Can't connect to IPSEC VPN from my laptop through XG (v18 EAP3) firewall

Screenshot showing that the traffic is not passing on UDP 500 but not being dropped, also successful connection on TCP 443.

Could you perform a conntrack?

conntrack -E | grep 68..... | grep NEW

Start this command (without "time") and try to connect.

It looks like, you NAT Table is doing something with those packets.

So if the firewall is picking up this traffic, you should see in the conntrack the NAT Policy and the firewall policy matching and what is going on.

Not NAT'ing, it's almost like the local charon process is getting it but I don't see anything in that log at all. I do have site to site IPSEC and SSL tunnels but that shouldn't impact this.

I left each of the below commands for 1 minute. There were about 8 connection attempts within each duration.

This might be too much info, but my firewall rule is the top rule for bypassing all filtering:

Details:

NAT:

It really does seem like the packet goes in PortA but then pretty much disappears. It's really odd. 

Try conntrack -L | grep 500    or grep 62.... 

Something establish there? 

Because you already tried a drppkt, and if there is no Drops, then most likely there is a connection but we need to know, where the connection is. 

Again, no loving from that command. I've been working on this for over a week now and I have quite a lot of experience with the XG platform. I've been working with it for about 3 years now and so far this is the most confused I've ever been. 

I did have to modify the "grep" filter. If I filter for just the IP or just 500 I get way too much. Grep -E "dport\=500" also works well for this too. That will trigger on orig-dport=500 and reply-dport=500.

This morning I may call support to see if they can help me at all. First I have to wait until 9am when support cuts over to North America.

I just deployed a Sophos UTM on my network using a unique public IP and unique LAN IP, set up only my work laptop to use that as the default gateway and the VPN connects immediately through that.

This is not a fix for me and I still feel that there is a bug of some sort in the Sophos XG v18 EAP3 device. I just cannot be without my company VPN connection for more than a couple weeks at a time.

Do you have IPsec Remote access enabled on this XG? Tested this on two different appliances, all could access IPsec through XG. 

It is somehow not understandable to me, where those packets went in your scenario.

Maybe Rana Sharma or Apurv Patel could take a look at your setup? 

I do have IPSEC enabled on the device, yes. I use a site to site tunnel (parents house, Cisco ASA 5505) and I also use the Sophos Connect client now.