Site-toSite VPN cannot access XG on remote site using normal 4444 port.

Hi Mark,

Check if device access over HTTPS is allowed for VPN in Administration > Device Access > VPN > HTTPS. 

Thanks,

This is already done. Just fails every time. It seems to be any device on the SITE B Lan e.g NAS drives, Sophos Firewall Manager (typically ones that have a PORT option)

Which device do you use on the other site of the XG tunnel? 

XG 210 itself, Synology NAS, Sophos Firewall Manager. (XG125 on branch office A)

Hi,

Did you solved your issue ?

I've the same problem.

Thanks in advance,

Ludo.

Nope - I logged a case with tech support and it has been escalated right up to senior support - I have spent many hours on remote sessions but still no solution !!

It only seems to be when the WAN connection to the ISP is STATIC - if it is PPoe then all works fine.

Hello,

Which IPSEC policy was used? Did you enable data compression?

I had the problem once before. Servers were available. Ping went too but I could not open the web interface of the XG (TLS handshake timeout) and traceroute did not work either.

It can be checked relatively quickly whether you can open the XG with Internet Explorer.

Hello,

Thanks for your reply.

I use the DefaultBranchOffice Ipsec profile. (and DefaultHeadOffice on my central Sophos XG)

In SFOS16 DefaultBranchOffice IPSec Profile, the compression is ON.

Not in SFOS17.

Do you think I have to test with the compression ON ?

Because in SFOS16, we don't have this Admin Login Page access problem.

Problem is the same with IE or Firefox.

Thanks in advance.

Ludo.

We used default Headoffice/Branch office policies. 

Did you solve this using data compression ?

So in my case it looked like this.

Without compression

With compression

Maybe i can provide some kind of Workaround.

Let me paint the picuture.

Client with Browser - Router - Ipsec Tunnel - XG - Webadmin Interface(192.168.190.1/24)

On The Router (SG / XG / Whatever), i apply following iptables command. 

iptables -t mangle -I POSTROUTING -d 192.168.190.1/32 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 900

Hi,

It's seems to work when I apply a 900 MSS on the LAN Interface.

So now, what's the impact on the trafic or anything else if I let this like that ?

Thanks.

Ludo.

Hi,

It's seems to work when I apply a 900 MSS on the LAN Interface.

So now, what's the impact on the trafic or anything else if I let this like that ?

Thanks.

Ludo.