Site-to-Site RED tunnel not working

Hi Dominik,

To my knowledge, once a tunnel is setup, traffic between two UTMs becomes purely a matter of routing and firewall rules. Can you verify that you configured RED (Network) in the Gateway route definition instead of RED (Address).

Thanks

Hi,

thanks for answering!

I'm pretty sure it had something to do with routing, but I couldn't get it to work.

I decided to scratch the RED setup and instead, went ahead and established a SSL-VPN Site-to-Site tunnel...lo and behold, everything worked right from the get-go.

So I couldn't solve the original problem, but since Sohps UTM is crazy flexible you usually find a solution that works [:)]

Thanks anyway!

Hi,

thanks for answering!

I'm pretty sure it had something to do with routing, but I couldn't get it to work.

I decided to scratch the RED setup and instead, went ahead and established a SSL-VPN Site-to-Site tunnel...lo and behold, everything worked right from the get-go.

So I couldn't solve the original problem, but since Sohps UTM is crazy flexible you usually find a solution that works [:)]

Thanks anyway!

Hi Dowagner,

I've set up an ungodly amount of UTM to UTM RED tunnels in my time and i love them to bits except for sometimes the static routing can be a pain to do.

Set the interface IPs of the UTMs virtual RED interfaces like as follows (with whatever IP you want but following this design):

• UTM1 reds# has IP 10.254.254.1/30
• UTM2 redc# has IP 10.254.254.2/30

Then basically you have to make sure you set a static route for all remote networks like as follows:

• On UTM1 set a static gateway route for all subnets behind UTM2 with the gateway target of 10.254.254.2
• On UTM2 set a static gateway route for all subnets behind UTM1 with the gateway target of 10.254.254.1

Then I make two firewall rules on both UTMs of which are:

• All remote subnets allow any to all local subnets
• all local subnets allow any to all remote subnets

I have followed the method above for all my UTM to UTM RED tunnels I have never had a problem. The main problems people have are:

• They haven't created the RED interfaces yet
• Incorrect IP configuration for the reds/c interfaces resulting in a subnet mismatch/overlap
• No static routes or static routes are incorrectly configured
• No firewall rules allowing a connection being initiated to and from the two UTMs

Additionally, the Any Service does not include ICMP pings, you will have to make sure you allow ping forwards in the Network Protection > Firewall > ICMP tab. Or add the ICMP service to your firewall rule.

SSL VPN & IPSEC tunnels are nice and easy because it does all the virtual interfaces and IP addressing and static routing for you, with the RED UTM to UTM tunnels you have to do it all manually. But I've the RED tunnels to be up to 40% faster than IPSEC!

Emile

Hi Emile,

i followed exactly step by step your guide... Doesnt work...

Site 1 - UTM at work (reds15 iface IP 10.30.1.1/30)

Site 2 - UTM at home (redc15 iface IP 10.30.1.2/30)

Site 1 one of LANs behind 10.10.1.0/24

Site 2 LAN behind 192.168.6.0/24

Static routing Site 1 - 192.168.6.0/24 - Gateway 10.30.1.2

Static routing Site 2 - 10.10.1.0/24 - GW 10.30.1.1

Firewall Site 1 - Site 2 subnet --any-- LAN 10.10.1.0/24 allow

Firewall Site 2 - Site 1 subnet --any-- LAN 192.168.6.0/24 allow

(also tested to add RED network into FW rule, same result)

ICMP and PING allowed on both sites

From UTM Tools at Site 2 im able to ping everything i want, including server in 10.10.1.0 subnet and also red interface 10.30.1.1

From UTM Site 1 it is the same

From client behind UTM Site 2 im able to ping only local red iface 10.30.1.2, nothing else

From client behiind UTM Site 1 im able to ping only local red iface 10.30.1.1 but not remote 10.30.1.2 or any client...

I think that RED interfaces should be normally pingable as they should act as directly connected...

Nothing found in firewall log

Where the hell can be problem?

Thank you

Hi Vikino,

That is really odd, could you provide the following screenshots from both UTMs:

• Screenshot of RED Interfaces
• Screenshot of Static Routes
• Screenshot of Firewall Rules

That would be fab, thanks.

Emile

Site 1 acting as RED server:

Site 2 client:

Hi Vikino,

It looks like you are missing two firewall rules, do you have the two firewall rules:

• Allowing LAN to Semily RED on Site 2
• Red Semily to vitek_subnet2 on site1?

Whats happening here is you're allowing the incoming traffic at each site but you're not actually allowing the initiating traffic which is behind the UTM, so a device in site2 could receive data from site 1, but then the UTM at site1 doesn't allow a device behind site1 out in the first place.

Clone your rules but switch the sources and destinations and lets see what happens :)

Emile

Done... And guess what? Still nothing :-)

Btw. one of my firewall rules is LAN - any - any   allow, currently on both sites, because i dont know what else to try...and firewall is telling just nothing...just dropping some WAN traffic.

One more thing im thinking about is that Site 1 subnet is behind RED50, but that should be not an issue, because from Site 2 UTM/Tools im able to ping that remote subnet 10.10.1.0/24 and servers in it...

Result...

It is connected over 4G so the ping time is appropriate :-)

Just to make sure, you are using the UTM's as default gateway at both sides for the clients you are using in the ping test do you?

Off course i do,you can see that on my last screenshot where is also ipconfig in window, im managing quite big company network so in basic settings there is absolutely no problem...

This is a long thread, so you all may well already have discussed the fact that ICMP/ping is not included in the "Any" service.  Do specific rules allowing ping between the subnets resolve this mystery?

Cheers - Bob