Trouble Accessing Specific IP Behind Sophos Firewall in Multi-VPC Environment – Need Assistance!

Question

Hello all,

I hope you're all doing well! I'm currently facing a perplexing issue in our multi-VPC setup, and I'm hoping someone with experience in network configurations can shed some light.

We have three VPCs (vpcA, vpcB, vpcC) interconnected through a transit gateway, and all traffic is allowed through our Sophos firewall. Strangely, we're encountering difficulties accessing a specific IP address (example: 1.1.1.1) from within these VPCs, even though ping tests to the same IP address seem to be successful.

Has anyone experienced a similar issue before, where certain IP addresses cannot be accessed despite a seemingly open firewall policy? What troubleshooting steps or configurations should I be checking within the Sophos firewall or AWS networking setup to diagnose and resolve this problem?

Any insights, suggestions, or past experiences with similar challenges would be greatly appreciated. Thank you in advance for your assistance!

Answer

![Enter image description here](/media/postImages/original/IM-b2PKj-XTc2D0ZHBMSpL-Q)

Source: Test EC2 Instance 
Destination: https://citrixworkspacesapi.net

Traffic is logged into the firewall as DENIED and sometimes ALLOWED.

Similar to this https://community.sophos.com/sophos-xg-firewall/f/discussions/139663/internet-traffic-sometimes-denied

Answer

Arhh.. The first thing that jumps out is Asymetric routing. Something to check:-

Traffic in appliance mode is routed correctly as long as the source and destination traffic are coming to a centralized VPC (Inspection VPC) from the same transit gateway attachment. Traffic can drop if the source and destination are entering from two different transit gateway attachments.

When appliance mode is enabled, a transit gateway selects a single network interface in the appliance VPC, using a flow hash algorithm, to send traffic to for the life of the flow. The transit gateway uses the same network interface for the return traffic. This ensures that bidirectional traffic is routed symmetrically—it's routed through the same Availability Zone in the VPC attachment for the life of the flow. If you have multiple transit gateways in your architecture, each transit gateway maintains its own session affinity, and each transit gateway can select a different network interface.

If your VPC attachments span multiple Availability Zones and you require traffic between source and destination hosts to be routed through the same appliance for stateful inspection, enable appliance mode support for the VPC attachment in which the appliance is located.

https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-appliance-scenario.html

**EDIT**
**Disable source/destination checks**

Each EC2 instance performs source/destination checks by default. This means that the instance must be the source or destination of any traffic it sends or receives. However, a NAT instance must be able to send and receive traffic when the source or destination is not itself. Therefore, you must disable source/destination checks on the NAT instance.
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck

Trouble Accessing Specific IP Behind Sophos Firewall in Multi-VPC Environment – Need Assistance!

Relevant content