SNAT over ipsec not working XGS2100

More updates on license. Its already visible in licensing portal here on device even after synchronise base Firewall showing  "Not Subscribed"

Hi Akshay Hegde 

Please contact Sophos Customer Care with Sophos Support to fix the issue with the license.

Check  Sophos Firewall: Impact of expired license  

Thanks and Regards 

Yes raised case already.  Its not expired we just bought new device recently and its already showing in Sophos cloud with description perpetual

When is your start date of the new Appliance? Currently the appliances (Base License) can have a future start date, which is shown in the license Schedule. 

Only Customer care can address this right now. 

Scheduled date is 14/03/2024, but this is very strange I spent nearly 24 hours to know this root cause... There is no alert or notification on admin interface regarding license requirements for site to site vpn. I requested for early activation so for nothing positive.

Which is recommended interms of best performance.

Policy based site to site vpn ? Or Route based ?

Any benchmarks?

Generally speaking this situation will be resolved in the future. Base licensing will be applied on delivery and not on subscription start date, which do not open this kind of problem. 

About the second question, both perform on a high level the same but Route based VPN generally speaking is better to setup and maintaine on the long run. 

Generally speaking this situation will be resolved in the future. Base licensing will be applied on delivery and not on subscription start date, which do not open this kind of problem. 

About the second question, both perform on a high level the same but Route based VPN generally speaking is better to setup and maintaine on the long run. 

Sophos team resolved this licensing issue my branch office link is up now.

so, now you're still working on  the SNAT issue?

who cannot access AD servers? the firewall or network devices on the remote side?

when it's your firewall:

set advanced-firewall sys-traffic-nat add destination 172.16.1.1 netmask 255.255.255.255 snatip 192.168.1.1

assuming your AD server is 172.16.1.1 and the firewall IP is 192.168.1.1

https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Authentication/HowToArticles/AuthenticationADIPsecRouteSysGenTraffic/index.html

After license synchronisation it resolved issue was with licence... It's hidden

having the same issue right now after replacing XG with XGS.

XGS license will be active only in 5 days in the future, the day where the XG expires.

struggling with wireless and SNAT not working. Thinking of a technical issue.

No information about license issue anywhere. That should be improved with a fat banner on the dashboard.

Found this thread here again.

what's the use of base license expired and only the subscriptions in evaluation mode?

This issue will be resolved in the future (we are working on a fix for that).
Base license is currently tied to the subscription start date - we will change that to order processing, meaning the base license will be activate on delivery.

You can contact Sophos customer care to get this manually fixed. 

Yes, thanks. Case is open and I have the feeling it is going well. They want to enable a new evaluation for the base subscription.

Yes without license it will not work... It's hidden features of sophos  no notification nothing.  Log case and request early activation of license. 

Base license is useless. At least they should provide notification saying what will not work.

Some information is here:  Sophos Firewall: Impact of expired license 
Earlier it was a rare case to have an expired base license. And Sophos wants to get back to this state but it needs some changes in the licensing and order processing workflow. 

my case has been resolved in ~1h. that was a good experience.

Thank you for the feedback LHerzog  !