Create a Site-to-Site VPN Using Sophos UTM

By | October 29, 2016


Two running instances of Sophos UTM with the following basic characteristics:

  • Each Sophos appliance should have a public IP assigned to the external NIC of the appliance.
  • Each Sophos appliance should have basic configuration to serve as gateway for Internet access.
  • Either a full or trial Sophos license to be able to use the appliance’s VPN features.
  • Network connectivity between these two appliances.
  • Remote Desktop, ping, or other application that can be used for testing connectivity through the tunnel.

Sample configurations used for this tutorial

Below is a sample representation of the topology to be used for this tutorial.

Logical diagram of Sophos to Sophos VPN

To set up this topology, this tutorial will make use of two ProfitBricks Virtual Data Centers (VDCs). Each virtual data center is self-contained and therefore will act as two separate physical locations even though they are technically on the same physical data center.

Here are the sample networking details that will be used during this tutorial, and a screen shot for one of these VDCs. The second VDC should look identical except that we will use a different internal IP space (subnet) to avoid unnecessary NAT rules.

  • VDC-01 Sophos Public IP: 162.254.X.X
  • VDC-01 Sophos Internal IP:
  • VDC-01 Mgmt Server Internal IP:
  • VDC-02 Sophos Public IP: 208.94.Y.Y
  • VDC-02 Sophos Internal IP:
  • VDC-02 Mgmt Server Internal IP:

Sophos to Sophos VPN - ProfitBricks VDCs

Set up the remote gateway

On your primary Sophos UTM (VDC-01), go to Site-to-Site VPN located on the left navigation menu. Then select the IPSec sub-menu option as depicted below.

Primary Sophos UTM IPSec

Next, go to the Remote Gateways tab, click on the New Remote Gateway button, and fill out the details accordingly.

Here is a sample configuration:

  • Name: VDC-02
  • Gateway type: Initiate connection.
  • Gateway: Click the + button to create a new Host by entering the details for the VDC-02 Sophos (Public IP).
  • In this scenario, this would be the 208.94.Y.Y public IP.
  • Authentication type: Preshared key
  • Key: Enter a password to be used for the creation of the tunnel.
  • Repeat: Re-enter a password to be used for the creation of the tunnel.
  • VPN ID type: IP address
  • VPN ID (optional): (Leave blank)
  • Remote networks: Click the + button to create a new Network by entering the details for the VDC-02 internal LAN.
  • In this scenario, this would be the range
  • Comment: VDC-02 Remote Gateway

Click the Save button

Primary Sophos UTM Remote Gateway

Set up the IPsec connection

The next step is to go over to the Connections tab and click on the New IPsec Connection button.

Here is the sample configuration for our scenario.

  • Name: VDC-02 Connection
  • Remote Gateway: VDC-02
  • Local interface: External (WAN)
  • Policy: AES-256 (this is a built-in policy)
  • Local Network: Internal (LAN) (Network)
  • This is done by clicking on the Folder icon and dragging and dropping the “Network”.
  • Check the Automatic firewall rules.
  • Comments: VDC-02 IPSec Connection

Click the Save button.

Primary Sophos - IPSec connection

Set up the secondary Sophos UTM

The primary Sophos UTM is now configured to connect to the secondary Sophos UTM. The next step is to perform the previous steps to set up the secondary Sophos UTM.

The configuration steps will be identical, but the information used (public IP, local subnet, etc.) will be different.

Verify that the Site-to-Site VPN is working

Once the second Sophos UTM is configured as described above, the tunnel should be established automatically.

You can verify this by clicking on the “Site-to-Site VPN” on the left navigation menu as shown below.

Sophos UTM IPSec Tunnel Established

Test the VPN tunnel

The last step is simply to test the VPN tunnel by pinging between management servers, establish a remote desktop connection or something along those lines.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.