Gateway and setup Remote Access
WAN -> Sophos 89.89.89.89 -> 172.16.0.0/20

Because of the ASA provided S2S ressources, I extended the Sophos SSLVPN Profile to newly created host-items:
Permitted ressources: LAN + ASA-S2S-net-1

And set new static routes for those networks
ASA-S2S-net-1: 192.168.120.0/21 via LAN-INT

And of course I extended the concerning Firewll Policy to permit access from SSLVPN to LAN + ASA-S2S-net-1

+ Rebooted Sophos

- When I ping a ASA-S2S-net-1 host from SSLVPN Client network, I get an answer from Sophos "Destination Host unreachable", but my pings weren't even logged.
- When I ping via diagnostic tools: 100% packet loss
- When I lookup route via diagnostic tools:
192.168.120.97 is located on br0  >>> this is actually right
192.168.120.97 is not behind a router >>> how is this message provided? I mean ASA is the router, but the next hop is a routing core switch. But that shouldn't break it, right?

I have to miss a thing, I don't get it running Disappointed

Any ideas on this?

cheers,
Vanessa



This thread was automatically locked due to age.
Parents
  • +1

    Hello there,

    Thank you for contacting the Sophos Community,

    So when you start the Ping on the computer with the SSL VPN client, towards one of the ASA-S2s-NET hosts, do you see the ping arriving:

    1. To the XG?

    2. Do you see the XG sending the packet out the interface that connects to the Core Switch?

    3. How did you set the static route as an interface or as a Gateway?

    4. What is the IP assigned to the SSL VPN clients

    For point 1 and 2 you can do a TCPdump in the advanced shell of the XG (5 > 3) and confirm

    Example of TCPdump for traffic coming from the SSL VPN client

    #tcpdump -eni tun0 host 172.16.0.100 

    Substitute accordingly 

    Example of TCPdumo for traffic leaving the XG via the interface 

    #tcpdump -eni Port1 host 192.168.120.100

    If you see the traffic arriving to the XG and leaving the correct interface, then most likely you’re missing a static route on your ASA or your core switch (I am thinking your switch is an L3.

    Regards,

Reply
  • +1

    Hello there,

    Thank you for contacting the Sophos Community,

    So when you start the Ping on the computer with the SSL VPN client, towards one of the ASA-S2s-NET hosts, do you see the ping arriving:

    1. To the XG?

    2. Do you see the XG sending the packet out the interface that connects to the Core Switch?

    3. How did you set the static route as an interface or as a Gateway?

    4. What is the IP assigned to the SSL VPN clients

    For point 1 and 2 you can do a TCPdump in the advanced shell of the XG (5 > 3) and confirm

    Example of TCPdump for traffic coming from the SSL VPN client

    #tcpdump -eni tun0 host 172.16.0.100 

    Substitute accordingly 

    Example of TCPdumo for traffic leaving the XG via the interface 

    #tcpdump -eni Port1 host 192.168.120.100

    If you see the traffic arriving to the XG and leaving the correct interface, then most likely you’re missing a static route on your ASA or your core switch (I am thinking your switch is an L3.

    Regards,

Children
  • 0 in reply to emmosophos

    Hello Emmanuel,

    you made it! tcpdump brought it on point. The L3 core switch route didn't work and I really don't know why.
    But I just move on to my next step on action plan and configured a new route to DMZ switches and finally took this road to the ASA-S2S-net :):)
    tcpdump got an hon. place in my toolbox now :)
    Thank you so much!! <3

    Kind regards,
    Vanessa