This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPsec site to site VPN with multiple remote address ranges - NAT setup

I have successfully set up a site to site VPN with another site (non UTM)
The remote site has 11 address ranges that translate into 11 SAs that are green on the IPsec tab. This site previously was connected using ISA 2006 and still connects successfully if I enable it. My UTM is AD enabled and joined.

The issue is I cannot get connectivity - unable to ping the remote server as I do not understand how to setup the NAT rules or whatever else I am missing.
I have 3 computers that need to have access to the servers on the other end of the tunnel.
I created a network group that includes the 11 network ranges and a group for the 3 computers. I assume I need a SNAT and a DNAT and have tried multiple ways. I have ping enabled. I am unable to ping the remote servers from the UTM tools. Traceroutes go to the internet instead of the tunnel. Any ideas?

This thread was automatically locked due to age.

0 BAlfson over 9 years ago
I don't know a way to get a traceroute to go through the tunnel.  You have to do packet capture to be sure that the traffic is being sent into the tunnel:
[LIST=1]Find the name of the IPsec tunnel to GM.  From the command line as root:
cc get ipsec connections

In my case, I saw the one I wanted was REF_IpsSitTest5162015.  I wanted to check that traffic from 123.211.55.10 was going through the tunnel, so I watched the result of:
espdump -n --conn REF_IpsSitTest5162015 -vv |grep '123\.211\.55\.10.*\..*:'

Once you have that in place, try to access the device at 123.211.55.10 as you normally would.
Ctrl-C at the command line to exit espdump
[/LIST]
Any luck with that?

Cheers - Bob
Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel