Sophos XG Use 0.0.0.0/0 for IPsec tunnel traffic

Hello,

Greetings, thank you for contacting Sophos Community!

You may refer to the below KBA for the detailed steps:

support.sophos.com/.../KB-000035798

That did not help much. I would like to use Any on both local and remote in IPSec tunnel and use Static Route to control what goes through it. My combined subnets is bigger than 192/2 on both sides.

Hello there,

Then you would need to configure your IPsec as a Tunnel Interface, this will create a 0.0.0.0/0 in the tunnels, and then you can control the traffic via Static Routes.

Regards,

Yes. the issue is I can not use 0.0.0.0/0 on both local and remote

Hello there,

Sorry can you clarify? When you set the tunnel as Tunnel Interface you don't need to fill out the Local o Remote Subnet, it’ll automatically be 0.0.0.0/0 on both sides.

Regards,

Getting same error if choosing Any/Any or null/null.

Hello,

I believe, you should configure the route based VPN. Adding the local and remote as ANY is not permissible! Using route based VPN, you can control your traffic using static routes!

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/VPN/SiteToSiteVPN/VPNRoutebased/index.html

Hello there,

Most likely you haven't changed the type of tunnel, you need to select Tunnel Interface mode.

Regards,

Hello there,

Most likely you haven't changed the type of tunnel, you need to select Tunnel Interface mode.

Regards,