Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 1 reply
  • Subscribers 39 subscribers
  • Views 1314 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSec tunnel active/active

Calyps

I am attempting to configure two active tunnels from one Sophos XG to two Junipers at different sites as per the below diagram.

I can bring both tunnels up, but when I do I can not get traffic to flow.  If I disconnect either tunnel traffic flows. 

I am not very strong on the networking side but I presume some form of weighted routing is required to achieve this?

Can anyone comment if the below configuration can work with both tunnels up at the same time?

I have configured a failover group which seems to work, but Company Y wants both tunnels to be up. 



This thread was automatically locked due to age.
Parents
  • +1

    Hi  

    As per the provided diagram, you are trying to configure IPsec Tunnel fro Sophos XG to Juniper devices having has same IP subnet.

    It will create an IP conflict and when you up both the tunnel, Sophos XG will not be able to decide, which tunnel traffic should forward because both the tunnel has the same network. When you disconnect one of the tunnels XG has a path to forward the traffic to the specific tunnel.

    Regards,

    Keyur
    Community Support Engineer | Sophos Support
    Sophos Support Videos | Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts |
    If a post solves your question use the 'This helped me' link

Reply
  • +1

    Hi  

    As per the provided diagram, you are trying to configure IPsec Tunnel fro Sophos XG to Juniper devices having has same IP subnet.

    It will create an IP conflict and when you up both the tunnel, Sophos XG will not be able to decide, which tunnel traffic should forward because both the tunnel has the same network. When you disconnect one of the tunnels XG has a path to forward the traffic to the specific tunnel.

    Regards,

    Keyur
    Community Support Engineer | Sophos Support
    Sophos Support Videos | Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts |
    If a post solves your question use the 'This helped me' link

Children
No Data
Unfiltered HTML