Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 13 replies
  • Subscribers 2 subscribers
  • Views 7823 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to route traffic originating on UTM to server in Amazon VPC?

thedukeness
I want to do DNS request routing to a DNS server located in an Amazon VPC.  I have the Amazon VPC Site-to-Site VPN set up.  My SSL Remote Access users can access the resources on the VPC.  The problem is the UTM itself can't ping ips in the VPC.

I ssh into the UTM as loginuser and ping a server in the VPC, then I run tcpdump on that server and I get this result:

18:33:51.204157 IP 169.254.254.74 > 10.6.30.201: ICMP echo request, id 20818, seq 59, length 64
18:33:51.204192 IP 10.6.30.201 > 169.254.254.74: ICMP echo reply, id 20818, seq 59, length 64

So the problem is traffic originating on the UTM is reporting a link local address to stuff in the VPC.  Is there a way to make this work?  I'd like the traffic to come from the internal interface or at least a real ip.


This thread was automatically locked due to age.
Parents
  • 0
    10.2.0.0/16 which is the VPC subnet I have my UTM's public and private interfaces located in.

    Is the 10.2/16 subnet in AWS or is that your local subnet?  Do you really have more than one UTM interface connected to that subnet?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0
    10.2.0.0/16 which is the VPC subnet I have my UTM's public and private interfaces located in.

    Is the 10.2/16 subnet in AWS or is that your local subnet?  Do you really have more than one UTM interface connected to that subnet?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • 0 in reply to BAlfson
    10.2/16 is in AWS.  To be clear, my UTM is in AWS.  Its the one you get here in the marketplace from Sophos:

    https://aws.amazon.com/marketplace/pp/B00DJDRZB2

    Within that 10.2/16 which is my VPC in AWS, I have two subnets set up which I use for my two UTM interfaces:

    External
    10.2.0.0/24 subnet
    10.2.0.5 interface address (attached to an elastic ip)

    Internal
    10.2.10.0/24 subnet
    10.2.10.5 interface address (I have this routed to some other VPCs in this same region via VPC peering)
Unfiltered HTML