This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Set the TLS minimum version to 1.2

In the OpenVPN client, you can set the minimum required TLS version. When I set that to 1.2, I get an error when connecting to the Sophos XG because the server does not support it.

Only when I set the minimal level to 1.0 I get a successful connection.

What do I need to do to set the VPN to use TLS 1.2?

This thread was automatically locked due to age.

Parents

0 Keyur over 5 years ago

Hi Pieter van Kampen

I would request you to check the URL- https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/19662466-tls-1-2-support-for-ssl-vpn

Please vote to prioritize the feature.

Regards,

Keyur
Community Support Engineer | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 Pieter van Kampen over 5 years ago in reply to Keyur

Thanks.

That is from 2017! I would hope that a security product such as the XG does not continue to rely on known insecure protocols. It makes you wonder whether this is a viable future product.
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to Pieter van Kampen

Hi Pieter van Kampen

I understand your point and I will forward your feedback to the concerned team to make the feature available as soon as possible.

Regards,

Keyur
Community Support Engineer | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to Pieter van Kampen

Hi Pieter van Kampen

I would advice you to review this community post for more detail on this topic : https://community.sophos.com/products/xg-firewall/f/vpn/105223/how-can-i-change-the-ssl-vpn-control-channel-to-be-tls-1-2

Please review answer posted by Aditya Patel

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 Pieter van Kampen over 4 years ago in reply to FormerMember

HI, from that, I understand I need to go to V18 as my XG 105 is still on V17.x However, I now see that this not work on "Older" models XG 105. I bought this in june 2018 and my first license has not expired yet, but it is already EOL?
Do you have an upgrade offer?
Cancel
Vote Up 0 Vote Down

Cancel
0 Aditya Patel over 4 years ago in reply to Pieter van Kampen

Hello Pieter,

We do not have plans, for now, to introduce this in V17.5. We have targetted the introduction in V18 MR1-1. If your appliance does not have 4GB, then you are not eligible for V18.

You may coordinate with our sales team and your local vendor for any offers pertaining to hardware upgrades.(If available)

Regards,

Aditya Patel
Global Escalation Support Engineer | Sophos Technical Support
Knowledge Base | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 l0rdraiden over 4 years ago in reply to Aditya Patel

17.5 is not EOL and Sophos should back port this from 18 to 17.5.

I don't think he need to contact with sophos sales to fix a security issue of a supported version of sophos XG
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 l0rdraiden over 4 years ago in reply to Aditya Patel

17.5 is not EOL and Sophos should back port this from 18 to 17.5.

I don't think he need to contact with sophos sales to fix a security issue of a supported version of sophos XG
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Pieter van Kampen over 4 years ago in reply to l0rdraiden

I agree, but they haven't solved this for three years now, so I won't be in contact with sales and draw my conclusions.
Cancel
Vote Up 0 Vote Down

Cancel
0 Network Inter-State over 4 years ago in reply to Pieter van Kampen

Hello,

I have also just replaced our old firewall ( a Juniper series) with the XG 430 Sophos, believing it would be good, and just received our first PCI and was completely surprised at the results. So, from reading above am I correct to assume that upgrading to v18 will fix the TLS1.0 issue?

Best Regards,

Scott M.
Cancel
Vote Up 0 Vote Down

Cancel
0 Pieter van Kampen over 4 years ago in reply to Network Inter-State

You are correct. And you should be able to upgrade, as the XG 430 has enough RAM. It is an issue at the lower end.

Bests,

Pieter
Cancel
Vote Up 0 Vote Down

Cancel