Sophos Firewall v18 AWS site-to-site VPN connected but no traffic PING SSH

Hi,

What do you have set for your Firewall Rules that are applied to the VPN? Also check your AWS Route table to make sure you have a route back to your local network over the VGW. When dealing with AWS VPN attachments AWS doesn't know what the route is back to your network unless you add the routes to the route table.

Can you try changing the IPSec from tunnel interface to site-to-site. Is there a reason you are using a tunnel interface?

Can you try changing the IPSec from tunnel interface to site-to-site. Is there a reason you are using a tunnel interface?

take a look at this. https://support.sophos.com/support/s/article/KB-000038437?language=en_US

ive only used the tunnel interface when dealing with multiple networks and bgp. Otherwise I use site to site 

I changed it to site-to-site, but when I clicked Save, I got "local/remote subnet configuration conflict", and noticed both of those boxes on the bottom of the IPSec connection page were red (meaning required). So I filled them in with my local subnet and the remote AWS subnet of the VPC (10.10.0.0/16) and clicked Save, and the tunnel successfully connected, but still no PINGS or SSH. Additionally, now I notice there is no xfrm1 interface under my WAN port. And because of that, my static route to AWS (in "Configure", click on "Routing" → Under "Static Routing"), is gone. So I recreated one to my one-and-only AWS subnet (10.10.1.0/24) and used the Port2 WAN interface. Now PINGs to my AWS box 10.10.1.93 come back as "Destination host unreachable" instead of timing out. I think the "Sophos XG Firewall v18 to AWS VPN Gateway IPSEC Connection" needs some editing because I have the exact same setup and followed it twice without success. Switching back and forth between the v17 and v18 how-to seems weird. 

That is very odd. Did you try looking at the link I sent above? Maybe there is something missing in the config. 

The link you sent is for v17, I have v18. But yes, I'll go through it and have a look.

DJB - I would highly recommend you reach out to support directly after you attempt to set this up again or you could engage our professional services team if you have the hours banked (or you could purchase an hour or 2 by reaching out to your partner or local sales team).  The advantage of the pro team is they are focused on deployment and educating our customers and reducing any frustration you may have with some more advanced setups like this one.  Support is focused on break/fix scenarios and are not for deployment and education scenarios.  I myself have this environment working in my lab and it works very well, but there are some gotcha's that can trip you up at various stages and its hard to troubleshoot over a forum!

DJB - I would highly recommend you reach out to support directly after you attempt to set this up again or you could engage our professional services team if you have the hours banked (or you could purchase an hour or 2 by reaching out to your partner or local sales team).  The advantage of the pro team is they are focused on deployment and educating our customers and reducing any frustration you may have with some more advanced setups like this one.  Support is focused on break/fix scenarios and are not for deployment and education scenarios.  I myself have this environment working in my lab and it works very well, but there are some gotcha's that can trip you up at various stages and its hard to troubleshoot over a forum!

Thanks. I am about to go through the document and start from scratch again. Other than the IP addresses, it's a very static environment so I kind of expected, if I followed the document step-by-step, I'd have a working setup. I understand troubleshooting over a forum can be difficult, but off the top of your head can you remember any gotcha's I should be aware of?