This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Newbie Site-to-Site VPN Sophos v9 with Cisco 1941 router trouble!

Hi All!

Please I have some trouble getting cisco and Sophos UTM v9 to send and receive traffic over A vpn I setup. The tunnel is up which is great (green in astaro and good isakmp ipsec status in Cisco), but I can't seem to send traffic to either side.

The devices are close on the same subnet externally, so I hope this isn't a problem?
Astaro internal: 192.168.2.0/24
Astaro external: 62.1.1.50

Cisco 1941 internal: 192.168.20.0/24
Cisco 1941 external: 62.1.1.122

Please see below my configurations and outputs, and please help!

From Astaro ipsec status I have:

ipsec status | grep -i THEIRS
000 "S_REF_IpsSitTHEIRSmmo_0": 192.168.2.0/24===62.1.1.50[62.1.1.50]...62.1.1.122[62.1.1.122]===192.168.20.0/24; erouted; eroute owner: #81931
000 "S_REF_IpsSitTHEIRSmmo_0":   newest ISAKMP SA: #81930; newest IPsec SA: #81931;
000 #81931: "S_REF_IpsSitTHEIRSmmo_0" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 84046s; newest IPSEC; eroute owner
000 #81931: "S_REF_IpsSitTHEIRSmmo_0" esp.f060294b@62.1.1.122 (672 bytes, 1064s ago) esp.8fe37822@62.1.1.50 (0 bytes); tunnel
000 #81930: "S_REF_IpsSitTHEIRSmmo_0" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 83620s; newest ISAKMP

From tcpdump on Astaro:

10:17:55.932774 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 112) 62.1.1.50.500 > 62.1.1.122.500: isakmp 1.0 msgid : phase 2/others I inf[E]: [encrypted hash]
10:17:55.934349 IP (tos 0x0, ttl 254, id 3357, offset 0, flags [none], proto UDP (17), length 112) 62.1.1.122.500 > 62.1.1.50.500: isakmp 1.0 msgid : phase 2/others R inf[E]: [encrypted hash]
10:18:25.380016 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 112) 62.1.1.50.500 > 62.1.1.122.500: isakmp 1.0 msgid : phase 2/others I inf[E]: [encrypted hash]
10:18:25.381717 IP (tos 0x0, ttl 254, id 3358, offset 0, flags [none], proto UDP (17), length 112) 62.1.1.122.500 > 62.1.1.50.500: isakmp 1.0 msgid : phase 2/others R inf[E]: [encrypted hash]

10:18:55.938298 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 112) 62.1.1.50.500 > 62.1.1.122.500: isakmp 1.0 msgid : phase 2/others I inf[E]: [encrypted hash]
10:18:55.939912 IP (tos 0x0, ttl 254, id 3359, offset 0, flags [none], proto UDP (17), length 112) 62.1.1.122.500 > 62.1.1.50.500: isakmp 1.0 msgid : phase 2/others R inf[E]: [encrypted hash]

This is my Cisco 1941 configuration:

!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key ****** address 62.1.1.50
!
!
crypto ipsec transform-set TS-MY esp-3des esp-md5-hmac
!
crypto map MYMAP 10 ipsec-isakmp
set peer 62.1.1.50
set transform-set TS-MY
match address MY-VPN-TRAFFIC
!
!
!
!
interface GigabitEthernet0/0
description WAN CONNECTION
ip address 62.1.1.124 255.255.255.248 secondary
ip address 62.1.1.123 255.255.255.248 secondary
ip address 62.1.1.122 255.255.255.248
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map MYMAP
!
ip nat inside source list 100 interface GigabitEthernet0/0 overload
!
!
ip route 192.168.2.0 255.255.255.0 GigabitEthernet0/0
!
ip access-list extended MY-VPN-TRAFFIC
permit ip 192.168.20.0 0.0.0.255 192.168.2.0 0.0.0.255
!
access-list 1 permit 192.168.20.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 192.168.2.0 0.0.0.255

This thread was automatically locked due to age.

0 BAlfson over 11 years ago

Please Disable the IPsec Connection, open the IPsec Live Log and show us the lines from a single connection attempt.

Also, [Go Advanced] below and attach pictures of the Edit of your IPsec Policy and of the Site-to-site VPN tunnel status.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 notify.sina over 11 years ago

Hi Bob

Thanks for answering! I disabled and renabled the IPSec Connection, see LiveLog output for that connection below (The actual VPN name is Fortis, not THEIRS, and the public IPs are 62.173.32.50 and 62.173.32.122, my sad attempt at keeping secrets):

2013:09:22-10:47:27 qfw1 pluto[6761]: "S_THEIRSMMO": deleting connection
2013:09:22-10:47:27 qfw1 pluto[6761]: "S_THEIRSMMO" #85340: deleting state (STATE_QUICK_I2)
2013:09:22-10:47:27 qfw1 pluto[6761]: | executing down-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='down-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17637' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:47:27 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" prospective erouted: self; eroute owner: self
2013:09:22-10:47:27 qfw1 pluto[6761]: "S_THEIRSMMO" #84383: deleting state (STATE_MAIN_I4)
2013:09:22-10:47:27 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" unrouted: NULL
2013:09:22-10:47:27 qfw1 pluto[6761]: | executing unroute-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='unroute-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17637' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:02 qfw1 pluto[6761]: added connection description "S_THEIRSMMO"
2013:09:22-10:49:02 qfw1 pluto[6761]: | Queuing pending Quick Mode with 62.1.1.122 "S_THEIRSMMO"
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: initiating Main Mode
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: received Vendor ID payload [RFC 3947]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: enabling possible NAT-traversal with method 3
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ignoring Vendor ID payload [Cisco-Unity]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: received Vendor ID payload [Dead Peer Detection]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ignoring Vendor ID payload [e86b7d7f3af5308e80237602642eac3d]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: received Vendor ID payload [XAUTH]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: NAT-Traversal: Result using RFC 3947: no NAT detected
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: Peer ID is ID_IPV4_ADDR: '62.1.1.122'
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: Dead Peer Detection (RFC 3706) enabled
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ISAKMP SA established
2013:09:22-10:49:02 qfw1 pluto[6761]: | unqueuing pending Quick Mode with 62.1.1.122 "S_THEIRSMMO"
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#85409}
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
2013:09:22-10:49:02 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" unrouted: NULL; eroute owner: NULL
2013:09:22-10:49:02 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" unrouted: NULL; eroute owner: NULL
2013:09:22-10:49:02 qfw1 pluto[6761]: | executing up-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='up-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17641' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:02 qfw1 pluto[6761]: | executing prepare-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='prepare-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17641' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:02 qfw1 pluto[6761]: | executing route-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='route-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17641' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:03 qfw1 pluto[6761]: | route_and_eroute: instance "S_THEIRSMMO", setting eroute_owner {spd=0x91a1b88,sr=0x91a1b88} to #85410 (was #0) (newest_ipsec_sa=#0)
2013:09:22-10:49:03 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: sent QI2, IPsec SA established {ESP=>0xb2ceae1b
Cancel
Vote Up 0 Vote Down

Cancel
0 notify.sina over 11 years ago

Hi Bob

Thanks for answering! I disabled and renabled the IPSec Connection, see LiveLog output for that connection below (The actual VPN name is Fortis, not THEIRS, and the public IPs are 62.173.32.50 and 62.173.32.122, my sad attempt at keeping secrets):

2013:09:22-10:47:27 qfw1 pluto[6761]: "S_THEIRSMMO": deleting connection
2013:09:22-10:47:27 qfw1 pluto[6761]: "S_THEIRSMMO" #85340: deleting state (STATE_QUICK_I2)
2013:09:22-10:47:27 qfw1 pluto[6761]: | executing down-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='down-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17637' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:47:27 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" prospective erouted: self; eroute owner: self
2013:09:22-10:47:27 qfw1 pluto[6761]: "S_THEIRSMMO" #84383: deleting state (STATE_MAIN_I4)
2013:09:22-10:47:27 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" unrouted: NULL
2013:09:22-10:47:27 qfw1 pluto[6761]: | executing unroute-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='unroute-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17637' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:02 qfw1 pluto[6761]: added connection description "S_THEIRSMMO"
2013:09:22-10:49:02 qfw1 pluto[6761]: | Queuing pending Quick Mode with 62.1.1.122 "S_THEIRSMMO"
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: initiating Main Mode
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: received Vendor ID payload [RFC 3947]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: enabling possible NAT-traversal with method 3
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ignoring Vendor ID payload [Cisco-Unity]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: received Vendor ID payload [Dead Peer Detection]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ignoring Vendor ID payload [e86b7d7f3af5308e80237602642eac3d]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: received Vendor ID payload [XAUTH]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: NAT-Traversal: Result using RFC 3947: no NAT detected
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: Peer ID is ID_IPV4_ADDR: '62.1.1.122'
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: Dead Peer Detection (RFC 3706) enabled
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ISAKMP SA established
2013:09:22-10:49:02 qfw1 pluto[6761]: | unqueuing pending Quick Mode with 62.1.1.122 "S_THEIRSMMO"
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#85409}
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
2013:09:22-10:49:02 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" unrouted: NULL; eroute owner: NULL
2013:09:22-10:49:02 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" unrouted: NULL; eroute owner: NULL
2013:09:22-10:49:02 qfw1 pluto[6761]: | executing up-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='up-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17641' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:02 qfw1 pluto[6761]: | executing prepare-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='prepare-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17641' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:02 qfw1 pluto[6761]: | executing route-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='route-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17641' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:03 qfw1 pluto[6761]: | route_and_eroute: instance "S_THEIRSMMO", setting eroute_owner {spd=0x91a1b88,sr=0x91a1b88} to #85410 (was #0) (newest_ipsec_sa=#0)
2013:09:22-10:49:03 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: sent QI2, IPsec SA established {ESP=>0xb2ceae1b
Cancel
Vote Up 0 Vote Down

Cancel
0 notify.sina over 11 years ago

Hi Bob

Thanks for answering! I disabled and renabled the IPSec Connection, see LiveLog output for that connection below (The actual VPN name is Fortis, not THEIRS, and the public IPs are 62.173.32.50 and 62.173.32.122, my sad attempt at keeping secrets):

2013:09:22-10:47:27 qfw1 pluto[6761]: "S_THEIRSMMO": deleting connection
2013:09:22-10:47:27 qfw1 pluto[6761]: "S_THEIRSMMO" #85340: deleting state (STATE_QUICK_I2)
2013:09:22-10:47:27 qfw1 pluto[6761]: | executing down-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='down-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17637' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:47:27 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" prospective erouted: self; eroute owner: self
2013:09:22-10:47:27 qfw1 pluto[6761]: "S_THEIRSMMO" #84383: deleting state (STATE_MAIN_I4)
2013:09:22-10:47:27 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" unrouted: NULL
2013:09:22-10:47:27 qfw1 pluto[6761]: | executing unroute-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='unroute-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17637' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:02 qfw1 pluto[6761]: added connection description "S_THEIRSMMO"
2013:09:22-10:49:02 qfw1 pluto[6761]: | Queuing pending Quick Mode with 62.1.1.122 "S_THEIRSMMO"
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: initiating Main Mode
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: received Vendor ID payload [RFC 3947]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: enabling possible NAT-traversal with method 3
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ignoring Vendor ID payload [Cisco-Unity]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: received Vendor ID payload [Dead Peer Detection]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ignoring Vendor ID payload [e86b7d7f3af5308e80237602642eac3d]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: received Vendor ID payload [XAUTH]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: NAT-Traversal: Result using RFC 3947: no NAT detected
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: Peer ID is ID_IPV4_ADDR: '62.1.1.122'
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: Dead Peer Detection (RFC 3706) enabled
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ISAKMP SA established
2013:09:22-10:49:02 qfw1 pluto[6761]: | unqueuing pending Quick Mode with 62.1.1.122 "S_THEIRSMMO"
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#85409}
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
2013:09:22-10:49:02 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" unrouted: NULL; eroute owner: NULL
2013:09:22-10:49:02 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" unrouted: NULL; eroute owner: NULL
2013:09:22-10:49:02 qfw1 pluto[6761]: | executing up-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='up-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17641' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:02 qfw1 pluto[6761]: | executing prepare-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='prepare-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17641' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:02 qfw1 pluto[6761]: | executing route-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='route-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17641' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:03 qfw1 pluto[6761]: | route_and_eroute: instance "S_THEIRSMMO", setting eroute_owner {spd=0x91a1b88,sr=0x91a1b88} to #85410 (was #0) (newest_ipsec_sa=#0)
2013:09:22-10:49:03 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: sent QI2, IPsec SA established {ESP=>0xb2ceae1b
Cancel
Vote Up 0 Vote Down

Cancel
0 notify.sina over 11 years ago

Hi Bob

Thanks for answering! I disabled and renabled the IPSec Connection, see LiveLog output for that connection below (The actual VPN name is Fortis, not THEIRS, and the public IPs are 62.173.32.50 and 62.173.32.122, my sad attempt at keeping secrets):

2013:09:22-10:47:27 qfw1 pluto[6761]: "S_THEIRSMMO": deleting connection
2013:09:22-10:47:27 qfw1 pluto[6761]: "S_THEIRSMMO" #85340: deleting state (STATE_QUICK_I2)
2013:09:22-10:47:27 qfw1 pluto[6761]: | executing down-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='down-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17637' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:47:27 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" prospective erouted: self; eroute owner: self
2013:09:22-10:47:27 qfw1 pluto[6761]: "S_THEIRSMMO" #84383: deleting state (STATE_MAIN_I4)
2013:09:22-10:47:27 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" unrouted: NULL
2013:09:22-10:47:27 qfw1 pluto[6761]: | executing unroute-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='unroute-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17637' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:02 qfw1 pluto[6761]: added connection description "S_THEIRSMMO"
2013:09:22-10:49:02 qfw1 pluto[6761]: | Queuing pending Quick Mode with 62.1.1.122 "S_THEIRSMMO"
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: initiating Main Mode
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: received Vendor ID payload [RFC 3947]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: enabling possible NAT-traversal with method 3
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ignoring Vendor ID payload [Cisco-Unity]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: received Vendor ID payload [Dead Peer Detection]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ignoring Vendor ID payload [e86b7d7f3af5308e80237602642eac3d]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: received Vendor ID payload [XAUTH]
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: NAT-Traversal: Result using RFC 3947: no NAT detected
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: Peer ID is ID_IPV4_ADDR: '62.1.1.122'
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: Dead Peer Detection (RFC 3706) enabled
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ISAKMP SA established
2013:09:22-10:49:02 qfw1 pluto[6761]: | unqueuing pending Quick Mode with 62.1.1.122 "S_THEIRSMMO"
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#85409}
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85409: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
2013:09:22-10:49:02 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME
2013:09:22-10:49:02 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" unrouted: NULL; eroute owner: NULL
2013:09:22-10:49:02 qfw1 pluto[6761]: | route owner of "S_THEIRSMMO" unrouted: NULL; eroute owner: NULL
2013:09:22-10:49:02 qfw1 pluto[6761]: | executing up-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='up-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17641' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:02 qfw1 pluto[6761]: | executing prepare-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='prepare-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17641' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:02 qfw1 pluto[6761]: | executing route-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='route-client' PLUTO_CONNECTION='S_THEIRSMMO' PLUTO_NEXT_HOP='62.1.1.122' PLUTO_INTERFACE='eth1' PLUTO_REQID='17641' PLUTO_ME='62.1.1.50' PLUTO_MY_ID='62.1.1.50' PLUTO_MY_CLIENT='192.168.2.0/24' PLUTO_MY_CLIENT_NET='192.168.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='62.1.1.122' PLUTO_PEER_ID='62.1.1.122' PLUTO_PEER_CLIENT='192.168.20.0/24' PLUTO_PEER_CLIENT_NET='192.168.20.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_MY_SOURCEIP='192.168.2.253' /usr/libexec/ipsec/updown classic
2013:09:22-10:49:03 qfw1 pluto[6761]: | route_and_eroute: instance "S_THEIRSMMO", setting eroute_owner {spd=0x91a1b88,sr=0x91a1b88} to #85410 (was #0) (newest_ipsec_sa=#0)
2013:09:22-10:49:03 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: sent QI2, IPsec SA established {ESP=>0xb2ceae1b
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 11 years ago

2013:09:22-10:49:03 qfw1 pluto[6761]: "S_THEIRSMMO" #85410: sent QI2, IPsec SA established {ESP=>0xb2ceae1b

This indicates that the tunnel was established successfully as the site-to-site VPN tunnel status confirms. What, specifically, do you observe that makes you conclude that you can't "send and receive traffic" through the tunnel?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 notify.sina over 11 years ago

I can't ping or connect to any LAN IP from either network. At all.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 11 years ago

Hi,

Please check the firewall and IPS logs.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 notify.sina over 11 years ago

I don't think its the firewall dropping, I'm really leaning towards a problem from the cisco 1941 router. I checked in the "Automatic Firewall Rule" box in the Connections Tab for that VPN.
This is the route Sophos creates:
ip route | grep 192.168.20
192.168.20.0/24 dev eth1  proto ipsec  scope link  src 192.168.2.253

From a host behind the Sophos UTM, traffic seems trying to exit via the VPN:

tracepath 192.168.20.2
1:  confmgr.qrios.com (192.168.2.56)                       0.246ms pmtu 1500
1:  gateway.qrios.com (192.168.2.253)                      1.441ms
1:  gateway.qrios.com (192.168.2.253)                      0.826ms
2:  gateway.qrios.com (192.168.2.253)                      0.696ms pmtu 1446
2:  no reply
3:  no reply
4:  no reply
5:  no reply
6:  no reply
7:  no reply
8:  no reply

From a host behind the cisco 1941 unit it doesnt seem normal:
traceroute 192.168.2.253
traceroute to 192.168.2.253 (192.168.2.253), 30 hops max, 60 byte packets
1  gateway.fortismmoney.com (192.168.20.1)  1.422 ms  1.402 ms  1.645 ms
2  32-121.rv.ipnxmediahosting.com (62.173.32.121)  2.819 ms  2.989 ms  3.131 ms
3  34-225.rv.ipnxtelecoms.com (62.173.34.225)  1.636 ms  1.671 ms  2.149 ms
4  35-101.rv.ipnxtelecoms.com (62.173.35.101)  2.240 ms  2.244 ms  2.234 ms
5  41-184-56-17.rv.ipnxtelecoms.com (41.184.56.17)  2.325 ms  2.440 ms  2.482 ms
6  35-161.rv.ipnxtelecoms.com (62.173.35.161)  2.208 ms  1.283 ms  1.264 ms
7  10.165.1.66 (10.165.1.66)  1.448 ms  1.456 ms  1.503 ms
8  * * *
9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 11 years ago

When Barry makes a suggestion, it's a good idea to try it. [;)] I bet you see drops in the firewall log. Ping and traceroute behavior is regulated on the 'ICMP' tab of 'Firewall'.

Cheers - Bob

Sorry for any short responses. Posted from my iPhone.

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Newbie Site-to-Site VPN Sophos v9 with Cisco 1941 router trouble!

Submitted a Tech Support Case lately from the Support Portal?