Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 6 replies
  • Subscribers 3 subscribers
  • Views 4488 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't access remote network over IP Sec Site-to-Site VPN

Its Ecko

So I have this annoying problem that I signed up just to ask. I tried my best to find an open thread but didn't really find anything. Please let me know what I'm doing wrong!

I have two sites setup with the Sophos UTM 9 and successfully established the IPSec site-to-site VPN tunnel however when trying to access the remote networks, I'm unable to. I've tested this on Cisco devices with no problems but I'm new to Sophos so I may have overlooked something.

I'm not sure where to start but here are my networks:

Site 1 (Me) - 192.168.1.0/24
Site 2 (Remote) - 192.168.2.0/24

IPSec VPN site-to-site on both ends are up and my automatic firewall rules are in place so Any traffic is permitted in both directions

My SNAT rule on Site 1 is any network using any service going to internet ipv4 to change the source to the WAN address. No automatic firewall rule but manually created to allow internet access.
My SNAT rules on Remote is is any the internet network using any service going to internet ipv4 to change the source to the WAN address. Automatic firewall rule created.

The pings and http access isn't being blocked on either side in the firewall logs and I see SYN requests showing on my end triggering the NAT rule.

I don't have any static routes set.

I tested the pings from the gateway on either side with no success. I'm also able to login to the remote gateway via the admin console to make any config settings.

 

What an I missing?



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    I do not quite understand why you need SNAT to get the ipsec work. If the ipsec and automatic firewall rule is on it should work. What does tcpdump show does the traffic even reach the remote device? Normaly just to reach the remote gateway u do not need any routes.

    Regards

    Jason

    Sophos Certified Architect - UTM

Reply
  • 0

    Hi,

    I do not quite understand why you need SNAT to get the ipsec work. If the ipsec and automatic firewall rule is on it should work. What does tcpdump show does the traffic even reach the remote device? Normaly just to reach the remote gateway u do not need any routes.

    Regards

    Jason

    Sophos Certified Architect - UTM

Children
  • 0 in reply to Jason Klein

    Basically I'm using it for translating my internal Network to the internet. I know I can use masquerading but I wanted the flexibility of translating all of my VLANs.

    I know I don't need to translate my IPSec traffic, usually on Cisco I would need to modify the ACL that the NAT rule uses to exclude the internal Network to the remote network but I don't know if the UTM handles that for me. I know it takes care of the routing and then created the bidirectional ACL when I checked the firewall exception box on the IPSec profile.

    I would have to check the tcpdump in the morning.

Unfiltered HTML