Firewall XG135 failed to connect to Domain controller in Azure via site-to-site VPN tunnel

Hello Bryant Lim ,

Thank you for reaching out to the community, please refer the following KBA - Sophos Firewall: Integrate Sophos Firewall with Azure AD

Thanks Vivek Jagad , thanks to propose the alternative method to use the Azure AD domain services for SSL VPN authentication, but it will cost me U$100++/month to use this service.

I am looking for solution that I am facing as above mentioned. Only the firewall IP (192.168.88.254) can't reach out to Azure network (192.168.99.0/24), and other servers (192.168.88.x) can connect to Azure network (192.168.99.0/24).

This could be due to the routing or policy but I couldn't capture any log when trying to ping the DC (192.168.99.43) in Sophos Diagnostic tools.

Appreciate of someone to shed some light.

Please share a packet capture and ensure under the administration > device access > VPN zone the services like PING and client auth is allowed...
May we know the current SFOS version ?

Thanks Vivek Jagad . The services allowed under Device access > VPN zone is same as the LAN, both PING and Client Auth are allowed.

The packet capture couldn't get the log when tested the ping from firewall (192.168.88.254) to Domain controller (192.168.99.43). The test ping from my laptop (192.168.88.124) to Domain controller (192.168.99.43) was captured. 

The current firmware is SFOS 18.5.1 MR-1-Build326.

Hey Bryant Lim , I would request you to upgrade the firmware to at least v18.5 MR-4...
As SFOS 18.5.1 MR-1 has been declared EoL 07-DEC-2022
You can find the release notes, changes, bugfixes here - https://docs.sophos.com/releasenotes/index.html?productGroup
Select Product type: Network Security, Product: Sophos Firewall and the desired version you wish to upgrade !

Sure, will try to upgrade to latest and update if this help. Thanks Vivek Jagad 

Hello Bryant,

Additionally, to what Vivek said, make sure you’re following this KB. (Routing Sophos Firewall-initiated traffic).

IF the issue persists after you have upgraded to a supported version and you have followed the KB I mentioned, please share the packet capture Vivek mentioned. 

Regards,

Thanks emmosophos  and Vivek Jagad , by following the KB-000035839, the firewall now can connect to the Domain Controller that sit in remote network via IPSec.

Thanks emmosophos  and Vivek Jagad , by following the KB-000035839, the firewall now can connect to the Domain Controller that sit in remote network via IPSec.