Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 6 subscribers
  • Views 1053 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

S2S IPSec with several IP / Subnet on both Side

RemoHehlert

Hello @all,

I have try to configure one S2S-IPSec Tunnel vom my Sophos UTM to a Fortingate FW with several singel IP Adresses Subnet one both Side an some are private and public IP's.

My UTM configuration example:

Connection Tab:
Local Netw. IP1: 10.130.x.1, IP2:10.131.x.1
Automatic FW Rule: I create own Rule (not Checked)
Strict Route: not Checked
Bind tunnel to local interface: active (test also with unchecked

Remote Connection Tab:
Gateway type: Initiate Connection
Gatewas: GW IP of Remote FW
Authentication type: PSK
VPN ID type: IP Adr-
VPN ID (optional):  Nothing
Remote Networks: Some IP (Public and Private IP) and one Subnet (Private)

Policies:
Komprimierung aus, strikte Richtlinie wird nicht verwendet.
IKE-Einstellungen: AES 256 / SHA2 256 / Gruppe 5: MODP 1536   Lebensdauer: 36000 Sekunden
IPsec-Einstellungen: AES 256 / SHA2 256 / Gruppe 5: MODP 1536   Lebensdauer: 3600 Sekunden

If i enable my IPSec tunnel I get this one:

Why is on the first connection no Policie and up and running connection?

The Remote FW says there are problem with phase 2 are found.

Can anyone help me with that?

may thanks

TBC



This thread was automatically locked due to age.
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for reaching out to Sophos Community.

    Could you please confirm the phase-2 parameters for non-established SA at Fortingate end?

    Also, please run the below command in shell and re-establish the tunnel.

    utm:/root # tail -f /var/log/ipsec.log

    ==> If you have multiple tunnels configured, then grep ipsec.log with tunnel name.

    utm:/root # tail -f /var/log/ipsec.log | grep -i "<tunnel_name>"

    eg: utm:/root # tail -f /var/log/ipsec.log | grep -i "<T-COM-for>"

    Share the session output here or via PM.

  • 0 in reply to FormerMember

    Hello Yash Kothari,

    i have fixed the Problem. There are 2 Problem.

    1. on Fortinet we need to configure IKEv1 because Sophos can't v2, thats not really accaptable!!!

    2. I have to set up 2 Tunnels on Sophos site and several Phase 2 routes on Fortinet site in one Profile.

    Example:
    You have about 6 Systems, 4 one Site A are communicate to 4 on Site B
    2 on Site A are communicate to 4 on Site B

    Fortinet Site:
    IP_1 > IP_A
    IP_2 > IP_A
    IP_3 > IP_A
    IP_4 > IP_A
    IP_1 > IP_B
    IP_2 > IP_B
    IP_3 > IP_B
    IP_4 > IP_B
    and the next IP's or Subnets
    for the other 2 IP do the next, all of them has the same Policy and PSK and are configured on IPSec Profile in Fortinet.

    Sophos Site:
    one IPSec Tunnel for the 4 IP and one Tunnel for the last 2 Systems

    after that one it works.

    When is sophos fixing the problem to allow IKEv2??

    Many thank

    TBC

  • FormerMember
    0 FormerMember in reply to RemoHehlert

    There are currently no plans to integrate IKEv2 into Sophos UTM 9.

  • 0 in reply to FormerMember

    another unbelievable move by Sophos! :-(
    Sophos UTM = Security no thanks!

  • 0 in reply to FormerMember

    Well congratulations.

    This was the final nail in the coffin for us to throw sophos out. Thanks for the ignorance towards your customers

Unfiltered HTML