Site-to-site VPN traffic between Sophos and Fortigate not be forwarded

[timchen]

I have 2 offices, Site A is Sophos and Site B is Fortigate. I have established Site-To-Site VPN for the two sites. The tunnel between the two sites is UP, but the Tunnel Interface IP cannot ping each other and the two sites cannot ping each other. The server under the site cannot ping the opposite endpoint.

The following is relevant information:

Site A (Sophos)

• WAN IP : 11.11.11.11
• LAN IP Subnet : 172.29.21.0/24, Server IP: 172.29.21.11 (LAN Gateway under Sophos Firewall)
• Tunnel Interface IP : 10.212.0.1/29
• Firewall Policy: Accept LAN(172.29.21.0/24) toVPN(10.210.101.0/24) 

Site B (Fortigate)

• WAN IP : 22.22.22.22
• LAN IP Subnet : 10.210.101.0/24, Server IP: 10.210.101.11 (LAN Gateway under Fortigate Firewall)
• Tunnel Interface IP : 10.212.0.6/29
• Static Route: 172.29.21.0/24 via interface S2S_DCOF_M
• Firewall Policy: Accept LAN(10.210.101.0/24) to S2S_DCOF_M(172.29.21.0/24)

  (Below Fortigate IPSec Tunnel Status)

Here I'm using Route-based to establish a Site-To-Site VPN connection, I've also tried Policy-based, but neither worked, and I'm not sure if I'm missing any settings.

I can't ping from the tunnel interface 10.212.0.1 to 10.212.0.6, nor does the reverse ping from 10.212.0.6 to 10.212.0.1.

and i tried the mtr from server, according to the server's mtr tracking, the data will stop at Fortigate's LAN Gateway

 

[timchen]

Hi @AEK 

Thank you for your help. Today, I conducted various checks again without changing any settings, and suddenly the tunnel started working, but I don't know why. I'm not sure if it's a bug in the Sophos Firewall or some issue with the internet line.

But all the setup steps should be correct.

[Tzneg_wx]

The establish a routed base site-to-site VPN with Sophos. You must set laocl subnet in FortiGate VPN Phase2, but do not set romote subnet.

This will make it successful. You can try it.