Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 11 replies
  • Answers 2 answers
  • Subscribers 41 subscribers
  • Views 7395 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't access or ping IPSec Site-to-Site Local to Remote devices

bcharles

Hi,

I'm trying to enable an IPSec Site-to-Site connection with a remote location but have a few problems on the route side

Here's my config : 

  • Sophos XG - SFOS 19.5.2 MR-2-Build624
  • Sophos LAN on 172.16.16.x (set as LAN in Hosts and services)
  • LAN port is connected to a router acting for DHCP, DNS and other functions (the router is Synology RT2600ac with VPN Server)
  • Local LAN on 192.168.1.x (set as LAN1 in Hosts and services)
  • Remote LAN on 192.168.2.x (set as LAN2 in Hosts and services)
  • Static route on Sophos for 192.168.1.x to static DHCP IP on the 172.16.16.x range
  • Sophos DNS is set to 172.16.16.16
  • Public IP address is 10.50.xx.xx

And here's the steps that lead to the problem : 

  1. The IPSec Profile is set with the same settings on the Local and Remote servers : 


  2. Firewall Rules FROM and TO all three IP ranges (172.16.16.x, 192.168.1.x, 192.168.1.x) :


  3. DNAT rules are created as showed here : 
  4. VPN is allowed to PING and DNS in Device Access
  5. Site-to-Site connection established and active


  6. I can't ping/traceroute Remote devices via Diagnostics / Terminal of Sophos :

    or Local device present in the DHCP range of the Synology router : 


  7. The ping process works from a Remote to Local server though!

I tried a few things I saw on Sophos Community, on Synology's and other forums but can't find a way to make my setup work

Is there anything I could do to make it work?

Thanks in advance and don't hesitate if I can provide anything else

Regards



This thread was automatically locked due to age.
Parents Reply Children
Unfiltered HTML