So i finished all the instructions as posted on page https://community.sophos.com/kb/en-us/133109
Downloaded the client and exported the configuration. Set up the client and finally made a connection.
So far so good. Can ping hosts on the internal network by ip adress, however i can't seem to reach hosts by their name.
I did enter the ip of the DNS server but somehow hosts aren't being resolved.
Any thoughts or pointers on this.
Thnx, Peter-Paul
Hi Vitali,
could you please open a new thread in the community with details about your issue?
We want to avoid confusing in mixing up issues.
__________________________________________________________________________________________________________________
Unknown said:Hello Leet,
Can you please list the steps on what the settings are to make it work on SSL VPN. I would like to see why it is not working with Sophos Connect.
Thank you,
Ramesh
I haven't had a single minute to try and diagnose this further yet and I'm not comfortable posting the logs publicly with company info in them.
SSL VPN works with nearly the exact same settings as Sophos Connect.
Neither work for domain resources initially. When I try to go to \\server.domain.local it doesn't work. None of my network drives can connect either.
HOWEVER, on the SSL VPN, On the XG admin webpage, I have to go to "Show VPN Settings" >>> "SSL VPN" and specify "Domain Name" as "domain.local"
After doing that, SSL VPN works for domain resources, however, Sophos Connect does not and doesn't have a setting for me to specify a domain.
What is the correct way to handle dns suffix search in Sophos Connect vpn for users to reach internal systems by hostname on their own personal devices we can't touch with gpo without manually adding internal domains to dns suffix search list?
Hello Momentum,
In the Sophos Connect Client policy you configure on XG, you will assign the DNS server 1 and DNS server 2 (if available). After the tunnel is established, all hostname look ups will be sent down the tunnel and the internal DNS server should resolve the internal systems by hostname.
Please let us know if this works for you.
Ramesh
Hi Ramesh
Configuring the DNS servers is only part of the requirements for friendly name resolution. You also need to be able to configure the DNS suffix (or better, a list of suffixes) for the connection. Configuring the suffix list to include "example.com" allows someone to connect to the server "server01.example.com" using just the short name server01. The configured DNS suffix is automatically added to the end of the name if the name is incomplete.
Most VPNs do this automatically - but the lack of documentation on the TGB and SCX file formats means we can't reverse-engineer it easily, and it's not exposed in the firewall or admin UIs.
It's also worth noting that at least for me, I had to manually create a firewall rule to permit communication from the VPN to the internal networks - it wasn't automatically provisioned when I completed the Sophos Connect configuration on the firewall.
rmk_2018 said:Hello Momentum,
In the Sophos Connect Client policy you configure on XG, you will assign the DNS server 1 and DNS server 2 (if available). After the tunnel is established, all hostname look ups will be sent down the tunnel and the internal DNS server should resolve the internal systems by hostname.
Please let us know if this works for you.
Ramesh
Not getting good results for dns lookups on a Win10 version 1803 build 17134.706 client I'm testing with XG210_WP03_SFOS 17.5.4 MR-4-1 and sophos connect client xg pattern 1.2.001 windows application version 1.2.5.0202. With Sophos Connect successfully connected all dns lookups end up going to the local ethernet adapter's dns server instead of of the xg tunnel dns server. The result is that lookups for hosts on the internal company domain are being sent out to the wrong public dns server and resolve incorrectly. nslookup queries without manually specifying the internal xg dns server go to the physical ethernet adapter's dns server. The xg internal dns server ip specified in the sophos connect config xg page is reachable over the vpn, pings, and If I manually specify that ip in an nslookup query it does return the expected result for internal hostnames or fqdn's resolving to the internal ip's. Disabling ipv6 on the client's ethernet adapter + sophos tap adapter and also adding the internal domain name as either the sophos tap connection specific dns suffix or the dns suffix search list have been tried with no change. We are using split tunnel in the scx config with internal subnets defined. Wireless adapter is disabled on the client. What's the client's logic for how internal dns lookups should be routed?
Windows IP Configuration
Host Name . . . . . . . . . . . . : ABCD-1234
Primary Dns Suffix . . . . . . . : mydomain1.com
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : mydomain1.com
mydomain2.com
Ethernet adapter Ethernet:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (2) I219-LM
Physical Address. . . . . . . . . : 84-****
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.0.0.188(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Wednesday, April 24, 2019 11:02:30 AM
Lease Expires . . . . . . . . . . : Thursday, April 25, 2019 11:54:04 AM
Default Gateway . . . . . . . . . : 10.0.0.1
DHCP Server . . . . . . . . . . . : 10.0.0.1
DNS Servers . . . . . . . . . . . : 10.0.0.1
NetBIOS over Tcpip. . . . . . . . : Enabled
Ethernet adapter Ethernet 3:
Connection-specific DNS Suffix . : mydomain2.com
Description . . . . . . . . . . . : Sophos TAP Adapter
Physical Address. . . . . . . . . : 00-FF-F7-11-F6-B0
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.99.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.200.1
NetBIOS over Tcpip. . . . . . . . : Enabled
scx file:
{
"name": "TEST1",
"managed": false,
"version": 1,
"gateway": "something.mydomain.com",
"vip": "0.0.0.0",
"auto_connect": {
"required": false,
"enabled": false
},
"proposals": "aes256-sha2_256-modp1024",
"dpd_delay": 60,
"rekey_time": 15300,
"start_action": "none",
"local_auth": {
"psk": {
"id": "0.0.0.0"
},
"xauth": {
"can_save": false
},
"otp": true
},
"remote_auth": {
"psk": {
"id": "%any",
"secret": "******************"
},
"otp": false
},
"child": {
"rekey_time": 3060,
"remote_ts": [
"*********************"
]
}
}
Hello Momentum,
When you enter nslookup on your dos command window what is the DNS server it is using? Is that the correct DNS server as assigned in the Policy? Then when you do a lookup for an internal host name (note you have specify the FQDN for the hostname) are you getting back a response?
Please let us know.
Ramesh
