Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 6 replies
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 23020 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-site connection between Sophos XG and FritzBox: No Ping

JelkoSeiboth

After lots of try and error, I finally got the connection between a FritzBox 6842 LTE and a Sophos XG Firewall running. Each device tells me that the connection is established and shows the right information about the local and the remote network.

Neither executing the ping command form the XG Firewall nor trying a traceroute do work.

In the /log/ipsec.log file the following error occurs during the connection:

up-client output: route: netmask and route address conflict


I am sure the network adresses are configured right.

What could be the problem?



This thread was automatically locked due to age.
  • 0

    Jelko,

    can you share the vpn configuration screenshot?

    Thanks.

  • 0 in reply to lferrara

    Sure, this is the configuration of the XG Firewall:

    The policy:

    The VPN config file of my FritzBox looks like this:

    vpncfg {
            connections {
                    enabled = yes;
                    conn_type = conntype_lan;
                    name = "XXX";
                    always_renew = yes;
                    reject_not_encrypted = no;
                    dont_filter_netbios = yes;
                    localip = 0.0.0.0;
                    local_virtualip = 0.0.0.0;
                    remoteip = 12.34.56.78;
                    remote_virtualip = 0.0.0.0;
                    localid {
                            ipaddr = "169.254.1.100";
                    }
                    remoteid {
                            ipaddr = "12.34.56.78";
                    }
                    mode = phase1_mode_idp;
                    phase1ss = "dh14/aes/sha";
                    keytype = connkeytype_pre_shared;
                    key = "XXX";
                    cert_do_server_auth = no;
                    use_nat_t = no;
                    use_xauth = no;
                    use_cfgmode = no;
                    phase2localid {
                            ipnet {
                                    ipaddr = 192.168.100.0;
                                    mask = 255.255.255.0;
                            }
                    }
                    phase2remoteid {
                            ipnet {
                                    ipaddr = 192.168.1.0;
                                    mask = 255.255.255.0;
                            }
                    }
                    phase2ss = "esp-all-all/ah-none/comp-all/pfs";
                    accesslist = "permit ip any 192.168.1.0 255.255.255.0";
            }
            ike_forward_rules = "udp 0.0.0.0:500 0.0.0.0:500",
                                "udp 0.0.0.0:4500 0.0.0.0:4500";
    }


    // EOF



  • 0 in reply to JelkoSeiboth

    Jelko,

    under Endpoints details put into local id the XG WAN IP address and remote ID the Fritzbox WAN IP address and not any. Also phase 2 on Fritzbox is:

    phase2ss = "esp-all-all/ah-none/comp-all/pfs"; while the Phase2 on XG is different. Can you check that?

  • 0 in reply to lferrara

    That's a bit tricky. The FritzBox is uses a Vodafone LTE SIM to connect to the internet, Vodafone uses a "private" subnet for their LTE customers, e.g. you are not able to connect to the FritzBox from the Internet. That's why I used a APIPA address as remote ID for the FritzBox.


    Anyway, I have set up a dynamic dns domain for it, which I will try to put in as remote ID under Endpoint Details.

    I think by setting phase2ss like that the FritzBox uses the same proposals in phase2 as in phase1. It's a bit tricky because the FritzBox VPN Client is not documented to good.

    They did it se same way (just have a look to the code-boxes): blog.webernetz.net/.../

  • 0 in reply to lferrara

    Ok I tried it now but I still could not recognize any change.

    My ipsec.log looks like like this now:

    Apr 20 09:01:40 packet from 109.84.1.153:36240: received Vendor ID payload [XAUTH]
    Apr 20 09:01:40 packet from 109.84.1.153:36240: received Vendor ID payload [Dead Peer Detection]
    Apr 20 09:01:40 "Eifel2-1" #65: responding to Main Mode
    Apr 20 09:01:40 "Eifel2-1" #65: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
    Apr 20 09:01:40 "Eifel2-1" #65: STATE_MAIN_R1: sent MR1, expecting MI2
    Apr 20 09:01:42 "Eifel2-1" #65: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
    Apr 20 09:01:42 "Eifel2-1" #65: STATE_MAIN_R2: sent MR2, expecting MI3
    Apr 20 09:01:43 "Eifel2-1" #65: Main mode peer ID is ID_IPV4_ADDR: '169.254.1.100'
    Apr 20 09:01:43 "Eifel2-1" #65: I did not send a certificate because I do not have one.
    Apr 20 09:01:43 "Eifel2-1" #65: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
    Apr 20 09:01:43 "Eifel2-1" #65: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=o
    Apr 20 09:01:44 "Eifel2-1" #66: responding to Quick Mode {msgid:a93050b1}
    Apr 20 09:01:44 "Eifel2-1" #66: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
    Apr 20 09:01:44 "Eifel2-1" #66: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
    Apr 20 09:01:45 "Eifel2-1" #66: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
    Apr 20 09:01:45 "Eifel2-1" #66: STATE_QUICK_R2: IPsec SA established {ESP=>0x5c9cfb8e <0x28e5264f xfrm=AES_256-HMAC_SHA1 IPCOM
    Apr 20 09:02:55 "Eifel2-1" #64: max number of retransmissions (20) reached STATE_MAIN_I1.  No response (or no acceptable respo
    Apr 20 09:02:55 "Eifel2-1" #64: starting keying attempt 45 of an unlimited number
    Apr 20 09:02:55 "Eifel2-1" #67: initiating Main Mode to replace #64

    I think the XG does not get a correct ip, according to the ifconfig:

    ipsec0    Link encap:Ethernet  HWaddr 22:AB:CC:31:D1:B4
              inet addr:169.254.234.5  Bcast:0.0.0.0  Mask:255.255.255.255
              inet6 addr: fe80::20ab:ccff:fe31:d1b4/64 Scope:Link
              UP BROADCAST RUNNING NOARP MULTICAST  MTU:16260  Metric:1
              RX packets:0 errors:0 dropped:0 overruns:0 frame:0
              TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:0
              RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

  • +1

    Hi,

    I finally got it all running. I just waited for the update to XG v17 and found a stable solution for this (rather undocumented) problem.

    So anybody for who might has the same problems with a FritzBox (6842 LTE, but it should also work on others) behind a carrier-grade NAT, I want to share my solution/settings.

    This is the config-file for the FritzBox:

    vpncfg {
            connections {
                    enabled = yes;
                    conn_type = conntype_lan;
                    name = "Sophos_IPSEC_ikev1_Mainmode";
                    always_renew = yes;
                    reject_not_encrypted = no;
                    dont_filter_netbios = yes;
                    localip = 0.0.0.0;
                    local_virtualip = 0.0.0.0;
                    remoteip = 12.34.45.56; // Change to Sophos External IP
                    remote_virtualip = 0.0.0.0;
                    localid {
                            fqdn = "my.fqdn.net"; // Change
                    }
                    remoteid {
                            ipaddr = "12.34.45.78"; // Change
                    }
                    mode = phase1_mode_idp; // Main Mode
                    phase1ss = "dh14/aes/sha";
                    keytype = connkeytype_pre_shared;
                    key = "xxx"; // has to be changed
                    cert_do_server_auth = no;
                    use_nat_t = yes;
                    use_xauth = no;
                    use_cfgmode = no;
                    phase2localid {
                            ipnet {
                                    ipaddr = 192.168.23.45; // change
                                    mask = 255.255.255.0;
                            }
                    }
                    phase2remoteid {
                            ipnet {
                                    ipaddr = 192.168.45.67; // change
                                    mask = 255.255.255.0;
                            }
                    }
                    phase2ss = "esp-aes256-3des-sha/ah-no/comp-lzs-no/pfs";
                    accesslist = "permit ip any 192.168.45.67 255.255.255.0"; // change IP
            }
            ike_forward_rules = "udp 0.0.0.0:500 0.0.0.0:500",
                                "udp 0.0.0.0:4500 0.0.0.0:4500";
    }


    // EOF

    Sophos XG:

    I will not add a picture of the general IPSec VPN settings on this point because it is trivial. You just have to enter the appropriate values for the IDs, select Site-to-Site as Connection Type and choose the right policy. The policy settings are a bit more tricky, so here is a picture of them:

    As you can see, the authentication method (SHA1) is marked as insecure. Unfortunately AVM does not offer any better method for this, but it works.

    There are two blog posts by Johannes Weber that helped me a lot (in German):

    https://blog.webernetz.net/fritzos-ab-06-23-ipsec-p2-proposals-erweitert/

    https://blog.webernetz.net/ipsec-site-to-site-vpn-fortigate-fritzbox/

     

    Best regards,

    Jelko