Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 8 replies
  • Subscribers 39 subscribers
  • Views 7034 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to use private IP Address for creating IPSEC Tunnel

Sachin Bhatgare

We have configured Sophos 310XG firewall in HA. Due to that BSNL FTTH Broadband link had to connect using private IP Address and forwarded all ports from ONT device to private IP of firewall. Can I use this link for site to site IPSEC VPN configuration?

If yes, please explain.



This thread was automatically locked due to age.
Parents
  • 0

    Hi  

    The ISP line which you want to use for IPsec needs port 500 and 4500 for IPsec communication, if you have forwarded all the ports then it is not possible to create IPsec tunnel on that specific ISP link, It would be great if you could provide more details on your requirement and your network setup, it would help us to assist you better.

    Regards,

    Keyur
    Community Support Engineer | Sophos Support
    Sophos Support Videos | Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts |
    If a post solves your question use the 'This helped me' link

  • 0 in reply to Keyur

    Hi Keyur,

    As my firewall is HA mode it does not support dial-up. Therefore I created a connection using PPOE in ONT(ONU) device. Then used private subnet to link ONT's LAN port with Firewall's WAN port. In ONT device I forwarded all the ports to WAN IP Address. That's how I started getting Internet access using that WAN port. We have subscribed one static IP address on this link. But as I have made dialup connectivity using ONT, the private IP address is there on WAN port and using the regular procedure I can't connect VPN link. Is there any way that I can use allotted static IP address for VPN connection. Kindly refer attached diagram broader understanding.

  • +1 in reply to Sachin Bhatgare

    Hi  

    Thank you for providing in-depth details of the scenario.

    If the remote end device has public IP we can configure * value in the remote end and can initiate the tunnel from Sophos XG as Sophos XG knows the remote gateway Public IP and we can establish the IPsec Tunnel.

    Sophos XG IPsec Configuration (Initiate the tunnel from Sophos XG)

    Local Gateway - WAN Interface (192.168.17.5)

    Remote Gateway - Remote End device Public IP address

    Remote End device IPsec Configuration (Responder Only)

    Local Gateway - WAN Interface

    Remote Gateway - * or Any

    Rest of the IPsec configuration, please refer the article- https://community.sophos.com/kb/en-us/123140

    Regards,

    Keyur
    Community Support Engineer | Sophos Support
    Sophos Support Videos | Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts |
    If a post solves your question use the 'This helped me' link

  • 0 in reply to Keyur

    Hi Keyur,

    Your suggested configuration is not working. Tried the setting on active IPSEC VPN, therefore we can be assured that other configurations are correct. It does not accept *, tried using Any. 

Reply Children
Unfiltered HTML