This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site to Site tunnel up but no traffic between specific Peers

Hi,  

I have an HA SG450 UTM 9 Pair running firmware version 9.705-3 in Active-Passive, on these there is an IPSec Site to Site setup with 1 local network (SNAT) and 10 remote networks which is working great.

I want to add another local network behind an SNAT and 1 more remote networks,  when I add these in everything appears to connect however I cannot reach the new remote network at all.
Original Setup:
The Original SNAT setup is: 10.150.5.0/24 > 10.24.53.15 (1 of 10 remote IPs), Translate to 10.66.35.201

The IPSec Connection was:
10.66.35.201

Remote Gateway Networks:
10.24.53.15

My new settings:
SNAT which is setup as so: 10.150.5.0/24  > 10.66.104.2 (New remote network), Translate to 172.10.0.10 and made sure to check use in IPSec traffic.

My new Network in my IPSec connections is:
10.66.35.201
172.10.0.10

and my new remote network in my remote gateway is:
10.24.53.15
10.66.104.2

I don't see any Firewall Drops for this traffic and I do see it hitting my NAT rule and the automatically created Firewall rule, but the other end of this isn't something I control but they are saying they never see the traffic hit their end, the original one still works fine.
I've ran some ESPDUMPS but awaiting the PSK to actually decrypt to see the traffic, but it appears to be sending out to the correct remote IP.

I am assuming that 2 different SNAT'd addresses as my local networks isn't going to cause my issues as the NAT'd addresses or remote addresses don't overlap anywhere.
Additionally if this were causing an issue could i use an additional IP on my side to create a secondary tunnel instead to the same remote IP, I'm guessing using a respond only connection with the remote side using my additional IP?

Many thanks,
Martin.



This thread was automatically locked due to age.
Parents
  • Hi Martin and welcome to the UTM Community!

    We already know the request goes out and that we see no response, so we don't need to do #1 in Rulz (last updated 2021-02-16). and that it must be a routing problem...

    Are we sure that the other VPN endpoint was also correctly updated with the additional subnets?  If confirming that doesn't resolve this, let's look at pictures of the relevant configurations.  Please show pictures of the Edits of the IPsec Connection, the Remote Gateway, the NAT rules and the firewall rule(s) if 'Automatic firewall rules' is not selected.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi Bob,

    Thanks for replying.  I have learnt more about Sophos UTMs and the various elements from reading your posts so it's a pleasure to "meet" you.

    It turns out that it was working all along and that the other side were not performing sufficient captures, once they had properly performed this we were able to see the traffic and determine that they had a misconfigured firewall rule.

    Many thanks reaching out.

Reply
  • Hi Bob,

    Thanks for replying.  I have learnt more about Sophos UTMs and the various elements from reading your posts so it's a pleasure to "meet" you.

    It turns out that it was working all along and that the other side were not performing sufficient captures, once they had properly performed this we were able to see the traffic and determine that they had a misconfigured firewall rule.

    Many thanks reaching out.

Children
No Data