Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 2 replies
  • Answers 1 answer
  • Subscribers 6 subscribers
  • Views 1955 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Bypassing some of the IPSec traffic

Thomas Schachtner

Hi there,

i currently have several IPSec site-to-site connections running on my Sophos UTM.

Recently we received the request to add many more and I do not want the UTM do all the work.

So my idea was that I could assign an additional IP address to my WAN interface and have all the new IPSec connections targeted on that new address.

Then, on the UTM I create a NAT rule to forward all IPSec-like traffic to a separate box which then takes care of the IPSec stuff for these new connections.

 

Unfortunately, this does not work. Packets to port 500 sent to the newly created address do not arrive at their target.

Could this be by design? Or is that supposed to work?

 

Best

Thomas



This thread was automatically locked due to age.
Parents
  • 0

    Hallo Thomas,

    In fact, IPsec does not play well with NAT.  Depending on the IPsec implementation, there might be an easy fix for this.

    If the "separate box" is also a UTM and you're using PSKs, insert the public additional IP in the 'Preshared Key Settings' box on the 'Advanced' tab.  You will need an SNAT for tunnels initiated by the "separate box."

    The alternative would be for the external endpoints to have the equivalent of "Respond only" Remote Gateways and have the "separate box" initiate all tunnels.   If you want to make that traffic leave with the desired IP you will also need an SNAT on the UTM, but that isn't necessary when the "separate box" initiates all tunnels.

    Please let us know what you do.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0

    Hallo Thomas,

    In fact, IPsec does not play well with NAT.  Depending on the IPsec implementation, there might be an easy fix for this.

    If the "separate box" is also a UTM and you're using PSKs, insert the public additional IP in the 'Preshared Key Settings' box on the 'Advanced' tab.  You will need an SNAT for tunnels initiated by the "separate box."

    The alternative would be for the external endpoints to have the equivalent of "Respond only" Remote Gateways and have the "separate box" initiate all tunnels.   If you want to make that traffic leave with the desired IP you will also need an SNAT on the UTM, but that isn't necessary when the "separate box" initiates all tunnels.

    Please let us know what you do.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data
Unfiltered HTML