Setting up site-to-site on Sophos XG

Note: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

Configuring at the Sophos XG Interface

Go to the Sophos XG interface and add a local and remote LAN
Go to Hosts and Services > IP Host and select Add to create the local LAN

Sophos XG firewall interface configuration form with LAN name, IPv4 network type, and subnet settings

Go to Hosts and Services > IP Host and select Add to create the NordLayer LAN (10.6.0.0/20)

Sophos XG IP host definition form with LAN name, IPv4 network type, and subnet configuration

Create an IPsec VPN connection
Go to VPN > IPsec Connections and select Wizard.

Sophos XG VPN settings panel with IPsec policies tab and Wizard button highlighted

Give it a name and description

Sophos XG VPN connection wizard showing four-step setup with NordLayer name field highlighted

Click Start to follow the wizard

Sophos XG VPN wizard showing Remote Access connection type highlighted among connection options

Select Site To Site as a connection type and select Head Office

Sophos XG VPN wizard showing Site-to-Site connection type highlighted among three network topology options

Set the Authentication Type to preshared key (generate this value as we will also need this value on our end)

Sophos XG VPN authentication wizard with preshared key option selected and key input fields

Enter details for the local network, including the local WAN port, IP version, local subnet, and local ID

Sophos XG VPN wizard configuring local WAN port, IPv4 network, local subnet, and ID settings

Enter details for the remote network, including the remote VPN server, IP version, and remote subnet (10.6.0.0/20, or as displayed NordLayer_LAN)

Sophos XG VPN wizard configuring remote server IP, subnet, and Remote ID settings

In the User Authentication Mode field, choose Disabled
Review the IPsec connection summary and click Finish
Click the Status (Active) to activate the connection

Sophos XG IPsec connections table showing active NordLayer site-to-site VPN with green status indicators

Add two firewall rules allowing VPN traffic
Go to Firewall and click +Add Firewall Rule

Sophos XG Firewall dashboard with IPv4 tab and Add firewall rule button highlighted

Create two user/network rules as shown below

First Rule:

Sophos XG firewall rule form with NordLayer name, LAN VPN description, and Accept action configured

Sophos XG firewall source configuration with LAN zone and localsubnet network selected

Sophos XG firewall destination configuration with VPN zone, NordLayer LAN network, and Any services selected

Click Save.

Second Rule:

Sophos XG firewall rule form with NordLayer name, VPN-LAN description, and Accept action configured

Sophos XG firewall source configuration with VPN zone and NordLayer LAN network selected

Sophos XG firewall destination configuration with LAN zone, localsubnet network, and Any services selected

Click Save.

Ending note:

In order to finalize the site-to-site tunnel, please create a setup in Sites tab of the NordLayer Control Panel.

Pre-shared key - you can generate it or we can provide it
Encryption details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP)
Remote subnet and mask (the subnet is used in your local network)

Note: In case you are experiencing different results, make sure that you have you carefully gone through all the steps. Having said that, in case the issue persists please feel free to contact our 24/7 customer support team.

Documentation Index

Setting up site-to-site on Sophos XG

Configuring at the Sophos XG Interface

First Rule:

Second Rule:

Ending note: