Sophos Firewall and Routing : Issue to ping my Destination IP

Why do you have individual routes for each IP address? Also VLAN 100 terminates on the XG where as VLAN 300 terminates on the watchguard and there is no

relationship between VLANs.

Ian

Why do you have individual routes for each IP address? Also VLAN 100 terminates on the XG where as VLAN 300 terminates on the watchguard and there is no

relationship between VLANs.

Ian

Hello

We do this because this Server 172.20.24.24 is the one that we need to have access , so we created this route .

From Sophos and watchguard, we have one direct  inteconnexion who have @IP 172.20.25.62 on Sophos interface and 172.20.25.1 on Watchguard interface Side . Sophos and watchguard can communicate with this direct interconnexion  .

And the issue is that all of my VLAN 100 ( ex : 192.168.123.10 ) can ping and have access to this server 172.20.24.24 , it s not a problem .

But the issue is , my Server 192.168.123.100 can't ping and stuck to my Gateway 192.168.123.1 when I tryed to traceroute  . This server also need to have access to this server 172.20.24.24

BR

Tovo

Hi,

VLAN300 does not come near the XG so having a network  labelled vlan300 goes nowhere.

Ian

Hello,

Thank you for your comment but this s not the principal issue , the issue is way i m not able form my server 192.168.123.100 to ping this IP 172.20.24.24 .

I am able form all of my VLAN ( 192.168.123.0:24) to acces on this same server with this route that I put below

BR

Tovo

As an example from my IP 192.168.123.30 to tracert this server 172.20.24.24

You can see here , the trace route .

BR

Tovo

You don’t have a path/route between the two locations..

ian

for additionnal info , the direct interconnexion is my path/route betwen this two location (it s configurate as a LAN) , from Sophos Side we have this IP 172.20..25.62 and from Watchguard Side : 172.20.25.1 , and I said before this two location can communicate .

Hi Tovo,

Have you checked the internal Firewall for end-user devices?

Kindly compare the working and non-working machines(192.168.123.30 and 192.168.123.100).

Hi Erick,

After doing a big analysis , there is a NAT for this @ip 192.168.123.100 and this rules block the traffic betwen 192.168.123.100 to 172.20.24.24  , so we put this NAT rules in the bottom of the rules list .

Thank you all for our support

BR

Tovo

Hi Tovo,

That is great to hear.