Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 6 replies
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 23022 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-site connection between Sophos XG and FritzBox: No Ping

JelkoSeiboth

After lots of try and error, I finally got the connection between a FritzBox 6842 LTE and a Sophos XG Firewall running. Each device tells me that the connection is established and shows the right information about the local and the remote network.

Neither executing the ping command form the XG Firewall nor trying a traceroute do work.

In the /log/ipsec.log file the following error occurs during the connection:

up-client output: route: netmask and route address conflict


I am sure the network adresses are configured right.

What could be the problem?



This thread was automatically locked due to age.
Parents
  • 0

    Jelko,

    can you share the vpn configuration screenshot?

    Thanks.

  • 0 in reply to lferrara

    Sure, this is the configuration of the XG Firewall:

    The policy:

    The VPN config file of my FritzBox looks like this:

    vpncfg {
            connections {
                    enabled = yes;
                    conn_type = conntype_lan;
                    name = "XXX";
                    always_renew = yes;
                    reject_not_encrypted = no;
                    dont_filter_netbios = yes;
                    localip = 0.0.0.0;
                    local_virtualip = 0.0.0.0;
                    remoteip = 12.34.56.78;
                    remote_virtualip = 0.0.0.0;
                    localid {
                            ipaddr = "169.254.1.100";
                    }
                    remoteid {
                            ipaddr = "12.34.56.78";
                    }
                    mode = phase1_mode_idp;
                    phase1ss = "dh14/aes/sha";
                    keytype = connkeytype_pre_shared;
                    key = "XXX";
                    cert_do_server_auth = no;
                    use_nat_t = no;
                    use_xauth = no;
                    use_cfgmode = no;
                    phase2localid {
                            ipnet {
                                    ipaddr = 192.168.100.0;
                                    mask = 255.255.255.0;
                            }
                    }
                    phase2remoteid {
                            ipnet {
                                    ipaddr = 192.168.1.0;
                                    mask = 255.255.255.0;
                            }
                    }
                    phase2ss = "esp-all-all/ah-none/comp-all/pfs";
                    accesslist = "permit ip any 192.168.1.0 255.255.255.0";
            }
            ike_forward_rules = "udp 0.0.0.0:500 0.0.0.0:500",
                                "udp 0.0.0.0:4500 0.0.0.0:4500";
    }


    // EOF



  • 0 in reply to JelkoSeiboth

    Jelko,

    under Endpoints details put into local id the XG WAN IP address and remote ID the Fritzbox WAN IP address and not any. Also phase 2 on Fritzbox is:

    phase2ss = "esp-all-all/ah-none/comp-all/pfs"; while the Phase2 on XG is different. Can you check that?

  • 0 in reply to lferrara

    That's a bit tricky. The FritzBox is uses a Vodafone LTE SIM to connect to the internet, Vodafone uses a "private" subnet for their LTE customers, e.g. you are not able to connect to the FritzBox from the Internet. That's why I used a APIPA address as remote ID for the FritzBox.


    Anyway, I have set up a dynamic dns domain for it, which I will try to put in as remote ID under Endpoint Details.

    I think by setting phase2ss like that the FritzBox uses the same proposals in phase2 as in phase1. It's a bit tricky because the FritzBox VPN Client is not documented to good.

    They did it se same way (just have a look to the code-boxes): blog.webernetz.net/.../

Reply
  • 0 in reply to lferrara

    That's a bit tricky. The FritzBox is uses a Vodafone LTE SIM to connect to the internet, Vodafone uses a "private" subnet for their LTE customers, e.g. you are not able to connect to the FritzBox from the Internet. That's why I used a APIPA address as remote ID for the FritzBox.


    Anyway, I have set up a dynamic dns domain for it, which I will try to put in as remote ID under Endpoint Details.

    I think by setting phase2ss like that the FritzBox uses the same proposals in phase2 as in phase1. It's a bit tricky because the FritzBox VPN Client is not documented to good.

    They did it se same way (just have a look to the code-boxes): blog.webernetz.net/.../

Children
No Data