VPN Sangfor Configuration 20

Cheisie Lv1Posted Aug-01-2025 14:16

Hello i'm new and i have a lab look like this :

I have two NSF devices connected to each other via VPN with the following information:

HQ Site IP: 3.3.3.1

Branch Site IP: 2.2.2.1

Local LAN IP at HQ: 192.168.20.1

Local LAN IP at Branch: 172.32.16.1

But the HQ site still can connected to local ip on Branch site. Do I need to configure anything else to make the local IPs on both sites communicate with each other? Thanks

Paolo Maldia has solved this question and earned 40 coins.

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins, 20 coins of bounty and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

Hi,

To allow the local IPs at your HQ (192.168.20.1) and Branch (172.32.16.1) to communicate over the VPN using Sangfor devices, there are several key steps you should confirm in your configuration.

1. Define Local Subnets in the VPN Configuration
On both Sangfor devices (HQ and Branch), you need to specify the local LAN subnet of each site in the VPN settings, not just the WAN/public IPs.

HQ Sangfor: Add 192.168.20.0/24 as your local subnet.

Branch Sangfor: Add 172.32.16.0/24 as your local subnet.

The VPN tunnel policy should include both subnets as allowed networks so that routing over the VPN is possible.

2. Set Up VPN Interfaces Correctly
Ensure each device's LAN interface is added to its VPN interfaces.

In Sangfor NGAF: Go to VPN interface section and add all LAN interfaces to the VPN interface group for both HQ and Branch. This allows traffic from your LANs to use the VPN tunnel.

3. Routing and Security Policies
Make sure each Sangfor device has a route to the remote subnet via the VPN tunnel.

HQ: Route 172.32.16.0/24 via Branch VPN tunnel.

Branch: Route 192.168.20.0/24 via HQ VPN tunnel.

Adjust firewall/security rules to permit traffic between these subnets over the VPN tunnel. If not, the devices may connect but local traffic won't pass

Is this answer helpful?
Newbie517762 Lv5Posted Aug-04-2025 12:50
  
HiHi,

The VPN configuration guide for NSF is not found, but you can refer to the attached file or the NGAF VPN YouTube link for reference. I hope it can help you.
SANGFOR_NSF_V8.0.85_Associate_2024_04_VPN.pdf (970.73 KB, Downloads: 134)
Paolo Maldia Lv1Posted Aug-06-2025 09:16
  
Hi,

To allow the local IPs at your HQ (192.168.20.1) and Branch (172.32.16.1) to communicate over the VPN using Sangfor devices, there are several key steps you should confirm in your configuration.

1. Define Local Subnets in the VPN Configuration
On both Sangfor devices (HQ and Branch), you need to specify the local LAN subnet of each site in the VPN settings, not just the WAN/public IPs.

HQ Sangfor: Add 192.168.20.0/24 as your local subnet.

Branch Sangfor: Add 172.32.16.0/24 as your local subnet.

The VPN tunnel policy should include both subnets as allowed networks so that routing over the VPN is possible.

2. Set Up VPN Interfaces Correctly
Ensure each device's LAN interface is added to its VPN interfaces.

In Sangfor NGAF: Go to VPN interface section and add all LAN interfaces to the VPN interface group for both HQ and Branch. This allows traffic from your LANs to use the VPN tunnel.

3. Routing and Security Policies
Make sure each Sangfor device has a route to the remote subnet via the VPN tunnel.

HQ: Route 172.32.16.0/24 via Branch VPN tunnel.

Branch: Route 192.168.20.0/24 via HQ VPN tunnel.

Adjust firewall/security rules to permit traffic between these subnets over the VPN tunnel. If not, the devices may connect but local traffic won't pass

Viktor Lv1Posted Aug-29-2025 14:27
  
ON HQ SIDE:
Configure webagent
- On Sangfor VPN > Basic Setting
- Configure the Primary IP Address and Shared Key.
- Configure the network segments that the branch needs to access.

- Go to Sangfor VPN > Basic Settings > Advanced
- Select VPN Interface and create parameters.

- Go to Sangfor VPN > VPN User
- Create a username, auth method, and password in case that you use password-based.

ON BRANCH SIDE:
- Sangfor VPN > VPN Connection
- Configure the appropriate Primary Address
- Enter Username, Auth Method, and Password. Select the needed protocol.

- Verify the connection status by checking the tunnels on the Sangfor VPN pane.
- View Device Routes on Network > All Routes.
- Try pinging the headquarter from the branch side to check connection.

Follow these and you'll be able to establish Sangfor VPN connection. Ping repetitively and different IPs to check connectivity's consistency.

I Can Help:

Change

Moderator on This Board

918
183
94

Started Topics

Followers

Follow

Board Leaders