Sophos XG IPSec VPN with Mikrotik Router

Hello techblue ,

Thank you for reaching out to the community, please refer the guide for configuring the IPsec VPN between the SFOS and Mikrotik Router - https://5cuc.short.gy/3fm5DB

Hi Vivek Jagad 

Thank you. However, I couldn't find information on getting internet access on branch office through head office as I mentioned in the post. I need all the computers on my branch office side gets internet conection through the IPSec VPN.

Could you help me on that as well?

Thank you

In that scenario you'll have to keep ANY on the Head office, then the remote sites's traffic will go through head office !!
You'll need a VPN to WAN rule on the head office too !!

That's cool. I have it working between 2 sophos firewall. I thought the settings would be a bit different using mikrotik router. I'll test it in a few days. 

Thank you!

You're welcome techblue , please be sure to upvote the  Verify answer if it helped !!

 Hi, Vivek Jagad 

I did the way you said but it didn't work. The VPN tunnel is ok and the branch office can reach head office. Now, I just need to make branch office to use Head Office's internet. 

I set the local subnet as "any" and it didn't work. 

Isn't it necessary to configure the mikrotik router as "any" destination like in the HO Firewall? I mean, in the other place I have it set with Sophos XG in both sides I needed to set "any" in "remote subnet" in the branch side as well. Don't I need to do something similar in the mikrotik?

Regards,

 Hi, Vivek Jagad 

I did the way you said but it didn't work. The VPN tunnel is ok and the branch office can reach head office. Now, I just need to make branch office to use Head Office's internet. 

I set the local subnet as "any" and it didn't work. 

Isn't it necessary to configure the mikrotik router as "any" destination like in the HO Firewall? I mean, in the other place I have it set with Sophos XG in both sides I needed to set "any" in "remote subnet" in the branch side as well. Don't I need to do something similar in the mikrotik?

Regards,

of course in the mikrotik's remote subnet you need to mention it as "ANY" 
And also on the XG you'll need a FW rule - VPN to WAN !!

Could you help me on that as well? I don't know where I need to set as "any". I thought it would be in the IPSec Policies, but it doesn't accept "any". I tried also to use 0.0.0.0/24 but it didn't work.

Thank you

What you mentioned is correct, but I would suggest contact Mikrotik support once, techblue !

All right. Thank you.

Hi Vivek Jagad 

Finally, I got it working! I needed to set destination address, as mentioned above, 0.0.0.0/0 AND disable NAT (masquerade).

I found relevant to leave this comment here so other people can see how it can be done.

I didn't follow the KB you sent me. I found out this tutorial in youtube more relevant to my case:

https://www.youtube.com/watch?v=ISRrnWPQ9zU 

Thank you very much.

Best regards,