Site to Site VPN Routing

Question

Configured Site to Site VPNs on the XG. 
 The Tunnel is green on both sites and I let the tunnels create the automatic firewall rules, but I am unable to ping across them. 
 I am missing the routes needed? 
 I have multiple networks on both sides, but decided for routing purposes to lump it all into one network. 
 Example: 
 Local: 
 172.18.0.0/16 
 Remote 
 172.19.0.0/16 
 
 Not seeing anything in the logs - are there logs to check? 
 Thanks

FormerMember · Accepted Answer

It seems the traffic is being NATed with your public IP address. 
 In VPN to VPN firewall rule, apply SNAT as your LAN interface IP address. Refer to the article below for more information on "Allow Remote Access SSL VPN Traffic Over an Existing IPsec Tunnel" 
 support.sophos.com/.../KB-000037043

FormerMember · Answer

As per the previous packet capture snapshot, traffic coming from 172.16.1.120 machine(head office) is getting forwarded via firewall rule ID 12 to internal machine 172.19.1.1 but there is no response to the ICMP request. 
 There could be 2 possibilities: 
 
 172.19.1.1 is not replying to ICMP requests coming from 172.16.1.120 source address. 
 172.19.1.1 is replying to ICMP requests but the reply packet isn&rsquo;t reaching the Sophos Firewall. If you have an L3 device connected in between Sophos Firewall and end machine then I'd suggest adding a reverse route for the reply packet. 
 
 After applying the SNAT policy, the source address in the ICMP request will be translated to the outgoing interface IP address(Port5.9). 
 Check the packet flow again to get better clarification.

Site to Site VPN Routing

Top Replies