Use Remote Access SSL VPN to reach 4 different internal networks

Hi Peter,

Thank you for reaching out to Sophos Community.

Have you tried to use any how-to videos, documentation, Sophos Assistant, or KBA to try to check the issue?

Can you do and the check Log viewer/packet capture to determine what has happened to the Packet.

Also, if possible, kindly share the screenshot.

Hi Erick,

seen many videos, documentation,... but noting that shows the scenario with sub networks behind the main office. Only for the UTM I can find some descriptions. Some additional information the S2S-VPN from the main office to the 3 sub office are new but use the same configuration an before witch the UTM. 13 ist the correct sNAT rule and 17 the correct firewall rule so look like the rules are used for the connection. 

Just information about a test from a sub office I can ping from sub to main office from the SG135 but don't get trace route information. This work from sub to sub office.

best regards Peter

Hi Peter,

Kindly try the following KB

How to troubleshoot SSL VPN remote access connectivity and data transfer issues

Configure remote access SSL VPN with Sophos Connect client

Hi Erick,

no the client can connect to the mail office and reach the resource at the main office. But he isn't able to use the resources (networks) of the sub office witch are connected via IPSEC. There is no manual how to configure this! The way I showed worked at the SG135,...but not at the XG. I'm wondering that this normal case of use is not documented. 

But the good news I solved the problem by setting separates routes on the console mode.

console> system ipsec_route add net 10.182.0.0/255.255.0.0 tunnelname MainOffice2SubOffice1  (this is name your ipsec tunnel at the S2S-VPN )

I think that is a very important additional information for all configurations with sub networks

best regards Peter

Hi Erick,

no the client can connect to the mail office and reach the resource at the main office. But he isn't able to use the resources (networks) of the sub office witch are connected via IPSEC. There is no manual how to configure this! The way I showed worked at the SG135,...but not at the XG. I'm wondering that this normal case of use is not documented. 

But the good news I solved the problem by setting separates routes on the console mode.

console> system ipsec_route add net 10.182.0.0/255.255.0.0 tunnelname MainOffice2SubOffice1  (this is name your ipsec tunnel at the S2S-VPN )

I think that is a very important additional information for all configurations with sub networks

best regards Peter

Hi Peter, 

That is great to hear. Cheers and have a great day