IPSEC site to site VPN, initiator behind router

Hi GaryBrown,

Thank you for reaching out to Sophos Community.

Kindly check the following KB for reference 

• IPsec VPN with firewall behind a router

Thanks for the link to the article.

The issue is that I don't have access to the shared office router.

I could ask them to setup forwarding rule but chances are that another one of their clients already has a IPSEC VPN in place.

Do I have any other options.

Hi GaryBrown,

Please do reach out to the router administrator. Another tunnel can be created.

Hi GaryBrown , 

* are you able to ping head office wan ip (118.xyz)  from branch office XGS?

* please check this: since the intervening device is a router, it should be having one subnet towards branch office (initiator) and another subnet towards head office.

* with this, branch office xgs should have remote gw (in Ipsec config) set to ip address of router interface pointing to branch office

* I am assuming ip address 150.xxx is on the router interface towards Internet (towards Head office XGS) as I see remote gw on Head office is set to this ip.

* Try with this 1st option:

On Head office: remote id type: IP address, Remote id: 150.xxx

No need to use local id and do not use local/remote id on Branch office.

2nd option:

On Branch office : Under Local gateway -->  Select Local ID type: DNS, Local ID: test

On Head office: Under Remote gateway -->  Select Remote ID type: DNS, Remote ID: test

Try these things and see if the connection comes up, also check the /log/charon.log on both Branch office and Head office while bringing up tunnel.

If this is not solving the issue, please share the access id of Branch and Head office to me on sreenivasulu.naidu@shophos.com, will take a look at the setup.

Had a personal chat with GaryBrown , looked at the setup; able to ping from Branch office SFOS to Head office SFOS on wan port (via shared router that does snat),  but from HO, unable to ping Branch office ; most likely - this caused Branch's IPsec initiation packet reaches Head office, but the response packet is not reaching Branch office and hence connection did not come up. Suggested to work on shared router to adjust the reverse path packet forwarding; once HO is able to ping BO on its wan ip,  Ipsec connection should come up.

Thanks Sreenivasulu for your input and assistance.

As I expected I am having issued with getting the shared office IT to setup port forwards and thus at this stage do not have the site to site working.

I am not really sure why port forwards are required.

We have this exact scenario setup using Draytek routers at another site.

Not sure why our Sophos units (which we promote as superior) cant do it.

For anyone looking

I was never able to get the IPSEC VPN working

For my interest I have done further testing using the same two Sophos XGS units as per my original post.

To first of all prove that I didn't have something fundamental wrong in my setup, I connected a 4G modem with a static IP address in the hosted office, update the IP in the IPSEC VPN settings and it connected without issue.  The 4G Modem was then removed.

I then did some further testing, I was able to get a XGS to XGS RED tunnel connected without needing to get any firewall/forwarding rules setup on the managed office network.

If RED can 'figure out' how to get the connection working, not sure why IPSEC could not.