Attempts to download Sophos Connect client (IPsec and SSL VPN) from an XG135 User Portal result in a text file

Hello Chris,

Thank you for contacting the Sophos Community.

This issue is being investigated under NC-70289

As a workaround, you can share the Client with users if you download it from the XG it self.

Configure >> VPN >> IPSec (Remote Access) >> Download Client

Regards,

Thanks for getting back to me. I'll be handing out Clients manually for now.

Just to be sure...Does your reference to NC-70289 means that Sophos is aware of the issue (has a bug report or internal support ticket) and that a fix will be out sometime? If so, I'm satisfied.

Sincerely,

Chris

Ok - Lets slow down. 

Dirk Burg - Do you get a cred auth page, which asks for your creds and a captcha portal. Or does it not start in general? If you go to the user portal (manually), can you download the config for sslvpn for different OS (not Sophos connect)? 

Sam Cunliffe That is correct, but that is not what should matter in any kind of scenario. If you download the SSLVPN for other OS, it still should work. And this ovpn should be importable in the Sophos Connect. 

Alok posted the Link to the KB, which indicates the issue and the limitation is only the New MR4 version, presented to the end user. 

If Sophos Connect/SSLVPN would be broken, there would be more feedback in the community than this. This feature is perfectly working for every Sophos customer today. Only the new option to give the user a own download link is broken, which basically is not in use by many customer. (Most likely because a user do not has admin privileges on their windows client). 

No, the old ssl-vpn client cannot be downloaded under 18MR4, if that would work I would have no problem.

That seems to be an issue, not related to this one. If you try to download the old SSLVPN, what do you see in the user portal? 

Yes, i Do get a cred auth page, then the Message with the  missing SSL-VPN-Polici folows. 

And no, I can neither download the SSL VPN configuration nor the configuration for Sophos Connect from the user portal.

That seems to be an issue, not related to this one. If you try to download the old SSLVPN, what do you see in the user portal? 

Nothing happens.

Exactly same here

So you cannot download the SSLVPN Config, as the user portal does nothing, if you click on SSLVPN configuration for other OS? 

Did you check this KB? https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/119348/sophos-xg-firewall-troubleshooting-0-byte-ssl-vpn-file

It could be related to this issue, that you are not able to download this file, as the config file is broken. Thats not related to this issue. 

I confirmed on multiple XG Firewalls, that i can download the SSLVPN and this is not related / affect in any case. 

So you issues are not related to this particular issue. We are only tracking the Download of Sophos Connect on user portal as an issue. Your problems seems to be something else. 

Do you have CA configured on the XG? SSL VPN cannot be downloaded if you dont have CA configured

I’ve not touched anything to do with the CA, do you need to change any of the default settings to get this to work? I didn’t see that listed in the configuration guide 

Yes you have to first configure certificate authority for the XG. Its unfortunatelly not part of the guide for VPN, but its a prerequisite.

When you click to download SSL VPN client for new user it automatically generates certificate for this user that is signed by the Sophos XG appliance CA. If you do not have the CA configured it cannot create user certificate and therefore you cannot download the SSL VPN client. Unfortunatelly it doesnt throw any error. It just doest work.

But this is not anyhow related to the Sophos Connect case.

Yes you have to first configure certificate authority for the XG. Its unfortunatelly not part of the guide for VPN, but its a prerequisite.

When you click to download SSL VPN client for new user it automatically generates certificate for this user that is signed by the Sophos XG appliance CA. If you do not have the CA configured it cannot create user certificate and therefore you cannot download the SSL VPN client. Unfortunatelly it doesnt throw any error. It just doest work.

But this is not anyhow related to the Sophos Connect case.

I had this issue yesterday with a brand new XG I installed for a customer.   The old SSL VPN client wouldn't download. Click > nothing. 

I called support and after a long wait on hold I spoke with support who went through and textbooked my setup (hate it when they do that).  The very last thing he did was to fill out the information in System > Certificate Authorities > Default certificate.  After that was filled out I logged out/in to the user portal and my SSL VPN client started downloading.  

I've never filled this certificate out that I recall.  It's always been pre-populated.  I'm not even sure where they got the city & state from, but they're accurate.  I went through several of our customers, even some that don't use VPN, and they all have the correct information in the default CA.  So having to fill it out yesterday manually was new for me.  

The Connect client still gives the text file error and the Apple IOS IPsec VPN client configuration logs me out of the firewall when clicked.  

This issue can occur, if the data in MySophos is not correct or uses special characters. XG will fetch the data by wizard from mySophos. If there are special characters or other stuff in there, it can destroy the CA creation. Most likely in most setups, this works fine, sometimes there are corner cases, which shows this issue about the empty / corrupt CA. 

Hi There!

If I regenerate the built-in Certificate, it can be affect the RED devices?

As far as i know - No. RED uses a own certificate, not visible for the enduser. 

Hi, same issue here

The Connect client still gives the text file error and the Apple IOS IPsec VPN client configuration logs me out of the firewall when clicked.  

When I try to download either of the Windows or macOS clients, I don't get any kind of executable or installer

The Problem is more than 30 days old an there is no Solution with a firmware update.

Did you check for this issue? https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/119348/sophos-xg-firewall-troubleshooting-0-byte-ssl-vpn-file

Hi,

i checked the issue but it does not work. I dont unse Certificats on ipsec or ssl vpn.

i filled the ca, but still no download from the client an i get logged out if i download ipsec ios konfig file.

Sophos Connect Client is broken.

Apple iOS IPsec VPN is broken.

SSL VPN Client should work. If this is not working: Check https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/119348/sophos-xg-firewall-troubleshooting-0-byte-ssl-vpn-file all options. (Check the certificate, check for special characters etc.)

Sophos Connect Client is broken.

Apple iOS IPsec VPN is broken.

Ok, i hope it will be fixed. It is broken over 30days after it is reportet!

Sophos Connect Client is not needed, as this is a new option and most admins use the Webadmin anyway instead of the user configuration part. Sophos Connect works perfectly with the option presented in the XG webadmin. Apple iOS is a corner use case as most customer use MDM solutions to push this configuration anyway.