Setting up site-to-site on Sophos XG


Note: If you are unsure whether site-to-site is the best solution for you, please take a look at our Remote Access article first. What is more, if your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

 

Configuring at the Sophos XG Interface

1. Go to the Sophos XG interface and add a local and remote LAN

2. Go to Hosts and Services > IP Host and select Add to create the local LAN

01_Setting_up_site-to-site_on_Sophos_XG.png

3. Go to Hosts and Services > IP Host and select Add to create the NordLayer LAN (10.6.0.0/20)

02_Setting_up_site-to-site_on_Sophos_XG.png

4. Create an IPsec VPN connection

5. Go to VPN > IPsec Connections and select Wizard.03_Setting_up_site-to-site_on_Sophos_XG.png

6. Give it a name and description

04_Setting_up_site-to-site_on_Sophos_XG.png

7. Click Start to follow the wizard

05_Setting_up_site-to-site_on_Sophos_XG.png

8. Select Site To Site as a connection type and select Head Office

06_Setting_up_site-to-site_on_Sophos_XG.png

9. Set the Authentication Type to preshared key (generate this value as we will also need this value on our end)
07_Setting_up_site-to-site_on_Sophos_XG.png10. In the Local Subnet field, choose the local LAN created earlier

08_Setting_up_site-to-site_on_Sophos_XG.png11. In the Remote Subnet field, choose the remote LAN created earlier

09_Setting_up_site-to-site_on_Sophos_XG.png

12. In the User Authentication Mode field, choose Disabled

13. Review the IPsec connection summary and click Finish

14. Click the Status (Active) to activate the connection

10_Setting_up_site-to-site_on_Sophos_XG.png

15. Add two firewall rules allowing VPN traffic

16. Go to Firewall and click +Add Firewall Rule

11_Setting_up_site-to-site_on_Sophos_XG.png

17. Create two user/network rules as shown below

First Rule:

12_Setting_up_site-to-site_on_Sophos_XG.png

13_Setting_up_site-to-site_on_Sophos_XG.png

14_Setting_up_site-to-site_on_Sophos_XG.png

Click Save.

Second Rule:

15_Setting_up_site-to-site_on_Sophos_XG.png

16_Setting_up_site-to-site_on_Sophos_XG.png

17_Setting_up_site-to-site_on_Sophos_XG.png

Click Save.

 

Ending note:

In order to finalize the site-to-site setup on our end, we will need these values:

  • Pre-shared key - you can generate it or we can provide it
  • Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
  • Remote gateway/router public IP (must be reachable while connected to the dedicated server)
  • Remote subnet and mask (the subnet is used in your local network)

Lastly, it is important to know what device or cloud network is being used (Ubiquiti, Fortigate, AWS, Google Cloud, etc.)

You can provide all of these values to us securely via privnote.com

In case you are experiencing different results, make sure that you have you carefully gone through all the steps. Having said that, in case the issue persists please feel free to contact our 24/7 customer support team.


Return to top