This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

No Internet or Ping over Site-to-Site VPN SSL

Hi guys,

I have some questions regarding the Site to Site VPN SSL configuration. What is the case? We will implement in a couple of months a Sophos UTM Firewalls and I want to learn more about it, how it works and to be more efficient and confident when doing changes. That's why I decide to install 2 virtual UTMs and play a bit with them. On a remote location with public IP and ESXi I've installed UTM 9.5 with an Internal Network 192.168.2.0/24 with rules and 1 server to test. The Internet is running, I've set also a SSL VPN client  - everything is ok. Then on my notebook in another location I've installed VMplayer and with vmcfg bridge it to the LAN card and installed UTM 9.5 with an Internal Network 192.168.3.0/24 and 1 Server - again everything is ok. Then I've created a Site to Site VPN tunnel which I've copied and import on the second UTM. So far so good but the moment the tunnel is connected there is no Internet or Ping to hosts in the first location. I've created as newbie some rules in the Firewall with Any services and different options like: fw1-internal to fw2-internal, fw2-internal to external on both UTMs but still not working. At the same everything is running fine through the standard SSL VPN Client. What confused me is that if I add a third UTM to test and want a "triangle" configuration than it will be quite impossible because as I see in the UTM there is only one SSL VPN Pool for tunnel and clients. Or should I do IPsec Site-to-Site for the UTMs and let SSL VPN for the clients?

Thanks in advance



This thread was automatically locked due to age.
Parents
  • Hallo Kiro and welcome to the UTM Community!

    The "Any" service includes only TCP and UDP, not Ping or any of the other IP Protocols.  Pinging is regulated on the 'ICMP' tab of 'Firewall'.  If you want to allow only specific devices to ping, disable the selections on the 'ICMP' tab as those take priority over manual firewall rules - see #2 in Rulz for more details.

    If you're not able to reach the Internet, show us the Edit of the Server definition and confirm that you have a Masq rule for the traffic originating in the Client site.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • Hallo Kiro and welcome to the UTM Community!

    The "Any" service includes only TCP and UDP, not Ping or any of the other IP Protocols.  Pinging is regulated on the 'ICMP' tab of 'Firewall'.  If you want to allow only specific devices to ping, disable the selections on the 'ICMP' tab as those take priority over manual firewall rules - see #2 in Rulz for more details.

    If you're not able to reach the Internet, show us the Edit of the Server definition and confirm that you have a Masq rule for the traffic originating in the Client site.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data