Problem with my SOPHOS IPSec Site to Site VPN Tunnels

Hello Rodney,

Thank you for contacting the Sophos Community.

I would recommend you to check if the packets destined to Site B are going to the IPsec tunnel using the GUI Packet Capture.

Also make sure you don't have overlapping networks on your end that match the Remote Subnets of Site B.

Try also checking if you have any conflicting static route or SD-WAN and if the VPN routes have precedence. (For this last step you need to SSH into the XG and press 5>4 in the Main Menu to land in the Console)

console> system route_precedence show

Regards,

Hi emmosophos,

Thanks for the swift response. I check thru SSH and here is the result.

I think I have conflicting SDWAN rules with VPN. How can I change the precedence making VPN routes number 1 then SDWAN as second option?

Thanks

Rodney

Hi emmosophos,

Thanks for the swift response. I check thru SSH and here is the result.

I think I have conflicting SDWAN rules with VPN. How can I change the precedence making VPN routes number 1 then SDWAN as second option?

Thanks

Rodney

Hello Rodney,

You can run the following command:

console> system route_precedence set vpn sdwan_policyroute static

This will set the priority first for VPN routes, SDWAN, Static Routes

You can confirm by running:

console> system route_precendence show

Regards,

Hi emmosophos,

If I change the system route precedence will there be downtime on my firewall? Coz if so then I need to reschedule this reconfiguration. 

Appreciate your help.

Thanks

Rodney

Changing the route precedence will only affect new connections. So it could cause a downtime, if the new connection uses a wrong route but should not affect existing connections. 

Hi Lucar Toni,

Thanks for the info. This is really great! I'll do this and update here once fixed. 

Thanks again!

Rodney