This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site-to-Site RED tunnel not working

Hi,

I'm having the hardest time setting up a Site-to-Site RED tunnel between two SG230 appliances.

I'm trying to establish a tunnel between our main site (subnet 10.0.0.0/16) and our remote site (subnet 10.3.0.0/16).

I was following the steps from the tutotial located at

https://community.sophos.com/kb/en-us/120157

and was able to get the RED-tunnel up.

However, setting the static routes as described in the howto does not work unfortunately, no traffic seems to pass between both UTMs.

I've defined the reds2 Interface on the main site UTM with the ip adress 192.168.200.1 (We have another RED tunnel to a RED15 appliance at another branch Office, which is why the server Interface is named reds2) and the redc1 Interface on the remote site with the ip adress 192.168.200.2.

At this Point, shouldn't I be able to ping both RED endpoints from either UTM? At the Moment, I'm unable to get any pings across.

Any help would be appreciated!

Dominik



This thread was automatically locked due to age.
  • Just to make sure, you are using the UTM's as default gateway at both sides for the clients you are using in the ping test do you?


    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • Off course i do,you can see that on my last screenshot where is also ipconfig in window, im managing quite big company network so in basic settings there is absolutely no problem...

  • This is a long thread, so you all may well already have discussed the fact that ICMP/ping is not included in the "Any" service.  Do specific rules allowing ping between the subnets resolve this mystery?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi Bob,

    ping is included in fw rule,as it is on screenshots,also tried rule only for ping...

    To the hell with ping, but nothing is working, RDP, SSH,FTP...

    Bob should i be able to ping from client on both RED interfaces? I mean virtual iface on both sites...? The local one im able to ping,so internal routing works,but not remote...

    From UTM/Support/Tools/ping it works fine to ping everywhere...

  • I'll take a look at the pictures you posted, but, based on your last post, I wonder if there aren't routing problems outside the UTM.  What happens if you make a masq rule like 'Semily RED subnet -> LAN' in one UTM and a corresponding rule in the other?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi Bob,

    i tryied masq also like Semily subnet -> LAN and Semily subnet -> local RED interface...

    Nothing...

    Tracing route to 10.10.1.56 over a maximum of 30 hops

      1     2 ms     1 ms     3 ms  192.168.6.1
      2     *        *        *     Request timed out.
      3     *        *        *     Request timed out.

  • You're using different network objects in the routes and firewall rules.  Is the problem that you need two firewall rules for traffic from the LAN to the remote subnet: one in the server side allowing traffic from the LAN to the remote subnet and one on the client that allows traffic from the server-side LAN to the client-side subnet.  In fact, before you do that, you should see blocks in the Firewall Live Log if this is the problem.

    If you still haven't solved the problem, Please make a diagram for us, including IPs and subnets.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • I tryied so many combinations in firewall rules that i almost cant count them all.

    Im going to draw a diagram, by hand, ill post it in few minutes...

  • From UTM Client Tools im able to ping server 10.10.1.56 on RED 50 site...

    Also im able to ping 10.30.1.1

    but from client behind Client UTM im able to ping only 10.30.1.2, nothing else...

  • Vitek, I think my last comment about firewall rules was right.  I'll just use the numeric subnets as the network objects will have different names in each UTM:

    RED Client UTM:

    1. 192.168.6.0/24 -> Any&Ping -> 10.10.1.0/24 : Allow
    2. 10.10.1.0/24 -> Any&Ping -> 192.168.6.0/24 : Allow
    3. Gateway Route 10.10.1.0/24 via 10.30.1.1

    RED Server UTM:

    1. 192.168.6.0/24 -> Any&Ping -> 10.10.1.0/24 : Allow
    2. 10.10.1.0/24 -> Any&Ping -> 192.168.6.0/24 : Allow
    3. Gateway Route 192.168.6.0/24 via 10.30.1.2

    Any better luck now?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA