This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSec Site to Site VPN - no traffic

Hi,

I am trying to configure site to site VPN between an Sophos UTM 9.006_5 on site "A" against a WatchGuard on site "B".

Right after the initial configuration, I was able to ping an IP address on the remote subnet. The day after it stopped and has never worked ever since.

Nothing was changed on the Astaro and the "other guy" claims nothing was changed on the WatchGuard.

Both firewalls shows the tunnel is up, but neither can ping to the other side.

I am quite sure all parameters for main and quick mode is correct (checked multiple times) but I cannot seem to spot the problem.

I enabled debug logging and collected this log from the ASG. Hope someone can provide some input.

Thx.

This thread was automatically locked due to age.

ASG.zip

Parents

0 jarle over 12 years ago

Hi

Post your ipsec and ike config.
First look seems that can be some key lifetime or time diffrent on the fw.

Jarle.
Cancel
Vote Up 0 Vote Down

Cancel
0 jpvj over 12 years ago in reply to jarle

Both ends are directly connected to a WAN connection (no NAT).
DPD is currently off, but was initially off. No difference.

We are using a preshared key.
None of the advanced settins on the remote gw settings are enabled (MTU discovery, ECN or XAUTH mode).

I have our Internal network (/24) as local network, and their /24 as remote Network.
Automatic firewall rules are enabled.

IPSec policy:

IKE encrypt: 3DES
IKE auth: SHA1
IKE SA lifetime: 28800 (8 hours)
IKE DH Group: Group 2

IPSec encr: AES 128
IPSec auth: SHA1
IPSec lifetime: 28800 (8 hours)
IPSec PFS: None

Strict policy and compression is off.

I have not access to the other firewall but have requested screenshots of all settings. I will expect to have them tomorrow.

The settings are "dictated" by the other part, but can be changed upon request.

Our local WAN IP scope is a /29 range:
.40 is Network ID
.41 is gateway
.42 is IP of the FW and also used for DNAT'ing (primarily RDP to different ports beeing mapped to 3389 on several servers).
.43 Unused
.44 Unused
.45 Unused
.46 Unused
.47 Broadcast

Should it cause any issues to do NAT'in on the IP of the FW?

/JP
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 jpvj over 12 years ago in reply to jarle

Both ends are directly connected to a WAN connection (no NAT).
DPD is currently off, but was initially off. No difference.

We are using a preshared key.
None of the advanced settins on the remote gw settings are enabled (MTU discovery, ECN or XAUTH mode).

I have our Internal network (/24) as local network, and their /24 as remote Network.
Automatic firewall rules are enabled.

IPSec policy:

IKE encrypt: 3DES
IKE auth: SHA1
IKE SA lifetime: 28800 (8 hours)
IKE DH Group: Group 2

IPSec encr: AES 128
IPSec auth: SHA1
IPSec lifetime: 28800 (8 hours)
IPSec PFS: None

Strict policy and compression is off.

I have not access to the other firewall but have requested screenshots of all settings. I will expect to have them tomorrow.

The settings are "dictated" by the other part, but can be changed upon request.

Our local WAN IP scope is a /29 range:
.40 is Network ID
.41 is gateway
.42 is IP of the FW and also used for DNAT'ing (primarily RDP to different ports beeing mapped to 3389 on several servers).
.43 Unused
.44 Unused
.45 Unused
.46 Unused
.47 Broadcast

Should it cause any issues to do NAT'in on the IP of the FW?

/JP
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data

IPSec Site to Site VPN - no traffic

Submitted a Tech Support Case lately from the Support Portal?