Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 1818 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM can not reach host on other side of IPSEC Site-To-Site VPN tunnel

htguru
I have IPSEC Site-To-Site VPN working fine from internal network to internal network. Hosts can reach each other with no problem, but the UTMs themselves can not reach a host on the other side, only each other. I have confirmed this with ping, tracert, and DNS on the Support: Tools tabs.

Example: I need UTM A (which is running SMTP proxy) to be able the reach a PDC host on the other side of the VPN, not just UTM B, so DNS request routing to the PDC can work so that emails from hosts on the UTM A side do not get blocked by Strict rDNS checks which I have now committed to using. I know I can add the hosts to an Exception List under Email Protection: SMTP: Exception tab, but I would rather it just work, or at the very least, to understand why it won't.

The Automatic Firewall rules are attached and I would think that a UTM itself would match the rule because it is after all an address within the network but no joy because, presumably, the UTM's Internal Address is part of the tunnel.

I tried adding Internal (Address) to the firewall rules, but no luck.


The IPSEC Site-To-Site VPNs are: 
192.168.1.0/24=96.254.x.94  96.252.x.46=192.168.100.0/24
and
192.168.100.0/24=96.252.x.46 96.254.x.94=192.168.1.0/24
respectively.

Can anyone think of why this does not work and what is required to make it work? Seems everything is possible with Sophos, how is what will make your head explode sometimes.

Any help appreciated.

Thanks in advance,
HTG


This thread was automatically locked due to age.
  • 0
    Does the DNS Proxy on UTM B include the subnet of UTMA's "Internal (Network)?"  Does #1 in Rulz give you any hints on either UTM?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Bob,

    First, The DNS Proxy on UTM B does not include the subnet of UTM A's "Internal (Network) but it should not be required as I an querying DNS on a Windows SBS box not the UTM. As you say: Client PC -> AD/DNS/DHCP Server -> UTM -> Google/OpenDNS.

    Second, Rulz #1 shows nothing.

    Third, a reboot of UTM B fixed the problem.

    GO FIGURE.

    Thanks,
    THG

    Best Regards - HTG
    Frustrated Sophos Partner seeing all the things
    that brought me to Sophos slowly slip away.
    RIP astaro.org

Unfiltered HTML