Not Able to ping Internet from Sophos XG 115w

RE: Not Able to ping Internet from Sophos XG 115w

Karim GUIDOUM — Tue, 16 Nov 2021 19:18:26 GMT

Hi Dirkkotte,

you're right, issue is that the system-generated traffic whas not NATed, the following command fixed the issue

set advanced-firewall sys-traffic-nat add destination 0.0.0.0 netmask 0.0.0.
0 snatip <my-public-IP>

RE: Not Able to ping Internet from Sophos XG 115w

Karim GUIDOUM — Mon, 08 Nov 2021 18:16:32 GMT

Hi,

bellow the NAT rule screenshot, NAT_iphost is the Alias public IP 41.111.198.5

from the console, i checked the NAT for system generated traffic, it is not configured yet, thanks

RE: Not Able to ping Internet from Sophos XG 115w

rfcat_vk — Sun, 07 Nov 2021 21:39:47 GMT

Hi dirkokotte,

I am nor sure what you are driving at?

ian

RE: Not Able to ping Internet from Sophos XG 115w

dirkkotte — Sun, 07 Nov 2021 14:59:47 GMT

Seems as your NAT/Masquerading rule don't capture the system-generated traffic ...
Can you show us a screenshot?

@rfcat_vk: if there is a really big bug ... internal users should not be able to work either

RE: Not Able to ping Internet from Sophos XG 115w

Karim GUIDOUM — Sun, 07 Nov 2021 11:34:35 GMT

here is the network diagram

RE: Not Able to ping Internet from Sophos XG 115w

rfcat_vk — Sun, 07 Nov 2021 10:53:54 GMT

Sorry, this is not making sense, please provide a network drawing to clarify the connections.

ian

RE: Not Able to ping Internet from Sophos XG 115w

Karim GUIDOUM — Sun, 07 Nov 2021 10:25:37 GMT

Hi,

i'm using another public IP (41.111.198.5) as Alias on the external interface (wich has the primary IP 192.168.123.82 )

thanks

RE: Not Able to ping Internet from Sophos XG 115w

rfcat_vk — Sun, 07 Nov 2021 09:44:36 GMT

Hi,

using the public which is assigned to the external interface of your isp router will not work. You need to put the isp router into bridge mode to be able to use the public IP address.

ian

RE: Not Able to ping Internet from Sophos XG 115w

Karim GUIDOUM — Sun, 07 Nov 2021 08:56:35 GMT

Hi,

192.168.123.81 is my default GW for the sophos, wich is ISP router,

192.168.161.85 is located on the ISP network,

i'm using NAT with a public IP provided by the ISP, the public IP is configured as an alias on the WAN interface of Sophos firewall

ping and traceroute to 8.8.8.8.8 using the internal interface as source is also failing,

i have only one Internet connection

here is the traceroute screenshot from LAN IP of sohops

RE: Not Able to ping Internet from Sophos XG 115w

dirkkotte — Thu, 04 Nov 2021 17:17:13 GMT

please tell us more about IP 192.168.123.81 and 192.168.161.85
what are these devices? Where are they located?
If you don't mask your internal traffic at the WAN interface, possible your LAN-segments are routable and the transfer-subnet not..
Are there other Ways out of your LAN (2nd ISP, other routers, ...)?

Try the ping & traceroute 8.8.8.8 tests again and select the internal interface as source.

RE: Not Able to ping Internet from Sophos XG 115w

Vishal_R — Thu, 04 Nov 2021 15:26:11 GMT

Hi Karim GUIDOUM : What is the observation in TPCDUMP and Drop packet on XG CLI when you generate PING or any traffic from XG CLI itself? Is it getting dropped or getting forwarded out to the correct WAN Interface?

RE: Not Able to ping Internet from Sophos XG 115w

Karim GUIDOUM — Thu, 04 Nov 2021 15:02:51 GMT

Hi,

version is XG115w (SFOS 18.5.1 MR-1-Build326)

RE: Not Able to ping Internet from Sophos XG 115w

dirkkotte — Thu, 04 Nov 2021 11:15:59 GMT

Hi,

which version do you use currently?
Which output do you get from
- diagnostics / Tools / Ping -- 8.8.8.8
- diagnostics / Tools / Traceroute -- 8.8.8.8
- diagnostics / Tools / Name lookup -- 8.8.8.8

RE: Not Able to ping Internet from Sophos XG 115w

Karim GUIDOUM — Thu, 04 Nov 2021 10:29:53 GMT

Hi,

DNS Settings are OK, clients are accessing internet

the issue is that the sophos device cannot access Internet from the Administration Portal

Karim,

RE: Not Able to ping Internet from Sophos XG 115w

rfcat_vk — Wed, 03 Nov 2021 09:41:50 GMT

Hi,

please check the dns settings of the XG.

ian