Branches office cannot communicate thought Ipsec of head office

Samps,

use a traceroute from each branch office to understand where the traffic goes. If it go through internet, you have to add a static route on each branch office that uses the IPSec as gateway or interface.

Regards

Hi Lferrara,

I thought that add appropriate lan to Ipsec HQ and BOs on local network or Remote network would assign static route.

I remove ''Rewrite source address (Masquerading)' on Firewall rule VPN to Lan in HQ and it's working. I can communicate between BOs

But doing that I lost the possibility to route SSL Vpn traffic (internet) thought my HQ. Is there any option to fix that?

Thanks, 

Regards,

Samps,

rewrite source address is not needed on those rules. For routing internet traffic from branch office to HQ, uhm....you can create a firewall rule VPN to WAN (MASQ on) and additionally, you need to  change the remote network on branch office to any and on HQ the local network to any.https://community.sophos.com/kb/en-us/115661It is for UTM9 but you can see the changes required or:https://kb.cyberoam.com/default.asp?id=2617

Regards

Samps,

rewrite source address is not needed on those rules. For routing internet traffic from branch office to HQ, uhm....you can create a firewall rule VPN to WAN (MASQ on) and additionally, you need to  change the remote network on branch office to any and on HQ the local network to any.https://community.sophos.com/kb/en-us/115661It is for UTM9 but you can see the changes required or:https://kb.cyberoam.com/default.asp?id=2617

Regards

lferrara,

Sorry I wasn't clear.

Here is my setup :

BO1-------Ipsec------HQ------Ipec-----BO2     and I had SSL VPN to HQ when we are on road.

Since I remove ''rewrite source address'' on VPN to Lan on HQ firewall rules, booth BO can communicate between them (ping/share...)

But since I made this modification, from my SSL VPN outside offices (BO and HQ), I can communicate with LANs but not acces to internet.

Regards,

So if I understood correctly, ssl vpn for remote users, correct?

If this is the case, create an above firewall rule where source is vpn but source network is the ip-range leased by the XG vpn ssl component. You can find the leased ip from vpn > show vpn settings>ssl

Regards

Hi lferrara,

Correct, it's for remote users.

I created the rule VPN (IP-range-SSL as source) to Lan but no acces to internet. The only way is to active Masq but in this cas I lost ping/share to BOs

Regards,

Samps,

clone this rule but change the LAN to WAN and enable Masq.

It should work!

Regards

And It works!

Thanks a lot,

Regards,