This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

remote IPsec summarizes pool

Hello guys,

 

I have a strange remote IPsec issue. My system Sophos UTM home edition 9.5

I have configured remote SSL VPN with pool 1.1.1.0/24 and remote IPsec VPN with pool 2.2.2.0/24.

I connect to each one of them from a laptop, using:

Sophos SSL VPN client - for ssl connection

Cisco VPN client - for IPsec connection

After connection i receive the following on SSL vpn:

 Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Sophos SSL VPN Adapter
   Physical Address. . . . . . . . . : 00-FF-F4-5D-D8-DB
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::e1ea:82ac:d052:6062%28(Preferred)
   IPv4 Address. . . . . . . . . . . : 1.1.1.2(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : vineri, 20 octombrie 2017 11:23:56
   Lease Expires . . . . . . . . . . : sâmbătă, 20 octombrie 2018 11:23:56
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 1.1.1.254

 

And on IPsec connection:

Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Cisco Systems VPN Adapter for 64-bit Windows
   Physical Address. . . . . . . . . : 00-05-9A-3C-78-00
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::d970:5db7:43e3:7050%3(Preferred)
   IPv4 Address. . . . . . . . . . . : 2.2.2.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.0.0.0
   Default Gateway . . . . . . . . . :

 

Both connections work, but certain traffic/applications don't work on IPsec (i suppose that traffic is routed through the tunnel instead).

Routing tables for each connection are similar.

 

Why do i get a /8 mask instead of a /24 mask on the IPsec connection?

Why there are differences like no DHCP server between the IPsec adapter and SSL adapter?

Yes, i have checked and the IPsec pool is defined correctly on the Sophos.

 

 



This thread was automatically locked due to age.
Parents
  • In other words, with the IPsec connection i get the default mask for the IP class used in that pool. In my case, it is a Class A so i get a /8, no matter what other mask i explicit specify for this pool.

    Why?

  • Please show the information from the UTM instead of Windows.  Also, when obfuscating IPs, please show reasonable facsimiles of the actual addresses instead of confusing public and private IP ranges: 192.168.x.1, 86.x.y.217, 10.x.y.0, etc.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hey Bob,

    what does this do?

    What does the log invalid packets function do, would disabling this function affect the logging of those packets? I suspect not because RST packets are not invalid, thought I would ask anyway.

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • UTM info.docx

    What do you mean by obfuscating IPs and confusing public and private IP ranges? In the output appears both pools (ssl and ipsec). There is no 192.etc nor 86.etc. I choosed 1.1.1.0/24 and 2.2.2.0/24 for the pools. Using class A or B or C ip range does not seem to have anything to do with my issue. I tested before with 10.x.y.0/24 as well and 192.168.x.x and on the IPSEC client i receive the mask corresponding to the IP CLASS used.

    I have uploaded a file with the UTM settings. 

Reply
  • UTM info.docx

    What do you mean by obfuscating IPs and confusing public and private IP ranges? In the output appears both pools (ssl and ipsec). There is no 192.etc nor 86.etc. I choosed 1.1.1.0/24 and 2.2.2.0/24 for the pools. Using class A or B or C ip range does not seem to have anything to do with my issue. I tested before with 10.x.y.0/24 as well and 192.168.x.x and on the IPSEC client i receive the mask corresponding to the IP CLASS used.

    I have uploaded a file with the UTM settings. 

Children
  • Your UTM configuration looks fine, so I guess you have a problem with the client or client device.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA