Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 26 subscribers
  • Views 3296 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Setting up an XG as a secondary device for VPN traffic only?

Dru DuBay

My question applies to two different situations I'm in...

 

First, I have a large client with a full Cisco network, many VLANs, dual Cisco ASA 5510's as their gateway. Their ASA's don't have active support, and the VPN client no longer supports Windows 10 and MacOS. The VPN users only need to access a single VLAN. I'm looking at my options, and one that came to mind was setting up an XG for VPN. I would assign it a public IP and an IP on the LAN. I know this would work in terms of users connecting to the VPN and accessing certain things, I just think it may have issues. The devices on the LAN would retain the ASA as their gateway. The users would only need SMB access to Windows file servers on the LAN. As far as my concerns, see my second scenario below. 

Second, I have a client with an XG firewall, it's set as their gateway for the LAN. Users are unable to use their ShoreTel software on the XG's SSL VPN, I have support cases, forums posts, I'm an XG certified engineer, no one has been able to make it work. The ShoreTel software had no issues on their previous firewall, a Cyberoam. I'm able to connect to the VPN on the Cyberoam, but it doesn't work. I acuate this to the gateway mismatch, traffic comes in on Cyberoam VPN, hits the server, then the server tries to send it out through it's XG gateway which isn't aware of the Cyberoam. This may be fixable by some type of routing but I'm not sure how. 

-Dru



This thread was automatically locked due to age.
  • 0

    Dru,

    first of all make sure next time you ask one question per thread.

    For the first scenario, you can make the VPN access working if the Cisco ASA knows the VPN Remote Users networks. So let me clarify with an example:

    Let's suppose your XG Remote VPN users will receive a 10.10.10.0/24 Ip address so they are able to access the Windows Share (because XG has a lan ip address), the problem is the reverse traffic, when the Windows Server have to reply to XG remote users. They will send the layer 3 requests to Cisco which will send the request to internet. So make sure Cisco ASA forward 10.10.10.0/24 traffic to XG LAN address. Second, you will have asymmetric routing on XG so you need to manage it using advanced-firewall command line exceptions.

    For the second scenario, the behaviour is the same.

    Make sure to allow traffic back and forth on both ASA and Cisco.

    Let us know.

    Regards