This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't get RED UTM to RED UTM bridging to work

Hi,

I am trying to have connected my two UTMs (9.315-2) via a RED tunnel, using the same subnet 192.168.0.0 / 24 and bridging.

After having spent several hours and red every thread i found in relation to that I am giving up an asking for help.

What I have is:
- working red tunnel between UMT MUC (IP 1) and UTM NYC (IP 2)
- LANs connected to each UTM with same above subnet 192.168.0.0 / 24, but different gateways (IP 1 / IP 2, see above), no conflicting IPs.
- both UMTs do DHCP for non conflicting ranges within the same subnet.
- a bridged internal interface with reds1 / redc1 on each side
- a firewall rule on each side internal -> all -> internal -> allow
- NO masquerading rule internal - internal (but had tried that too)
- Intrusion Prevention, Application Control Advanced Threat Protection are OFF.

Result / Status qou:
- working ping from each UTM to the other UTM
- UTM NYC can ping devices in the remote network but not the other way around (! even so i cannot find any relevant difference in configuration)
- no UTM connected network device can ping or TCP connect to devices behind the remote UTM
- not evidence of allowed or denied traffic in firewall logs

Is there anything else if have overseen or where i could start investigating any further ?

Thanks a lot for any hints in advance. [:)]

This thread was automatically locked due to age.

0 BAlfson over 9 years ago

Hi, Bate, and welcome to the User BB!

Please click on [Go Advanced] below and attach pictures of the configuration showing the relevant objects open in Edit.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Bate over 9 years ago

MUC UTM side 1-5
Cancel
Vote Up 0 Vote Down

Cancel
0 Bate over 9 years ago

MUC UTM side 6-7
NYC UTM side 1-3
- muc-rule-6.PNG
- View
- Hide
Cancel
Vote Up 0 Vote Down

Cancel
0 Bate over 9 years ago

NYC UTM side 4-7
Cancel
Vote Up 0 Vote Down

Cancel
0 Bate over 9 years ago

Note:

The firewall rules using "Red Bridge" have been described in an older Sophos RED bridging guide.
The don't seem to change anything.
Cancel
Vote Up 0 Vote Down

Cancel
0 Bate over 9 years ago

Since a had no idea how to get this to work, i set up a regular RED UTM site2site tunnel with routing.
Remotely changing all static IP adresses in the remote network was a challenge, but i got it done.

One issue is left yet: I am accessing both networks with Ipsec VPN client connections to each UTM.
But I can only access the local networks, but not the remote ones.
Firewall rules are done.
Would additional routing and or masquerading settings be required?
Cancel
Vote Up 0 Vote Down

Cancel
0 Bate over 9 years ago

This issue i got solved:

Yes - additional masquerading rules are required for IPSEC clients to access the remote side of a RED tunnel:

IPSEC user Red Interface
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 9 years ago

Great Problem solving, Bate!

Thanks for the pictures. You're right that the RED Bridge Network definition and the related firewall rules are unnecessary.

Your workaround mentioned in Post #7 was necessary because "VPN Pool (IPsec)" was not included in the RED tunnel. Although How to allow remote access users to reach another site via a Site-to-Site Tunnel uses the example of SSL VPN over a site-to-site IPsec tunnel, the principles also apply to your case. Note the suggestion to change the "VPN Pool (----)" in one of the locations.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Bate over 9 years ago

Hi BAlfson,

thanks for the link with the howto... very helpful since this configuration is nothing i would have found out myself. Will try that in a quiet minute.
Cancel
Vote Up 0 Vote Down

Cancel
0 Bate over 9 years ago

Did you have on obvious idea though, why bridging was not going to work for me?
I might still want that for another branch using a RED10 device.
Cancel
Vote Up 0 Vote Down

Cancel