Can’t route self-generated packets

Hi Rodrigue GRIMAUD Thank you for reaching out to the Sophos community. The help section below is a good reference to get an understanding in terms of configuration for routing system-generated authentication queries through an IPsec tunnel. Also, it has covered both the type tunnel scenario i.e. PBVPN and RBVPN both.

Section - "Translate the addresses of gateways system-generated traffic uses" will cover how to change the NAT address.

Route system-generated authentication queries through an IPsec tunnel:

https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Authentication/HowToArticles/AuthenticationADIPsecRouteSysGenTraffic/index.html

OR You may refer below KBA on same kind of topic:

Sophos Firewall: Route traffic through an IPsec VPN tunnel
https://support.sophos.com/support/s/article/KB-000035839?language=en_US

Hi and thank you for your answers. It looks like this solved my problem, but I can't be sure if this is because of this modifications. See what I did:

On the CLI I added an IPSec route and a sys-traffic-nat rule:

system ipsec_route add host IP-OF-MY-AD-SERVER tunnelname NAME-OF-MY-IPSEC-CONNECTION
set advanced-firewall sys-traffic-nat add destination IP-OF-MY-AD-SERVER snatip IP-OF-MY-MANAGEMENT-GATEWAY

After applying these commands, I remodified the name of the management network by removing the "A" from the name, so that it returned to second position. After applying the changes, the requests were sent by the management interface, as I wanted.

However, by deleting the 2 newly created rules (IPsec route + sys-traffic-nat), my packets are still sent by the management interface. So I wonder if everything I did had an impact...

What do you think about this?

Hi and thank you for your answers. It looks like this solved my problem, but I can't be sure if this is because of this modifications. See what I did:

On the CLI I added an IPSec route and a sys-traffic-nat rule:

system ipsec_route add host IP-OF-MY-AD-SERVER tunnelname NAME-OF-MY-IPSEC-CONNECTION
set advanced-firewall sys-traffic-nat add destination IP-OF-MY-AD-SERVER snatip IP-OF-MY-MANAGEMENT-GATEWAY

After applying these commands, I remodified the name of the management network by removing the "A" from the name, so that it returned to second position. After applying the changes, the requests were sent by the management interface, as I wanted.

However, by deleting the 2 newly created rules (IPsec route + sys-traffic-nat), my packets are still sent by the management interface. So I wonder if everything I did had an impact...

What do you think about this?

Hi Rodrigue GRIMAUD  Assuming - It may be possible due to the existing connection not being flush which was present on the appliance, Traffic used the same connection and SNAT IP as in the management interface network IP that you want in your use case, Probably after a while when the existing connection flushed due to no traffic and new traffic will come again and XG will do route lookup or connection establishment at that time you may encounter an issue again. So as guided in the above KBA and Help section it is better to keep the SNAT and IPSec route for the destination host in a policy-based VPN scenario for appliance (device) generated traffic as per your current requirements.

Hi Vishal_R , thank you for your answer. I obviously recreated my rules. Thank you for your explanations. Everything has been working fine for several days.

Thanks again

Regards

Hi Rodrigue GRIMAUD Thank you for sharing your observations and issue status. I am glad to hear that the issue is fixed now.