Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 6 replies
  • Answers 2 answers
  • Subscribers 41 subscribers
  • Views 10626 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN IPsec site to site between Sophos and Fortigate

Boris Brunel

Hello,

I have to create several site-to-site IPsec between Fortigate Firewall and our Head Office Sophos Firewall.
All connections must go to the same subnet in our Head Office.

I've configured the Sophos as "Respond Only", the subnets are configured, and the policies are enabled.
The problem is that the IPsec only works when using the wildcard * on the remote gateway. And when I do that, I can't use a different pre-shared key for the other connections. As soon as I try to use the public static address of the Fortigate as the remote Gateway, the connection stop and don't work anymore. 

The log say : "Traffic selectors don't match. Check the configured local and remote subnets on both devices"

But the local and remote subnet are the same as when using * and should be working, right?

So far, I have tried to use the local and remote ID on both firewall, and also to use the Sophos to initiate the connection without success.
What am I missing here?

Thanks



This thread was automatically locked due to age.
Parents
  • 0

    If you need to use * then you should upgrade your Sophos to v20 which supports multiple PSKs.

    If you cannot upgrade then you will need to use something like DynDNS to prevent having to use *

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Reply
  • 0

    If you need to use * then you should upgrade your Sophos to v20 which supports multiple PSKs.

    If you cannot upgrade then you will need to use something like DynDNS to prevent having to use *

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Children
No Data
Unfiltered HTML