This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Connect Phase 1/2 Encryption Policies, where to change and Client ignoring Config file for settings?

I've had a look through the GUI and Console but cannot see where to change the Phase 1/2 encryption settings for Sophos Connect. I am very pleased it is now showing AES256 with SHA2 256 but I am unhappy that it has defaulted to DH Group 2 (1024-bit key) which is insecure and also that the client seems to ignore as below.

First question, will this be manually configurable in the GUI?

Now onto the something interesting part, it appears the Sophos Connect client is potentially ignoring the configuration file details for the encryption protocols. I have edited the file and have found that even performing the edits to force DH14 and AES256, the client will still connected using AES128 and actually used ECP256 (equivalent to 3072-bit so can't complain too much there) for Phase 1 but did not use Perfect Forward Secrecy for Phase 2 like it is set in the config file.

Original Config File (security ommissions):

# Do not edit this file. It is overwritten by VpnConf.
# SIGNATURE MD5 = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# Creation Date : 2019-01-09 at 08:59:21
# Written by CyberoamServer SFV4C6_SO01_SFOS 17.5.0 GA
# Client Version :
# CyberoamVPNClient :3.11.008
# IKE Service :3.10.08,02.13

[General]
Shared-SADB = Defined
Retransmits = 5
Exchange-max-time = 10
Default-phase-1-lifetime = 18000,360:86400
Bitblocking = 0
Xauth-interval = 20
DPD-interval = 60
DPD_retrans = 3
DPD_wait = 60

[Default-phase-2-lifetime]
LIFE_TYPE = SECONDS
LIFE_DURATION = 3600,360:86400

# ==================== PHASES 1 ====================

[Phase 1]
<IP> = Globelink_VPN-P1

[Globelink_VPN-main-mode]
DOI = IPSEC
EXCHANGE_TYPE = ID_PROT
Transforms = AES256-SHA2_256-GRP2

[AES256-SHA2_256-GRP2]
ENCRYPTION_ALGORITHM = AES_CBC
KEY_LENGTH = 256,128:256
HASH_ALGORITHM = SHA2_256
GROUP_DESCRIPTION = MODP_1024
AUTHENTICATION_METHOD = PRE_SHARED
Life = LIFE_MAIN_MODE

[Globelink_VPN-P1]
Phase = 1
Family = IPV4
Address = <IP>
Transport = udp
Configuration = Globelink_VPN-main-mode
Rconf = 1
Authentication = "<PSK>"
Xauth = 0
Xpopup = 1
NATT_ENABLED = 1


# ==================== PHASES 2 ====================

[Phase 2]
Manual-connections = Globelink_VPN-Globelink_VPN1-P2

[Globelink_VPN-Globelink_VPN1-P2]
Phase = 2
ISAKMP-peer = Globelink_VPN-P1
Remote-ID = Globelink_VPN1-remote-addr
Configuration = Globelink_VPN1-quick-mode
AutoStart = 0
USBStart = 0

# ==================== Ipsec ID ====================

[Globelink_VPN1-remote-addr]
ID-type = IPV4_ADDR_SUBNET
Network = 0.0.0.0
Netmask = 0.0.0.0

# ==================== TRANSFORMS ====================

[Globelink_VPN1-quick-mode]
DOI = IPSEC
EXCHANGE_TYPE = QUICK_MODE
Suites = Globelink_VPN1-quick-mode-suite

[Globelink_VPN1-quick-mode-suite]
Protocols = TGBQM-ESP-AES256-SHA2_256-PFSGRP2-TUN

[TGBQM-ESP-AES256-SHA2_256-PFSGRP2-TUN]
PROTOCOL_ID = IPSEC_ESP
Transforms = TGBQM-ESP-AES256-SHA2_256-PFSGRP2-TUN-XF

[TGBQM-ESP-AES256-SHA2_256-PFSGRP2-TUN-XF]
TRANSFORM_ID = AES
KEY_LENGTH = 256,128:256
AUTHENTICATION_ALGORITHM = HMAC_SHA2_256
GROUP_DESCRIPTION = MODP_1024
ENCAPSULATION_MODE = TUNNEL
Life = Default-phase-2-lifetime

 

 

And here is my edited file with highlights where I made changes:

# Do not edit this file. It is overwritten by VpnConf.
# SIGNATURE MD5 = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# Creation Date : 2019-01-09 at 08:59:21
# Written by CyberoamServer SFV4C6_SO01_SFOS 17.5.0 GA
# Client Version :
# CyberoamVPNClient :3.11.008
# IKE Service :3.10.08,02.13

[General]
Shared-SADB = Defined
Retransmits = 5
Exchange-max-time = 10
Default-phase-1-lifetime = 18000,360:86400
Bitblocking = 0
Xauth-interval = 20
DPD-interval = 60
DPD_retrans = 3
DPD_wait = 60

[Default-phase-2-lifetime]
LIFE_TYPE = SECONDS
LIFE_DURATION = 3600,360:86400

# ==================== PHASES 1 ====================

[Phase 1]
<IP> = Globelink_VPN_NEW-P1

[Globelink_VPN_NEW-main-mode]
DOI = IPSEC
EXCHANGE_TYPE = ID_PROT
Transforms = AES256-SHA2_256-GRP14

[AES256-SHA2_256-GRP14]
ENCRYPTION_ALGORITHM = AES_CBC
KEY_LENGTH = 256:256
HASH_ALGORITHM = SHA2_256
GROUP_DESCRIPTION = MODP_2048
AUTHENTICATION_METHOD = PRE_SHARED
Life = LIFE_MAIN_MODE

[Globelink_VPN_NEW-P1]
Phase = 1
Family = IPV4
Address = <IP>
Transport = udp
Configuration = Globelink_VPN_NEW-main-mode
Rconf = 1
Authentication = "<PSK>"
Xauth = 0
Xpopup = 1
NATT_ENABLED = 1


# ==================== PHASES 2 ====================

[Phase 2]
Manual-connections = Globelink_VPN_NEW-Globelink_VPN_NEW1-P2

[Globelink_VPN_NEW-Globelink_VPN_NEW1-P2]
Phase = 2
ISAKMP-peer = Globelink_VPN_NEW-P1
Remote-ID = Globelink_VPN_NEW1-remote-addr
Configuration = Globelink_VPN_NEW1-quick-mode
AutoStart = 0
USBStart = 0

# ==================== Ipsec ID ====================

[Globelink_VPN1-remote-addr]
ID-type = IPV4_ADDR_SUBNET
Network = 0.0.0.0
Netmask = 0.0.0.0

# ==================== TRANSFORMS ====================

[Globelink_VPN_NEW1-quick-mode]
DOI = IPSEC
EXCHANGE_TYPE = QUICK_MODE
Suites = Globelink_VPN_NEW1-quick-mode-suite

[Globelink_VPN_NEW1-quick-mode-suite]
Protocols = TGBQM-ESP-AES256-SHA2_256-PFSGRP14-TUN

[TGBQM-ESP-AES256-SHA2_256-PFSGRP2-TUN]
PROTOCOL_ID = IPSEC_ESP
Transforms = TGBQM-ESP-AES256-SHA2_256-PFSGRP14-TUN-XF

[TGBQM-ESP-AES256-SHA2_256-PFSGRP14-TUN-XF]
TRANSFORM_ID = AES
KEY_LENGTH = 256:256
AUTHENTICATION_ALGORITHM = HMAC_SHA2_256
GROUP_DESCRIPTION = MODP_2048
ENCAPSULATION_MODE = TUNNEL
Life = Default-phase-2-lifetime

Attached are the proposal selection logs from the edited connection and you can see it just does not match the configuration files details from the strongswan.log in debug mode:

Phase1:

2019-01-09 09:18:47 23[CFG] <191> received proposals: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256, IKE:ECP_256
2019-01-09 09:18:47 23[CFG] <191> configured proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/CURVE_25519, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/CURVE_25519, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/CURVE_25519, IKE
:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_192, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_192, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_192, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_521, IKE:AES_CBC_2
56/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_521, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_521, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_256, IKE:AES_CBC_128/HMAC_SHA1_96/PRF
_HMAC_SHA1/ECP_256, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_4096, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_4096, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_4096, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SH
A2_256/MODP_2048, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP
_1024, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/AES_CMAC_96/PRF_HM
AC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_AES128_CMAC/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/MODP_3072/MODP_4096/MODP_8192/MODP_2048, IKE:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_2
56/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_AES128_CMAC/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CUR
VE_25519/MODP_3072/MODP_4096/MODP_8192/MODP_2048
2019-01-09 09:18:47 23[CFG] <191> selected proposal: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256

Phase2:

2019-01-09 09:18:47 06[CFG] <Globelink_VPN-1|191> received proposals: ESP:AES_CBC_128/HMAC_SHA2_256_128/NO_EXT_SEQ
2019-01-09 09:18:47 06[CFG] <Globelink_VPN-1|191> configured proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/CURVE_25519/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA1_96/CURVE_25519/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA1_96/CURVE_25519/NO_EXT_SEQ,
ESP:AES_CBC_256/HMAC_SHA2_256_128/ECP_192/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA1_96/ECP_192/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA1_96/ECP_192/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA2_256_128/ECP_521/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA1_96/E
CP_521/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA1_96/ECP_521/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA2_256_128/ECP_256/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA1_96/ECP_256/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA1_96/ECP_256/NO_EXT_SEQ, ESP:AES_CBC_256/
HMAC_SHA2_256_128/MODP_4096/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA1_96/MODP_4096/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA1_96/MODP_4096/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA1_96/MODP_2048
/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA1_96/MODP_2048/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA2_256_128/MODP_1024/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA1_96/MODP_1024/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA1_96/MODP_1024/NO_EXT_SEQ, ESP:AES_CBC_25
6/HMAC_SHA2_256_128/NO_EXT_SEQ, ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ, ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ, ESP:AES_CBC_256/AES_CBC_192/AES_CBC_128/HMAC_SHA2_512_256/HMAC_SHA2_384_192/HMAC_SHA2_256_128/AES_XCBC_96/NO_EXT_SEQ
2019-01-09 09:18:47 06[CFG] <Globelink_VPN-1|191> selected proposal: ESP:AES_CBC_128/HMAC_SHA2_256_128/NO_EXT_SEQ

 

 

As you can see from the above, it has completely ignored both the encryption setting and the Key setting both for phase 1 and phase 2.

Can some light be shed on why this is as security recommendations are minimum AES192, SHA2 256 and DH14 for IPSEC connections, the fact the client is ignoring the configuration file is concerning.

Happy to provide any more details as and where necessary.

Emile



This thread was automatically locked due to age.
  • Hello Emile,

    What version of Sophos Connect Client are you using. You should be using Sophos Connect version 1.2.5.0202 on Windows. If you are using Mac OS then the version is 1.2.193.0201. We have fixed this issue. Please let us know if you notice any problems.

     

    Thank you.

    Ramesh