Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 13 replies
  • Answers 2 answers
  • Subscribers 38 subscribers
  • Views 3507 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sending Remote access traffic through Site-to-site VPN, with 1:n nat translation on XGS

XGS-admin

Hello Sophos community,

I am trying to set up a szenario where I have to send IPsec Remote access traffic through a Site-to-Site IPsec VPN with 1:n NAT translation on a XGS Firewall.

It seems to work on UTM:   Sending Remote access traffic through Site-to-site VPN, with 1:1 nat translation 

It did work on Cisco ASA, that I retired and that I have replaced with the XGS.

Setup:

Remote User -(IPsec Remote Access VPN)-> Sophos XGS  -(IPSEC Site-to-site VPN)-> Partner servers

We have a requirement for remote users (Sophos Connect Client) to access partners servers. Our IPsec Remote Access VPN is on a VPN subnet (192.168.99.0/24), internal LAN is 192.168.1.0/24

Our partner has the requirement that traffic is sent from the 1.2.3.4 IP (1:n NAT) to his networks.

The site-to-site VPN (Tunnel: To_Partner) is established and working, showing up at both ends. Local network on my end is set to be 1.2.3.4 - no NAT in Site-to-Site VPN active.

I have set up "system ipsec_route add net 10.1.1.0/255.255.255.0 tunnelname To_Partner"

Found this command mentioned here: support.sophos.com/.../KB-000037043

I have created a NAT rule (Name: NAT-Partner) to change traffic from internal LAN 192.168.1.0 as well as RA VPN LAN 192.168.99.0/24 , going to partner network 10.1.1.0, to map the source as 1.2.3.4

 
Firewall rules have been set up for both the S2S VPN, and internal LAN as well as RA VPN LAN

.
I have added the Partner network to the local networks section in the IPsec Remote Access VPN setup. 

Problem: I can ping as well as access partner network servers' ressources from internal LAN 192.168.1.0

I can ping from RA VPN LAN. I am, however, unable to access partner server's remote ressources. 

When trying to access a partner servers ressources from the RA VPN LAN, the counter on the NAT rule "NAT-Partner" increases. Sophos packet tracers says: Invalid traffic

I tried an "any"-"any" firewall rule. No success so far.

Do I have to put the Cisco ASA5510 back in place? I am a bit lost.

Cheers,

XGS admin



This thread was automatically locked due to age.
  • 0 in reply to XGS-admin

    I somehow managed it to re-create the firewall and NAT-rule. No more invalid traffic, traffic is now passed.

    However - no NAT. Please compare the following screenshot to  the one from from internal LAN (Source NATed as 1.2.3.4)

    Is the XGS capable of NATing incoming IPsec RA Traffic???? 

  • 0 in reply to XGS-admin

    Firewall and NAT has to be applied.

    Just to be sure, what are your filters? Because you are only seeing the incoming packets. Could be, NAT / Firewall are not applied. 

    BTW: If ICMP works but a protocol not, this could be an indicator for MTU size issues. 

    And about your point above: 

    You see Ipsec0 in and out. Which does not make sense, if this is the internal LAN traffic. internal LAN should be incoming Interfaces, not Ipsec0. 

    I assume you are filtering wrong in that sense.

    You have to read the tcpdump from bottom to top. 

    You could try sslvpn, if there is the same issue or not. 

    But i assume your filters are wrong and therefore we are not seeing what is happening. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Hello. Did a lot of testing and investigation.

    Seems to be a problem with policy based IPsec in general.

    - Tunneling the given 1:n NATed Site to Site via a route based to another Sophos works fine

    - SSL VPN remote access also works

    Policy base Site to Site and Remote Access does not work:

    Sophos XGS sends packets out to the tunnel. Sophos XGS does, however, not know what to do with the return packages. They are logged as INVALID TRAFFIC. Cannot get it working.

    No problem for me. I do have a working solution now.

    Thank you - (Danke für alles)

Unfiltered HTML