help to configurate IPSec VPN sophos xgs136

Where exactly do you need help? Have you tried setting it up under Configure -> Site-to-site VPN?

Hello Davide Filippi ,

Thank you for reaching out to the community, you can refer the Create a policy-based IPsec VPN using preshared key.

Thank you for the response. I had already followed this guide and the result is that the tunnel is up but the provider tells me that from his side he can send packets but not receive them. Indeed, if I try to do a tracert, I see that after my firewall, it is not forwarded in the VPN tunnel.

Hello Davide Filippi ,

Please create a new test firewall rule from VPN to LAN and LAN to VPN and keep the rule position on TOP for troubleshooting.

Make sure ping is enabled under Go to Administration > Device access. Under Ping/Ping6, select VPN.

• To see an IPsec connection, go to Current activities > IPsec connections.

Regards

Hi Bharat

As you suggest I've created two firewall rules on top but still doesn't work

Also, in packet capture I see

The upper rule ipsec0 to Port1 gives a Violation. Can you check the corresponding logging in firewall logging if you can find what happens there?

Cannot find firewall log. Neither if I filter "In interface: ipsec0" or "src ip: <ip address of my supplier>".

No record found

Please check by removing source network and destination network as any.If you have added static routing for IPsec please remove it

Firewal log can be found in top right section of webinterface, it's called Log Viewer. From there you should be able to filter on different fields.

 Bharat J I have no static routing for ipsec or nat rules. But if I remove source and destination network and keep only soruce and destination zone then in packet capture I can see status forwarding and not violation. Also, with wireshark, I can see ping request and reply.

 apijnappels Yes, i've check on log viewer but even if now it works I cannot see logs.

Now the problem is in reply. When I receive the ping I can see "In interface" ipsec0 but when I reply to ping I see "Out interface" port2.

Port1 is my lan interface

port2 is my wan interface (where I have multiple ip)