Replacement Firewall, new VPN installs do not connect

As Lucar suggested, if you uploaded the configuration, CA and all certificates are also restored so VPN users, for example, can connect.

For new users, did you put the users in the SSL VPN configuration?

Do you see the user's certificate under Certificates > Certificate menu?

Thanks

I restored a backup of the old XG and everything was working fine running unregistered. When I registered the device, I changed the registration to a different mySophos account. That's when I noticed that new VPN installs do not connect (though already installed clients do).

I can see user certificiates under Certificates -> Certificates.

Try to restore the Backup again.

If you skip the registration and restore the configuration, XG will not process the VPN Configuration.

The registration is needed for the VPN Certificates. 

Therefore your Configs are not correct imported. 

A Restore with the same backup after the registration should work. 

Thanks for the feedback.

Is the user an existing user or a new created one on the XG?

Logs from remote vpn client and from XG side?

Thanks

Thanks for the feedback.

Is the user an existing user or a new created one on the XG?

Logs from remote vpn client and from XG side?

Thanks

Existing user.

I tried experimenting with my own account. My VPN client was working. I uninstalled and reinstalled with a fresh download of the client. Now it does not connect.

When I restored from backup, it restored all certs and ran with registration (person)@(domain). Everything was working.

Now that I have changed registration to (group)@(domain), new VPN installs do not work. I am guessing it is a certificate issue?

Can you try what suggested by Lucar?

The backup I restored from is more than two weeks old at this point. I would much prefer not to restore it as I would lose changes I have made since then.

Sadly the registration process regenerates the XG's certificate chain (I've had this one crop up before), the only way to fix this if you don't want to restore is to just people to download and reinstall the SSL Client.

Regards

I was thinking to suggest to create a new vpn user and check if the VPN works.

If the CA is re-generated, no other change to download the SSL VPN config and start over.

:-(

I had a feeling... that is unfortunate.

I wonder - if I changed the registration back to what it was (person)@(domain) to match the certificate store, would that provide a (less than ideal) fix?

If you know, which changes you made, use Export / Import to export those modules into XML.

Then restore your old backup.

Restore the needed / changed modules via XML. 

Use the log viewer > Admin log to understand which changes you performed. Of course you do not have all the details, but at least you know the items created, modified, deleted.

If you have a old backup, you can import the backup configuration on a XG VM, export everything as suggested by Lucar and then compare the XML files with the new exported one.

Regards

Ok thank you. That is certainly an option.

Is it possible to re-register the firewall as it is?

Hi tripleview,

It is possible to re-register the XG firewall, but you have to de-register it first. I would suggest you to open a case with customer care to assist you with the process as it is not possible to de-register the firewall from the GUI, customer care team should be able to help you with this.

Send an email to customercare@sophos.com, if you decide to de-register and re-register the firewall.

Thanks,