VPN to VPN rules

Hi Project2501,

There are two options to accomplish your requirement. 

Option 1: If you are willing to update existing IPsec connection between XG to Azure follow this option. 

Sophos XG Firewall: How to configure access for SSL VPN remote users over an IPsec VPN

In IPsec connection add SSL Remote VPN network to Local Network on XG and on Azure in Remote Network. It also requires VPN to VPN rule.

Option 2 : It does not require any changes in existing IPsec connection. 

However, you have to add routes through CLI and a firewall rule VPN to VPN with Masquerading.

Sophos XG Firewall: How to allow Remote Access SSL VPN traffic over existing IPsec tunnel without modifying the IPsec tunnel

Thanks,

Hi,

I think I've got all the parts in place for option 1, and I can see traffic going through the rule, but it's still not working:

And the SSL subnet is added to my Azure end (did have to double check that I'd got that right admittedly)

Any advice on next step for diagnostics?

I ran a packet capture, and got this little gem:

Violation, Firewall. Just not sure why. It says rule 0, but there isn't a rule 0. I'm obviously missing something here. Rule 0 as I understand it is the default rule to drop if traffic doesn't match the rules in place right?

So based on the premise that our Remote SSL works, and the IPSec's work, it would suggest that the fault is somewhere in the VPN <> VPN rule?

Hi Project2501,

Please ensure that rule is on top and all networks required are allowed in that firewall rule, firewall violation means there is no firewall rule to match the traffic. 

Thanks,

Hi,

It's laid out just as the guidance suggests, and yes it's the top rule. Still doesn't work though.

Regards,

Check if a single ping works!

Give me a ping Vasili.

No dice though, ICMP blocked.

Hi Project2501,

I checked your configuration on your firewall and firewall rule and SSL VPN profile is configured correctly. The problem is with the IPsec tunnel configuration, please ensure you have SSL Remote Subnet in Remote network at Azure side. 

Thanks,

Turns out my rules were in fact fine. The issue lay with how SFOS 17.5 works with Azure VPN's. The subnets don't work until there is some communication from the remote (Azure) end.

Running a ping from the remote end always fails the first (and usually) second time - but third time round it will get to the destination.

I'm told that SFOS 18 and the upcoming 18.1 resolve this problem.

In the meantime I've got a scheduled task running a ping job every 15 minutes to both subnets (the local on-prem and the local remote SSL) and it's working fine.