Using public IPs in different locations with IPSEC

Hello Christian Garcia N ,

Thank you for reaching out to the community, create a full tunnel and at office A mention the local as "Any" and create a firewall rule VPN to WAN. 

Good afternoon.

I tried to perform several DNAT/SNAT on both XG but I can't figure out what I need to do, I don't know if I don't understand your explanation very well.

Would it be possible to tell me through images what should be done?

I give you a diagram of the network and what I need is that the server that has the IP 192.168.6.10 can both be accessed and that it has access to the Internet through the IP 91.92.136.10 and that it can communicate with the servers 192.168 .5.5 and 192.168.5.6.

Thank you very much for your help!

Good afternoon.

I tried to perform several DNAT/SNAT on both XG but I can't figure out what I need to do, I don't know if I don't understand your explanation very well.

Would it be possible to tell me through images what should be done?

I give you a diagram of the network and what I need is that the server that has the IP 192.168.6.10 can both be accessed and that it has access to the Internet through the IP 91.92.136.10 and that it can communicate with the servers 192.168 .5.5 and 192.168.5.6.

Thank you very much for your help!

Hey Christian Garcia N , Please refer - Route the branch office internet traffic through the head office ISP gateway.

Try route base vpn https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=site-to-site-VPN-route-based-VPN with SD-WAN routes

Hi Christian Garcia2 I have the same problem at this moment and tried to use

system ipsec_route add host REMOTE_BRANCH_IP_SERVER tunnelname TUNNEL

and

set advanced-firewall sys-traffic-nat add destination REMOTE_BRANCH_IP_SERVER snatip FW_IP

but doesn't work the traffic go in the correct FW rule and NAT rule but remain in SYN_SENT status when forwarded

Thanks in anyone can help us

Try route-based VPN to meet the requirement.