Sophos XG Use 0.0.0.0/0 for IPsec tunnel traffic

You can use the "Any" object on the local and remote host instead of 0.0.0.0/0

Hello,

Greetings, thank you for contacting Sophos Community!

You may refer to the below KBA for the detailed steps:

support.sophos.com/.../KB-000035798

I can only apply Any on either local or remote. I can not select both at the same time.

That did not help much. I would like to use Any on both local and remote in IPSec tunnel and use Static Route to control what goes through it. My combined subnets is bigger than 192/2 on both sides.

Hello there,

Then you would need to configure your IPsec as a Tunnel Interface, this will create a 0.0.0.0/0 in the tunnels, and then you can control the traffic via Static Routes.

Regards,

Yes. the issue is I can not use 0.0.0.0/0 on both local and remote

Hello there,

Sorry can you clarify? When you set the tunnel as Tunnel Interface you don't need to fill out the Local o Remote Subnet, it’ll automatically be 0.0.0.0/0 on both sides.

Regards,

Getting same error if choosing Any/Any or null/null.

Hello,

I believe, you should configure the route based VPN. Adding the local and remote as ANY is not permissible! Using route based VPN, you can control your traffic using static routes!

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/VPN/SiteToSiteVPN/VPNRoutebased/index.html

Hello there,

Most likely you haven't changed the type of tunnel, you need to select Tunnel Interface mode.

Regards,