Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 2 replies
  • Answers 1 answer
  • Subscribers 37 subscribers
  • Views 971 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-To-Site IPSec VPN issue

Sophos User3924

Case_Study_SIAB.pdf

Hi SOPHOS Community,
I'm have an issue to setup this IPSec Site-To-Site VPN configuration. Here's a brief description of what is happening. I'm an IT consultant for a business where we have deploy a SOPHOS XG210 Rev 2 firewall on the perimeter of their infrastructure. Here's the IP configuration of the interfaces on the SOPHOS XG210:

Port1(LAN): 172.16.16.16/24
Port2 (WAN 1): 41.207.168.226
Port3 (WAN 2): 156.38.75.154

The SOPHOS XG 210 FW is directly connected via its LAN (Port 1) to a CISCO ASA FW which has an IP 172.16.16.20 on its WAN ( Gi 0/0) interface. 

Behind the CISCO ASA FW exists a DMZ Segment (IP: 10.10.10.0/24). On this DMZ segment, a server which has an IP of 10.10.10.101 have to be reachable through the IPSec VPN Tunnel. How this VPN Tunnel is build?

Indeed, the IPsec VPN Tunnel is build between the SOPHOS XG210 FW and an OCI (Oracle Cloud Infrastructure) . Everything works well for the VPN configuration:
* A machine (192.0.1.3) from the Oracle Cloud Infrastructure (OCI) is able to ping the LAN (Port 1: 172.16.16.16) of the SOPHOS XG210 FW and the WAN ( Gi 0/0: 172.16.16.20) of the ASA FW while passing through the VPN Tunnel. But that machine from the Cloud (192.0.1.3) is not able to ping the machine (10.10.10.101) that resides in the DMZ (10.10.10.0/24) network segment that's behind the CISCO ASA FW and while on the SOPHOS XG i'm able to successfully ping the machine 10.10.10.101 that's behind the CISCO ASA FW.

Any successful advice or solution is welcomed. 



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for reaching out to Sophos Community.

    Assuming you already have added 10.10.10.0/24 network in the local subnet of IPsec tunnel configuration on XG.

    As mentioned 10.10.10.101 IP is reachable from Sophos XG.

    As per the network diagram you've Port6 configured with 10.10.10.254/24 network same as your SW-DMZ network.

    I would suggest changing the network of the Port6 interface.

    If that doesn't work then you might have to add a reverse route on Cisco for the reply packet to 192.0.1.0/24 network coming from 10.10.10.0/24

    Or you may also apply SNAT with default MASQ to the traffic coming from 192.0.1.0/24 network to 10.10.10.0/24(VPN to LAN).

  • 0 in reply to FormerMember

    Sorry, it's a mistake on the graph, that DMZ Interface is no more activated and the IP 10.10.10.254/24 is canceled on it.

Reply Children
No Data
Unfiltered HTML