Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 38 subscribers
  • Views 2305 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

use different internal ip address through ipsec tunnel

ctxdude

Hey guys,

im really new at sophos and firewalling. Actually I have a bit problems to get our voip solution (cloud provider) to work properly. Hopefully im able to explain it clear.

situation:

we changed our network. Sophos VPN to connect branch Offices and Connection through IPsec to our voip provider - instead of MPLS (cost factor)

we've a cloud voip provider, who is using an Avaya solution. The voip servers are located at cloud and we're connecting (only phones) through ipsec tunnel to this provider. Now we're having the issue, that new Phones on our Site are not able to get an ip address from dhcp server (located at cloud provider). Other traffic is working fine, cause 200th phones are already working. (however they're getting an dhcp, if "our Ip" is not whitelisted, see below)

if i set a static ip to the phones, the phones are working. The phone is also able to get an ip address from different dhcp server on our side (different vlan, for clients - just a test)

Now our Provider told aus, that we have to communicate through the ipsec tunnel with a specific (internal) ip address to get an ip address through the tunnel.

 

problem(?):

-> DHCP Requests needs to be arriving on remote side with a specific ip address range (e.g. 192.168.0.0/22)

-> The DHCP Request are actually delivered through Core Switch ve interface on transfer network betwenn Core Switches and Sophos (e.g. 10.10.190.251) 

 

The Solution should be: 

-> Rewrite outbound traffic through ipsec tunnel to a ip address between the 192.168.0.0/22 network

 

Should I create a SNAT Rule to meet this requirement? How would I need to configure this rule? What is best practice to get this working?

 

I'll hope youre able to help a newbi on this "easy thing" (that is it for you, i think :) )

 

greetz

 



This thread was automatically locked due to age.
Parents
  • 0

    Hi CTXDUDE,

    check the following KB:

    https://community.sophos.com/kb/en-us/130577

    It works for Cyberoam OS but it should work even for XG. The commands are different on XG:

    Change the command to "system ipsec_route add host 192.168.0.5 tunnelname xxx"

    and

    "set advanced-firewall sys-traffic-nat add destination 192.168.4.5 snatip yyy"

  • 0 in reply to lferrara

    Hi Iferrara,

    thanks for your hint, you got us to the right direction.

    1) We created a NAT-Rule to NAT the Traffic for UDP 67 to another IP

    2) We created both commands on Head Office

    system ipsec_route add host 192.168.0.5 tunnelname xxx

    set advanced-firewall sys-traffic-nat add destination 192.168.4.5 snatip yyy

     

    Now we're getting IP Addresses through IP Sec Tunnel between HeadOffice and Voip Cloud Provider. (check)

     

    The following Issue is still existing:

    The phones on our Branch Offices dont getting any IP-Addresses from our Voip Cloud Provider.

    Our Branch Offices are connecting through SSLVPN to our HeadOffice (no ipsec)

    - DHCP "IP-helper" is configured on our Branch Office Switches (HP Procurve)

    -> The commands are not working on branch offices, cause this isn't an ipsec? :) 

     

    The tcp dump on the branch office firewalls is still different to the head office...

    Head Office (Phone internal in HeadOffice - Firewall Head Office):

    10.10.190.251.67 > 192.168.0.1.67: BOOTP/DHCP, Request from ab:cd:ef:gh:ij:kl, length 300, hops 1, xid 0x3705500f, Flags [none]
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl
    10.10.190.251.67 > 192.168.0.1.67: BOOTP/DHCP, Request from ab:cd:ef:gh:ij:kl, length 300, hops 1, xid 0x3705500f, Flags [none]
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl

    Branch Office (Phone internal in BranchOffice - Firewall Branch Office):

    XG115w_XN03_SFOS 17.5.9 MR-9# tcpdump -vni any -s0 port 67 | grep ab:cd:ef:gh:ij:kl

    08:36:36.478430 Port4, IN: B ab:cd:ef:gh:ij:kl ethertype Unknown (0x0032), length 348:
    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ab:cd:ef:gh:ij:kl, length 300, xid 0xe8fdc721, Flags [none]
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl

     

    On Head Office we're getting specified sources and destinations, on branch office we're just getting a broadcast

    Is that an issue on DHCP-Relaying/ip-helper?

     

    Thanks a lot! 

     

    Here is a visualisation :)

     

Reply
  • 0 in reply to lferrara

    Hi Iferrara,

    thanks for your hint, you got us to the right direction.

    1) We created a NAT-Rule to NAT the Traffic for UDP 67 to another IP

    2) We created both commands on Head Office

    system ipsec_route add host 192.168.0.5 tunnelname xxx

    set advanced-firewall sys-traffic-nat add destination 192.168.4.5 snatip yyy

     

    Now we're getting IP Addresses through IP Sec Tunnel between HeadOffice and Voip Cloud Provider. (check)

     

    The following Issue is still existing:

    The phones on our Branch Offices dont getting any IP-Addresses from our Voip Cloud Provider.

    Our Branch Offices are connecting through SSLVPN to our HeadOffice (no ipsec)

    - DHCP "IP-helper" is configured on our Branch Office Switches (HP Procurve)

    -> The commands are not working on branch offices, cause this isn't an ipsec? :) 

     

    The tcp dump on the branch office firewalls is still different to the head office...

    Head Office (Phone internal in HeadOffice - Firewall Head Office):

    10.10.190.251.67 > 192.168.0.1.67: BOOTP/DHCP, Request from ab:cd:ef:gh:ij:kl, length 300, hops 1, xid 0x3705500f, Flags [none]
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl
    10.10.190.251.67 > 192.168.0.1.67: BOOTP/DHCP, Request from ab:cd:ef:gh:ij:kl, length 300, hops 1, xid 0x3705500f, Flags [none]
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl

    Branch Office (Phone internal in BranchOffice - Firewall Branch Office):

    XG115w_XN03_SFOS 17.5.9 MR-9# tcpdump -vni any -s0 port 67 | grep ab:cd:ef:gh:ij:kl

    08:36:36.478430 Port4, IN: B ab:cd:ef:gh:ij:kl ethertype Unknown (0x0032), length 348:
    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from ab:cd:ef:gh:ij:kl, length 300, xid 0xe8fdc721, Flags [none]
    Client-Ethernet-Address ab:cd:ef:gh:ij:kl

     

    On Head Office we're getting specified sources and destinations, on branch office we're just getting a broadcast

    Is that an issue on DHCP-Relaying/ip-helper?

     

    Thanks a lot! 

     

    Here is a visualisation :)

     

Children
  • 0 in reply to ctxdude

    From your diagram, it seems that your are trying an Hub and Spoke VPN.

    In the SSL VPN, did you transport even the provider lan resources in any of the branch office SSL VPN?

    Something like this?

    https://community.sophos.com/kb/en-us/123293

    Even if the KB is for IPSec.

  • 0 in reply to lferrara

    Hi Luk,

    we've configured on Head Office Site (BO=Branch Office, HO=Head Office):

    e.g. for BO4 (Head Office Site)

    Local Networks: Cloud-Providernetwork, HO-LAN, HO-VoiP, BO1-Voip,  BO2-Voip, BO3-Voip

    Remote Networks: BO4-Voip, BO4-LAN

     

    Firewall-Rules HO:

    Inbound:

    SrcZone:LAN,WAN,VPN, SrcNetwork:Any

    DstZone: VPN, Dst.Network=BO1-4-Global and Voip

    Outbound:

    SrcZone:LAN,WAN,VPN, SrcNetwork:Any

    DstZone:VPN, DstNetwork:B1-4-Global, Voip

     

    Firewall-Rules BO4:

    Inbound:

    SrcZone: VPN, SrcNetwork:Any

    DstZone: Any, DstNetwork: Any, Services: Any

    On BO-Site we imported the configuration file.

     

    Outbound:

    SrcZone: Any, SrcNetwork: BO4-MGMT(vlan), BO4-Printer(vlan), BO4-Client(vlan), BO4-Voip(vlan), BO4-internal(vlan), BO4-Infrastructure(vlan)

    DstZone: VPN, DstNetwork:Any, Services:Any

    We just have ThinClients (managed by Head Office), Phones (Voip Cloud Provider), Printers and Switches in Branch Office (+Sophos XG, modems, etc.)

     

    greetings

  • 0 in reply to ctxdude

    Thanks. So only dhcp replies are blocked?

    From BO, are you able to ping or reach provider’s services ?

Unfiltered HTML