How to create Static routes for IPSEC VPN's?

Hello John,

Thank you for being descriptive on the problem, the RED VPN is currently not support on XG which forces you to use the Ipsec site to site VPN.

Can you tell me what the Peer appliance on the site to site ?

With IPsec site to site which is way too different from Red VPN tunneling. Ipsec Security association is formed after both the peers agreeing on their local and remote networks and once the SA is formed it will auto create the routes on the route table and you dont have to create static routes as the Peer device will not accept the traffic because the SA did not negotiate the new network.

If you need to add a new network create an object for the new network and add the network under the destination networks of your local firewall Ipsec tunnel and also create an object for the same network on the peer and add it under the source network of the Ipsec tunnel.

One other way of implementing this and it would be much easier than RED and IPsec site to site implementation is by bringing in the support for Virtual tunnel interface (vti) also called route based VPNs which are available in V2 of XG firewall OS.

You can just created a tunnel interface between both the sites you can define static or you can also implement Dynamic routing and also Dynamic Multicast routing which is not possible with Reds.

this issue needs a troubleshooting session to understand which route the traffic is heading you can make the best use of tcpdump from option 4 of the command line.

IPsec site to site has been reliable way of connecting remote sites before the reds I will agree on the ease of use point of view it is difficult to accept this change :)

Thanks,
Kranthi

OK I cant find anything on those Virtual Tunnel Interfaces you mentioned, what is Sophos XG V2? Is it not out yet? I have all 4 IPSEC site to site VPN's connecting, I went through the policies at all the endpoints and created an exactly matching policy so I could get a connection. The problem I'm having is even though I have active VPN's I cant reach the remote networks of 2 out of 4 VPN's. I really am stuck!!! I was pretty competent using Sophos UTM but wanted to dive in and learn Sophos XG for my home. If i was having issues connecting to a single device type id probably be able to troubleshoot this but its not its 1 of each of the same devices that work?? I have posted other threads here about this but haven't gotten to the bottom of it still! I miss www.astaro.org. Ive gone over and over the configs of the endpoints and im confident I have replicated the working VPN's exactly apart from the IP addresses. I do not know how to create static routes on XG for ipsec tunnels as i dont have an interface to use for these. Also the Routes tool in diagnostics is confusing as all my IPSEC tunnels say they are using the same route and the IP in it isnt even right?

I could in theory drop 2 of my IPSEC tunnels as each of the pairs of endpoints have there own site to site connecting them, so if i could work out how to use static routes in XG i could route traffic destined for the remote subnet through the VPN that works and then through the endpoints VPN.  I cant see why that wont work either?

Also as I still have my old UTM on my LAN but on a different IP which still has working RED tunnels, I was trying to route traffic through that but again the unicast static routes i tried didn't work.

So please any ideas you can give me id really be grateful.

Thanks

JK

OK I cant find anything on those Virtual Tunnel Interfaces you mentioned, what is Sophos XG V2? Is it not out yet? I have all 4 IPSEC site to site VPN's connecting, I went through the policies at all the endpoints and created an exactly matching policy so I could get a connection. The problem I'm having is even though I have active VPN's I cant reach the remote networks of 2 out of 4 VPN's. I really am stuck!!! I was pretty competent using Sophos UTM but wanted to dive in and learn Sophos XG for my home. If i was having issues connecting to a single device type id probably be able to troubleshoot this but its not its 1 of each of the same devices that work?? I have posted other threads here about this but haven't gotten to the bottom of it still! I miss www.astaro.org. Ive gone over and over the configs of the endpoints and im confident I have replicated the working VPN's exactly apart from the IP addresses. I do not know how to create static routes on XG for ipsec tunnels as i dont have an interface to use for these. Also the Routes tool in diagnostics is confusing as all my IPSEC tunnels say they are using the same route and the IP in it isnt even right?

I could in theory drop 2 of my IPSEC tunnels as each of the pairs of endpoints have there own site to site connecting them, so if i could work out how to use static routes in XG i could route traffic destined for the remote subnet through the VPN that works and then through the endpoints VPN.  I cant see why that wont work either?

Also as I still have my old UTM on my LAN but on a different IP which still has working RED tunnels, I was trying to route traffic through that but again the unicast static routes i tried didn't work.

So please any ideas you can give me id really be grateful.

Thanks

JK