Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 10 replies
  • Answers 1 answer
  • Subscribers 42 subscribers
  • Views 10779 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Azure site-to-site VPN route-based tunnel connectivity issues

woter324

Hi,

I have created a site-to-site IPSec VPN between my XG and Azure.

The tunnel is up, confirmed both sides and I can connect from Azure to local, but not the other way around.

I followed this article to the letter: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/126356/sophos-xg-firewall-v18-to-azure-vpn-gateway-ipsec-connection.

I have multiple VLANs configured on my XG. I haven't done anything specific for those - not that I know if I need to. The firewall rule encompasses all the VLANs.

When testing connectivity from local to Azure, I can see the rule is allowed.

I have a gaping hole in my Azure NSG (ANY-ANY), both inbound and outbound.

The Azure endpoint is Ubuntu 20.04 LTS and as far as I know, all firewalls are off:

user@vm01:~$ sudo ufw status verbose
Status: inactive

Here is the main VPN config page:

I'm not particularly familiar with Ubuntu, so it may be something on the endpoint, however, I'd like to rule out XG's VPN config.

I read the note about the XG version and I am currently running on SFOS 18.0.4 MR-4. Can't upgrade just yet.

If anyone can think of anything I should try, please shout.

T.I.A



This thread was automatically locked due to age.
Parents
  • +1

    About six months ago, I couldn't ping from local to remote after setting up a route-based, IPSEC VPN (Tunnel Interface). At the time I gave up and set up Windows as a router to get around the problem. I've since had to revisit and solve the problem properly.

    It appears that this is quite a common issue, so, although my original post has been locked  Rage, I'm creating a new one with the solution.

     provided a step-by-step guide here for setting up a VPN between XG and Azure.

    In the end, it was down to badly configured NAT'ing. During a prior upgrade, Sophos changed the way NAT'ing behaved and the upgrade process automatically created a bunch of NAT rules. Things seemed to work, so I left them as they were. (I'm not blaming Sophos. It was my fault).

    What fixed the local > Azure ping issue was explicitly setting the Outbound Interface to my public interface. It was set to Any.

    Steps:

    1. Rules and policies.
    2. NAT rules.
    3. Select rule corresponding to VLAN that cannot ping.
    4. Interface matching criteria > Outbound interface > <external facing port>.
    5. Disable and reenable the VPN connection. 

    Port C is my external interface and the local PC that couldn't ping the remote endpoint is on VLAN50.

    I got some sporadic behaviour until I figured out any NAT rule changes had to be followed by reinitialising the connection.

    Anyway, I hope the above may help others. In all fairness, it was a reply to a thread on this community that pointed me in the direction of NAT. (Sorry, Cannot find the post now.).

Reply
  • +1

    About six months ago, I couldn't ping from local to remote after setting up a route-based, IPSEC VPN (Tunnel Interface). At the time I gave up and set up Windows as a router to get around the problem. I've since had to revisit and solve the problem properly.

    It appears that this is quite a common issue, so, although my original post has been locked  Rage, I'm creating a new one with the solution.

     provided a step-by-step guide here for setting up a VPN between XG and Azure.

    In the end, it was down to badly configured NAT'ing. During a prior upgrade, Sophos changed the way NAT'ing behaved and the upgrade process automatically created a bunch of NAT rules. Things seemed to work, so I left them as they were. (I'm not blaming Sophos. It was my fault).

    What fixed the local > Azure ping issue was explicitly setting the Outbound Interface to my public interface. It was set to Any.

    Steps:

    1. Rules and policies.
    2. NAT rules.
    3. Select rule corresponding to VLAN that cannot ping.
    4. Interface matching criteria > Outbound interface > <external facing port>.
    5. Disable and reenable the VPN connection. 

    Port C is my external interface and the local PC that couldn't ping the remote endpoint is on VLAN50.

    I got some sporadic behaviour until I figured out any NAT rule changes had to be followed by reinitialising the connection.

    Anyway, I hope the above may help others. In all fairness, it was a reply to a thread on this community that pointed me in the direction of NAT. (Sorry, Cannot find the post now.).

Children
No Data
Unfiltered HTML