Help us enhance your Sophos Community experience. Share your thoughts in our Sophos Community survey.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 26 replies
  • Subscribers 38 subscribers
  • Views 4990 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-Site IPSec Not Working As Intended

haydenspence

Hi.

I am currently working with a test environment and have configured two XG firewalls to have an IPSec Policy-based site-to-site connection between them. I cannot get the IPSec connection to forward traffic correctly. I have been trying for hours and looked at many online discussions about similar issues, but no success.

Here's how I have the firewalls physically connected:

Firewall A <-------> Firewall B

Very simple, one is connected to the other with Ethernet. On both firewalls, the interface for the link is set to WAN zone and I have configured a small 'pretend' IP block with no actual functioning gateway. Both firewalls can ping eachother.

I have configured the IPSec connection and the connection is successfully established, including the local and remote subnets on both firewalls both showing green in the status overview.

I have configured the firewall rules on both XGs to allow traffic to and from the VPN zone and the local subnets on both sides.

When I use a PC on the branch firewall and try to connect to a PC on the head office firewall (within the remote subnet configured), it will not forward the traffic to the ipsec0 interface. I can see with a packet capture that actually the firewall is trying to forward it to the Internet instead (which would not work, since the local/remote IPs are non-routable).

I have tried to manually add the IPSec routes (using CLI -> system ipsec_route add net) but that does not work either.

Has anyone else ever tried to test a IPSec VPN like this before? Why is it not adding the VPN routes as I am lead to believe it should be? I cannot get the traffic to flow over the VPN connection. I can even see in the rules, that both in and out are zero bytes, and I am 100% sure the rules should be matching the traffic.

I can provide more information if needed.

Can anyone help out?



This thread was automatically locked due to age.
  • 0 in reply to Erick Jan

    Ok, well I just tried again at the same link and it worked. I was able to successfully submit the support request.

  • 0 in reply to haydenspence

    Hi Hayden,

    Would it be possible to share the case ID so that we can further monitor. Thank you

    Erick Jan
    Community Support Engineer | Sophos Technical Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.

  • 0 in reply to Erick Jan

    I would like to provide an update regarding the firmware issue. After speaking with Sophos technical support, the firmware issue is resolved. For whatever reason, on either firmware, some services needed restarting after the firewall booted. Here's what was done to restore the Web GUI from the CLI (advanced shell):

    service tomcat:restart -d -s nosync
    service apache:restart -d -s nosync

    After restarting the services on version 19.5.1, I used the Web GUI to re-apply the 19.5.2 firmware. After a reboot, the Web GUI was working again on the latest firmware. A quite bizarre issue, but I have updated successfully now.


    I will continue my endeavours with the site-to-site VPN connection soon.

  • 0

    Hi. So I've had some more time to try and get my site-to-site VPN working. Since last time, I upgraded the firmware on Firewall A and deleted and re-created the IPSec connection on both firewalls. I can report that I am still unable to get any traffic to flow between the two firewalls. Does anyone have any ideas or am I best opening a support case for this one?

  • +1

    For anyone who may be interested, I resolved this issue myself. Turns out that the IPSec local/remote subnets don't work intuitively. In order for a local network to communicate with a remote subnet, you must also include this subnet in the "Local subnet" list in the IPSec connection. I was adding firewall rules with local zones as the source, and the VPN zone as the destination without creating a network definition for the zone's subnets and adding that to the IPSec connection's local subnet list.

Unfiltered HTML