IPSEC VTI and Domain Controller Access

[rgradert]

Hello,

To preface, I have an old Netgate appliance that is failing. Mission critical life safety equiment resides on this network so downtime would need to be limited heavily. As a result, we are standing a new OPNsense firewall up adjacent to the old network. All new Firewall, Switches, VLANs, etc etc.

Vlans are created with any/any on the new FW. Wireguard established for mobile devices. IPSEC established for LAN to LAN traffic between the networks. Tunnels are up and working. Devices ping, some limited services are available.

No domain services can be established. The goal being to stand up a new DC and replicate it to the old. Then slowly move all network devices over to the new system. Once complete, move the DCs over to the new network. Hopefully providing minimal downtime.

Anyone have experience with this.

For one, there is a 'main switch' as the primary gateway with a 0.0.0.0/0 default route to the old firewall. This created the asymmetrical routing issue resulting in default deny rules playing goalie. NoW that is sorted but services still cannot be established.