Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 39 subscribers
  • Views 204 views
  • Users 0 members are here
Options
Suggested

Sophos firewall IPSec site-to-site with Mikrotik

nauriz

 have two local networks on Sophos firewall, one is 192.168.0.0/24 which is on LAN_P5(physical interface) and other is 10.35.11.0/24 which is on port 5.11(VLAN).
I made an IPSec tunnel with a Mikrotik router, which has a LAN network 192.168.1.0/24.
All policies are the same for both sophos LANs and also there are policies for both LANs on Mikrotik.
The problem:
From Mikrotik I can ping any host on network 10.35.11.0/24, but on network 192.168.0.0/24 I can only ping Sophos address 192.168.0.1, all other addresses are not responding.
If I ping from the Sophos side using ping -a 192.168.0.1 192.168.0.0/24 (any host on this network) the ping is answered.
Here are packet captures from Sophos to ping examples to both Sophos network hosts from Mikrotik.
Ping from 192.168.1.1 (Mikrotik router on other end of ipsec tunnel) to 10.35.11.2

Ping from 192.168.1.1 (Mikrotik router on other end of ipsec tunnel) to 192.168.0.80

Route precedence is set to vpn static sdwan

Tried also setting IPSec route - system ipsec_route add net 192.168.0.0/255.255.255.0 tunnelname IPSec_tunnel

I have no more ideas what to test.



Added TAGs
[edited by: Erick Jan at 7:50 AM (GMT -8) on 15 Jan 2025]
Parents
  • 0

    Hi Nauriz,

    Can you also test if the network 192.168.0.0/24 only replies to its own network

    Test 1: perform a ping from a different network interface

    syntax: ping -a (IP network interface) (IP destination)

    Example where in the X.X.X.X is another network interface IP in Sophos

    If the IP was able to respond then we will need to further investigate the issue

    If the IP did not respond then the issue is that the network 192.168.0.0/24 only responds to it own network and I would suggest creating a firewall rule and configure a linked nat rule that the SNAT is MASQ

    here is an example:

Reply
  • 0

    Hi Nauriz,

    Can you also test if the network 192.168.0.0/24 only replies to its own network

    Test 1: perform a ping from a different network interface

    syntax: ping -a (IP network interface) (IP destination)

    Example where in the X.X.X.X is another network interface IP in Sophos

    If the IP was able to respond then we will need to further investigate the issue

    If the IP did not respond then the issue is that the network 192.168.0.0/24 only responds to it own network and I would suggest creating a firewall rule and configure a linked nat rule that the SNAT is MASQ

    here is an example:

Children
No Data
Unfiltered HTML