Hello,
I have an MP70 that does not have a public IP. It initiates an IPSec connection to one of my Sophos Firewalls. The connection comes up great and if I am behind the MP70, I can get to the internet and to the servers behind the Sophos Firewall. Going the other direction though is becoming an issue. When I try to ping or access anything on the MP70 side from a server behind the Sophos Firewall, I get no response. I ran a TCPdump on the Sophos and see the ICMP request coming in PortA1.42 and going out ipsec0, but that is it. I also checked the other side with TCPdump running on a laptop and see no traffic hitting the LAN. I looked but there does not seem to be a way to do a packet capture directly on the MP70. Let me know if there is please.
Since I have the tunnel partially working, I won’t fill in all the tunnel config, but here is my networks:
Sophos side local networks:
10.0.42.0/24 (Servers Net)
10.81.234.0/24 (SSL VPN)
Sophos side remote networks:
192.168.13.0/24 (MP70 LAN)
MP70 side local network:
192.168.13.0/24 (LAN)
MP70 side remote networks:
10.0.42.0/24 (Servers Net)
10.81.234.0/24 (SSL VPN)
From my laptop behind the MP70, I can ping one of my servers at 10.0.42.5, but 10.0.42.5 cannot ping back the other way. I get this in a TCPdump on the Sophos:
21:20:11.816165 PortA1, IN: ethertype IPv4, IP 10.0.42.5 > 192.168.13.100: ICMP echo request, id 14, seq 586, length 64
21:20:11.816165 PortA1.42, IN: IP 10.0.42.5 > 192.168.13.100: ICMP echo request, id 14, seq 586, length 64
21:20:11.816172 ipsec0, OUT: IP xx.xx.xx.xx(PublicWANIP) > 192.168.13.100: ICMP echo request, id 14, seq 586, length 64
Here is the TCPdump on the Sophos of the laptop pinging the server :
21:05:19.977786 ipsec0, IN: IP 192.168.13.100 > 10.0.42.5: ICMP echo request, id 32256, seq 0, length 64
21:05:19.977846 PortA1.42, OUT: IP 192.168.13.100 > 10.0.42.5: ICMP echo request, id 32256, seq 0, length 64
21:05:19.977848 PortA1, OUT: ethertype IPv4, IP 192.168.13.100 > 10.0.42.5: ICMP echo request, id 32256, seq 0, length 64
21:05:19.978001 PortA1, IN: ethertype IPv4, IP 10.0.42.5 > 192.168.13.100: ICMP echo reply, id 32256, seq 0, length 64
21:05:19.978001 PortA1.42, IN: IP 10.0.42.5 > 192.168.13.100: ICMP echo reply, id 32256, seq 0, length 64
So, I see the request going out the tunnel, but that is it. Ideas?
ALEOS Software Version: 4.16.2