Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 14 replies
  • Subscribers 28 subscribers
  • Views 31317 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Please Provide me with a Step by Step Firewall Rule Creaton Tutorial for l2tp/IPsec remote access

n1ete

Hey there Folks! 

I came from Linux Server world where everything is plain and simple! I am a bit Overwhelmed by the Graphical User Interface and i am not be able to open Ports on my XG for IPSEC / l2tp connections

 

i am pretty sure i configured everything right under the VPN Section already and created and added some local users for l2tp connections

but i get mainly two errors in the log:

 

1.

est-p1-am: response to establishment request from xxx.xxx.xxx.xxx failed. there is no active connection is defined for this peer OR verify ID configuration at both ends

2.

est-p1: system did not accept any proposal received. need to reconfigure the connection on either of the ends

 

i think the first one has something to do with port forwarding

the thing is when i want to add some rules into the firewall it just let me choose between some templates but i cant choose the classical way some ports for source and destination....

i feel kinda stupid because i set several working vpn connections up in my life...just with this sophos stuff not

the connections are mainly used for mac os client systems...

 

so please provide me with a small step by step tutorial for setting up my own fw rules

 

i saw another step by step request here but it didnt provide me with the exact steps what i needed....

 

thank you so much ear sophos community

 



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to lferrara

    Hi Luk,

    I have exactly the same issue trying to setup IPSEC between XG and Fortinet. Any idea how to get around this issue? Appreciate your help.

    Thank you.

  • 0 in reply to PGP

    Posh,

    Have a look at this thread:

    Regards

  • 0 in reply to lferrara

    Thank you for your reply Luk. I changed the algorithm however still getting the same error in XG. Not sure if there is something else I'm missing here :(

  • 0 in reply to PGP

    Posh,

    You can try to restart vpn service using console. If it does not help, open a ticket with support and let us know.

    Regards

  • 0 in reply to lferrara

    That did not help either. I will open a support ticket.

    Regards,

    Posh

  • 0 in reply to PGP

    I would look at these things if your tunnel is ipsec,  i have not configure l2tp but i have around 10 ipsec policies on  my xg that i have had to configure multiple times due to changing the device host name, bridge the wan port, and changing the xg gateway and bridge mode.

    If the wan ip is different from  the public ip you need to add aliase for your other public ips with \32 subnet.  May not be necessary but you might check it if your policy depends on a different wan gateway.

    Enter ipsec profile carefully

    Create ipsec policy and select the ipsec profile

    Set key to auto connect or something like that

    Make sure the encryption settings match up with the other side of the tunnel.

    I have typed the passcode key wrong before...

    Make sure you click on the red circles and hope they turn green. When light is green you can see what parts of your ipsec connection is working which is pretty cool.

    If the vpn depends on a static route it won't work.

    If you have stateless and stateful traffic going back and forth you might have to look into bypass stateful traffic as last resort.

    Also every host needs to be entered one at a time in the allow access to, you can't put a group host object in the settings.

    I currently have a problem with needing ipsec policies and have 3 hosted routers from our datacenter that i don't know what to do with yet, but i got building ipsec VPN policies down!

  • 0 in reply to B.R.O.

    Thank you for all your responses. Finally got it working with the help of sophos support. Fortigate unit was behind nat so the remote address had to be entered into remote ID in order to allow. Had to make fortigate and Sophos to use AES128/256 MD5 and 2DES MD5. All worked after making the changes. Thank you again for your support.