WAF backend over IPsec tunnel

Hi Jan W  Can you please validate some of the commands mentioned in the below guide to confirm which IP is communicating with WAF over VPN from the XG where WAF over VPN is configured?

support.sophos.com/.../KB-000039300

XGS2100_RL01_SFOS 19.5.0 GA-Build197 HA-Primary# ip route get 192.168.131.110
192.168.131.110 dev ipsec0 table 220 src 192.168.123.1 uid 0
cache

The WAF has source on Port2 with is the WAN Port. is this the issuse? 

Hi Jan W  Is System NAT Applied for 192.168.131.110 to NAT it via Firewall LAN Interface IP or any LAN device IP which is part of the tunnel network? If not yet applied then try the same as per the below KBA and confirm the status.

Sophos XG Firewall: How to NAT Sophos Firewall generated traffic

support.sophos.com/.../KB-000035607

Hi

There was no SNAT rule. I have now added one with following command:

set advanced-firewall sys-traffic-nat add destination 192.168.131.0 snatip 192.168.123.1

Result:

 NAT policy for system originated traffic
        ---------------------
        Destination Network     Destination Netmask     Interface       SNAT IP
        192.168.131.110         255.255.255.255                         192.168.123.1

But it still does not work...

Regards

Jan

Hi Jan W : Thanks for sharing the latest update, After SNAT try to check TCPDUMP on both the XG during access WAF on WAF Server IP to confirm and validate more and if required you may log a support case to investigate it further and to conclude it.

Hi Jan W : Thanks for sharing the latest update, After SNAT try to check TCPDUMP on both the XG during access WAF on WAF Server IP to confirm and validate more and if required you may log a support case to investigate it further and to conclude it.