Sophos Connect Client Authentication failes with certificate

Question

Hi all! I would like to setup a Client-VPN connection using Sophos Connect Client. Authentication should be digital certificate . After username & PW Sophos Connect Client says Failed to establish CHILD_SA . Here's the Log: Fullscreen 7870.sophos-log1.txt Download 2019-03-27 09:54:41AM 16[CFG] added vici connection: VPNClientTEST 2019-03-27 09:54:41AM 11[CFG] loaded certificate 'C=DE, ST=Bayern, L=XXX, O=XXX, OU=XXX, CN=vpn.XXX.de' 2019-03-27 09:54:41AM 07[CFG] loaded RSA private key 2019-03-27 09:54:41AM 13[CFG] loaded EAP shared key with id 'VPNClientTEST-xauth-id' for: 'testp' 2019-03-27 09:54:42AM 15[CFG] vici initiate 'VPNClientTEST-1' 2019-03-27 09:54:42AM 14[IKE] initiating Main Mode IKE_SA VPNClientTEST[9] to 194.39.183.50 2019-03-27 09:54:42AM 14[ENC] generating ID_PROT request 0 [ SA V V V V V ] 2019-03-27 09:54:42AM 14[NET] sending packet: from 192.168.43.69[57468] to 194.39.183.50[500] (204 bytes) 2019-03-27 09:54:42AM 12[NET] received packet: from 194.39.183.50[500] to 192.168.43.69[57468] (180 bytes) 2019-03-27 09:54:42AM 12[ENC] parsed ID_PROT response 0 [ SA V V V V V ] 2019-03-27 09:54:42AM 12[IKE] received XAuth vendor ID 2019-03-27 09:54:42AM 12[IKE] received DPD vendor ID 2019-03-27 09:54:42AM 12[IKE] received Cisco Unity vendor ID 2019-03-27 09:54:42AM 12[IKE] received FRAGMENTATION vendor ID 2019-03-27 09:54:42AM 12[IKE] received NAT-T (RFC 3947) vendor ID 2019-03-27 09:54:42AM 12[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256 2019-03-27 09:54:42AM 12[ENC] generating ID_PROT request 0 [ KE No NAT-D NAT-D ] 2019-03-27 09:54:42AM 12[NET] sending packet: from 192.168.43.69[57468] to XXX[500] (204 bytes) 2019-03-27 09:54:42AM 08[NET] received packet: from XXX[500] to 192.168.43.69[57468] (204 bytes) 2019-03-27 09:54:42AM 08[ENC] parsed ID_PROT response 0 [ KE No NAT-D NAT-D ] 2019-03-27 09:54:42AM 08[IKE] local host is behind NAT, sending keep alives 2019-03-27 09:54:42AM 08[IKE] sending cert request for "C=DE, O=XXX" 2019-03-27 09:54:42AM 08[IKE] sending cert request for "C=DE, XXX, OU=OU, CN=Sophos_CA_XXX, E=XXX" 2019-03-27 09:54:42AM 08[IKE] authentication of 'vpn.XXX.de' (myself) successful 2019-03-27 09:54:42AM 08[ENC] generating ID_PROT request 0 [ ID SIG CERTREQ CERTREQ N(INITIAL_CONTACT) ] 2019-03-27 09:54:42AM 08[NET] sending packet: from 192.168.43.69[57469] to XXX[4500] (700 bytes) 2019-03-27 09:54:42AM 11[NET] received packet: from XXX[4500] to 192.168.43.69[57469] (108 bytes) 2019-03-27 09:54:42AM 11[ENC] parsed INFORMATIONAL_V1 request 2569106983 [ HASH N(AUTH_FAILED) ] 2019-03-27 09:54:42AM 11[IKE] received AUTHENTICATION_FAILED error notify 2019-03-27 09:54:43AM 07[CFG] unloaded private key with id 076355e74d5920bd7d8e44759fe1299860180500 2019-03-27 09:54:43AM 13[CFG] unloaded shared key with id 'VPNClientTEST-xauth-id'

Aditya Patel · Accepted Answer

Hello Christian, 
 The firmware 17.5 Mr-4 is now available. Please upgarde your firmware to rectify this issue.

rmk_2018 · Answer

Hello Ruka, 
 
 I think I know why you are having the problem. Are you using .tgb file or .scx file to import the connection? You need to modify the gateway IP to a the DDNS name. YOu have to do this manually. 
 1) If you are using tgb file then this is the line you need to update that IP to your DDNS. 
 [Phase 1] 192.168.1.150 = <YourPolicyName>-P1 
 
 2) If you are using scadmin to modify the tgb file, you need to Modify Target Host and set it your DDNS. 
 
 After you make the modification, you MUST import the connection again and then it will work. 
 
 Please let us know. 
 
 Regards, 
 Ramesh

Aditya Patel · Answer

Hello Raju, 
 According to the logs, it does seem there is no packet received from the firewall, either the packet is not set to XG or not received. Could you take a packet capture from your local system and on XG firewall and compare the two.

Aditya Patel · Answer

Hello Ruka 
 You may check the traffic on your local system from your ethernet or WIFI port from where the connection is ongoing using Wireshark. 
 As for the XG firewall, you would need to follow the steps in this KB article . Follow the steps to download from a web browser. 
 Things to note down: 
 The public address of your remote location and Public address of your XG firewall location. 
 Compare the two PCAP and you may use timestamp on the packets as a reference point. 
 You should see if there is any ISAKMP packet from the remote end or if received on the XG firewall.