I am having an issue connecting more than one network / CIDR block through our IPSec VPN to the Google Cloud Compute Engine VPN.
It seems as though both ends support this as there is the option in the UTM IPSec Connection - Local Networks allows for adding multiple networks. Same at Google - you can add multiple networks to the IPSec connection tunnel.
The site-to-site tunnel status shows [2 of 2 IPsec SAs established] but when the connection is made it only connects one of the networks.
From the Google page . . .
"Security Associations and multiple subnets"
"Compute Engine VPN creates a single child Security Association (SA)
announcing all CIDR blocks associated with the tunnel. Some peer devices
support this behavior, and some only support creating a unique child-SA
for each CIDR block. With these latter devices, tunnels with multiple
CIDR blocks may fail to establish. The suggested workaround is to create
multiple tunnels that each have only one configured CIDR block."
"All subnets connected to the same tunnel must use the same child-SA. If
different subnets do not have the same SA, they must be connected to
different tunnels."
So, it looks to me like Sophos handles the two CIDR blocks with 2 IPSec SA's and Google wants to handle two CIDR blocks with 1 IPSec SA.
Another issue is Google does not allow two tunnels to one IP Address - this means to route two networks at the office requires using two WAN interfaces. This is a big limitation as it requires another WAN interface to establish two tunnels. (which we need - one for the LAN and one for the SSL VPN network for remote workers.)
"Adding a tunnel to an existing gateway"
"Compute Engine VPN does not support multiple tunnels between the same two gateways. Additional tunnels must point to different gateways."
So, my question is - from the comments in quotes above from the Google page is there any way to have Sophos treat multiple networks under the IPSec connection as one SA?
Or as Google states is the UTM one of those devices that only support creating a unique child-SA for each CIDR block.
It appears as thought it is connecting one and then not attempting to establish the other.
I do for now have 2 tunnels established using both of our WAN connections but if I need to add another network it won't work and I would much prefer to be able to add multiple networks to one tunnel.
This thread was automatically locked due to age.
