VPN Implementation Guide: Unifi OS to Sophos Firewall (Numbered VTI)

1. Overview and Architecture

This document outlines the configuration required to establish a stable, multi-subnet Route-Based (Numbered VTI) IPsec Site-to-Site VPN between a Unifi Cloud Gateway and a Sophos Firewall.

Design Rationale: While Unifi supports basic route-based VPNs, adding multiple subnets often causes Phase 2 negotiation failures across vendor platforms. To resolve this and ensure maximum stability, we use a Numbered VTI approach. The IPsec tunnel negotiates as an open pipe (0.0.0.0/0), the tunnel itself is assigned a transit IP subnet (10.255.254.0/30), and all traffic is managed entirely via explicit static routes and zone-based firewall rules.

---

2. Phase One: Unifi IPsec Profile Configuration

Configure the Unifi gateway to initiate the IPsec connection using a Tunnel IP.

General Settings

• VPN Type: IPsec

• VPN Method: Route Based

• Tunnel IP: Checked

• Unifi Tunnel IP: 10.255.254.1/30 (Transit IP)

• Local IP: Select the appropriate WAN interface.

• Remote IP / Hostname: The public IP of the Sophos Firewall.

• Remote Networks: Leave blank/None. (We will route manually to prevent Unifi automation errors).

Advanced (Manual) Settings

• Key Exchange Version: IKEv2
• Encryption (IKE & ESP): AES-256
• Hash (IKE & ESP): SHA512
• DH Group (IKE & ESP): 14
• Perfect Forward Secrecy (PFS): Enabled
• Local Authentication ID: 2.2.2.2 (Must be manually defined)
• Remote Authentication ID: 1.1.1.1 (Must be manually defined)

---

3. Phase Two: Sophos IPsec Profile Configuration

Configure the Sophos to act as the responder, mirroring the Unifi parameters while allowing any subnet to traverse the tunnel.

General & Gateway Settings

• Connection Type: Route-based (Tunnel interface)
• Gateway Type: Respond only
• Listening Interface: The corresponding Sophos WAN port.
• Gateway Address: The Unifi public IP.

Authentication & Subnets

• Authentication Type: Preshared key
• Local ID Type: IP address -> 1.1.1.1 (Exact inverse of Unifi)
• Remote ID Type: IP address -> 2.2.2.2 (Exact inverse of Unifi)
• Local Subnet: Any (or Any IPv4)
• Remote Subnet: Any (or Any IPv4)

---

4. Phase Three: Sophos Interface & Zone Configuration

Assign the other half of the transit IP to the newly created Sophos virtual tunnel interface.

1. Navigate to Network > Interfaces on the Sophos.
2. Locate the virtual interface associated with the VPN (e.g., xfrm5 or Tunnel Interface).
3. Edit the interface:

• IPv4 Address: 10.255.254.2
• Subnet Mask: /30 (255.255.255.252)
• Network Zone: VPN (Critical: If left as "None", firewall rules will fail).

1. Save the interface.

---

5. Phase Four: Static Routing

Because the IPsec tunnel is now subnet-agnostic, you must explicitly tell both firewalls which networks live across the tunnel.

Unifi Static Routes

1. Navigate to Settings > Routing > Static Routes (or via the Policy Table).
2. Create a route for the first Sophos Subnet:

• Destination Network: 192.168.16.0/24
• Next Hop / Interface: Select the Test Work VPN interface.

1. Create a route for the second Sophos Subnet:

• Destination Network: 192.168.27.0/24
• Next Hop / Interface: Select the Test Work VPN interface.

Sophos Static Routes

1. Navigate to Routing > Static Routing.
2. Create a route pointing back to the Unifi network:

• Destination IP / Netmask: 192.168.10.0 / 24
• Gateway / Interface: Select the xfrm interface configured in Phase Three.

---

6. Phase Five: Firewall Policies

Ensure both firewalls permit the traffic and do not perform Network Address Translation (NAT) on the VPN packets.

Sophos Firewall Rules

1. Navigate to Rules and policies > Firewall rules and create a new rule.
2. Source Zones: LAN, VPN
3. Source Networks: Any (or define the specific .10, .16, .27 subnets).
4. Destination Zones: LAN, VPN
5. Destination Networks: Any (or define specific subnets).
6. CRITICAL: Under NAT and routing, ensure Rewrite source address (MASQ) is Disabled/Unchecked.

Unifi Firewall Rules (Zone Matrix)

Ensure bidirectional communication is explicitly allowed for the permitted network, while others remain isolated.

1. Navigate to the Unifi Zone Matrix (Firewall Policies).
2. Outbound Rule: Create an Allow policy from Source: Work -> Destination: VPN.
3. Inbound Rule: Create an Allow policy from Source: VPN -> Destination: Work.
4. Ensure all other zones (e.g., restricted/NSFW subnets) remain set to Block All for the VPN zone to maintain security isolation.

---

7. Known Behaviors & Troubleshooting

• Windows Firewall "Silent Drops": By default, Windows Defender Firewall blocks ICMP (Ping) requests originating from outside its local subnet. If the VPN tunnel is up (verified by pinging networking equipment like a switch or NAS) but Windows PCs time out, update the Windows Firewall inbound ICMPv4 rule scope to include the remote subnet (e.g., 192.168.10.0/24).
• Unifi UI Reporting: When utilizing a Numbered VTI, the Unifi dashboard will accurately reflect the tunnel status (Green/Online) natively, resolving the false "Offline" warnings common in Policy-Based deployments.