IPsec with multiple subnets

Salut Nick,

If you followed How to allow remote access users to reach another site via a Site-to-Site Tunnel, you should have no trouble.  An SNAT should not be needed if the IPsec tunnel and the Remote Access Profile are configured as in that KnowledgeBase article..

Cheers - Bob

Gretting BAlfson,

Thank you a lot for looking into my issue,

Okay, so according to the KB; which seems to correspond my configuration/situation, 

Here are what is configured so far;

Site 1 (the Sophos UTM 9 : One that I am administering ) :

• SSL VPN Remote Access : 'Local Networks' = "Internal (Network / LAN)" and "LAN at Site2" (as you can see in the screenshots)
•  Site-to-site configuration :
  • "Remote Gateway" "Remote Networks" = "LAN at Site2"
  • "IPsec Connection" "Local Networks" = "Internal (Network / LAN)" and "VPN Pool (SSL)

Site 2 (a fortigate firewall that is not in my control) has the same configurations. I asked the person in charge to add the VPN SSL Network as a remote network. 

So far, from a VPN SSL connection, I can reach the http IIS webserver of the remote site's server but I can't ping (which I can do when I am in the LAN network) nor reach it's windows network drives. 

Thank you,

Cheers. 

Gretting BAlfson,

Thank you a lot for looking into my issue,

Okay, so according to the KB; which seems to correspond my configuration/situation, 

Here are what is configured so far;

Site 1 (the Sophos UTM 9 : One that I am administering ) :

• SSL VPN Remote Access : 'Local Networks' = "Internal (Network / LAN)" and "LAN at Site2" (as you can see in the screenshots)
•  Site-to-site configuration :
  • "Remote Gateway" "Remote Networks" = "LAN at Site2"
  • "IPsec Connection" "Local Networks" = "Internal (Network / LAN)" and "VPN Pool (SSL)

Site 2 (a fortigate firewall that is not in my control) has the same configurations. I asked the person in charge to add the VPN SSL Network as a remote network. 

So far, from a VPN SSL connection, I can reach the http IIS webserver of the remote site's server but I can't ping (which I can do when I am in the LAN network) nor reach it's windows network drives. 

Thank you,

Cheers. 

If you don't see the pings being blocked in your firewall log, Nick, then my guess is a setting in the Fortigate. See 3. in #2 in Rulz (last updated 2021-02-16).

I'll also guess that the remote Windows server has a setting that blocks your SSL VPN access to the shares, but I would have thought the SNAT suggested by Harsh would have fixed since your Internal network can access the shares.

Chers - Bob

BAlfson said:

SNAT

Okay, So just to update for providing a wonderful KB and helping with the issue, the remote site kept on informing me that everything is open and that there are no IPs/Ports blocked on their site but I was curious to find a workaround. 

Since the LAN Network already has full access to the remote site, I just put in place a SNAT towards the IPSec and everything is working as expected/needed. 

Thank you a million times, both BAlfson and   

Now, I have another issue, from time to time, the Sophos UTM9 disconnects all my VPN SSL users randomly and reconnects them after  ~ 5 minutes. I went through the VPN SSL logs but couldn't find why? 

For ex : at 12h00 - 15 vpn connections, at 12h05 - 30 vpn connections and at 12h10 - back to the usual 15 vpn connections.  

** the issue is that they use a specific application that breaks at each VPN disconnection. Some are not happy 

Chouette que SNAT ait résolu le problème, Nick !

One of the unwritten rules here is "one topic per thread" - that's to make it easier for future members to find an answer to a question that's already been answered.  Using an appropriate title, please ask your new question in the VPN forum.

Cheers - Bob