Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 38 subscribers
  • Views 2761 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG 18, SSL VPN android: no shared ciphers

Eduardo Diaz Comellas

Hi,

I've got a fresh new install of X.G. 18. Everything runs well *but*...

SSL VPNs can't be stablished from android devices. I've tested every combination of cipher and authentication, but the log still shows "no shared cipher".

-------------------

Mon May  3 13:10:30 2021 us=52099 [3330] TCP connection established with [AF_INET6]::ffff:1XX.1XX.2XX.2:45776
Mon May  3 13:10:30 2021 us=52115 [3330] TCPv6_SERVER link remote: [AF_INET6]::ffff:1XX.1XX.2XX.2:45776
Mon May  3 13:10:30 2021 us=52561 [3330] ::ffff:1XX.1XX.2XX.2 TCPv6_SERVER READ [14] from [AF_INET6]::ffff:1XX.1XX.2XX.2:45776: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Mon May  3 13:10:30 2021 us=52571 [3330] ::ffff:1XX.1XX.2XX.2 TLS: Initial packet from [AF_INET6]::ffff:1XX.1XX.2XX.2:45776, sid=c548a4be 80665ec5
Mon May  3 13:10:30 2021 us=52587 [3330] ::ffff:1XX.1XX.2XX.2 TCPv6_SERVER WRITE [26] to [AF_INET6]::ffff:1XX.1XX.2XX.2:45776: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Mon May  3 13:10:30 2021 us=82158 [3330] ::ffff:1XX.1XX.2XX.2 TCPv6_SERVER READ [265] from [AF_INET6]::ffff:1XX.1XX.2XX.2:45776: P_CONTROL_V1 kid=0 [ 0 ] pid=1 DATA len=239
Mon May  3 13:10:30 2021 us=82233 [3330] ::ffff:1XX.1XX.2XX.2 TLS_ERROR: BIO read tls_read_plaintext error: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher
Mon May  3 13:10:30 2021 us=82242 [3330] ::ffff:1XX.1XX.2XX.2 TLS Error: TLS object -> incoming plaintext read error
Mon May  3 13:10:30 2021 us=82249 [3330] ::ffff:1XX.1XX.2XX.2 TLS Error: TLS handshake failed
Mon May  3 13:10:30 2021 us=82277 [3330] ::ffff:1XX.1XX.2XX.2 Fatal TLS error (check_tls_errors_co), restarting
Mon May  3 13:10:30 2021 us=82286 [3330] ::ffff:1XX.1XX.2XX.2 SIGUSR1[soft,tls-error] received, client-instance restarting

--------------------

Any idea? I am using the OpenVPN Connect android client, and I have tried to activate AES-CBC cipher algoritm under "Settings".



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi ,

    Thanks for reaching out to the Community! 

    What is the current firmware version on your firewall? The errors in the logs suggested it's an issue with the TLS handshake; it could be related to the user certificate. 

    I'd suggest you delete the user certificate and redownload the configuration for the user. When you login to the user portal and download the configuration, the process will re-generate the user certificate.

    You could find the user certificate under Certificates > Search for the username to find the user certificate.  

  • 0 in reply to FormerMember

    Thanks very much for the answer.

    Thi is 18.0.4 MR4. The user was created 1 hour ago, so I don't think that deleting it and creating it again will make any difference. Please tell me if it is worth giving it a try.

    What is driving me mad is the "no shared cipher" message. What has changed so there are no common ciphers between the openvpn connect client and a sophos XG?

    Best regards.

  • FormerMember
    0 FormerMember in reply to Eduardo Diaz Comellas

    Hi ,

    Thanks for the update. 

    Are you able to connect to the SSL Remote VPN from a different device? Is the default certificate on the firewall properly configured? 

    If you made any changes to the configuration on the firewall related to the SSL VPN, you'd have to download the new configuration.

    Reference screenshot: 

    Thanks,

  • 0 in reply to FormerMember

    Sure. SSL access is working from PCs. It is just android phones that can't connect.  That is the weird thing about it.

    I've not tested from iphones (no one at hand) but will try tomorrow.

  • 0 in reply to Eduardo Diaz Comellas

    Try to use MR5 and redo this test. Check the android settings, which TLS Version is enforced by the phone. I do not have a android device.

    See: https://forums.openvpn.net/viewtopic.php?t=25487

    The Android device could have a preference to select specific ciphers, which are not supported on Xg. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Unfortunately MR5 is still not available for this firewall (it is an HA cluster, and it takes a bit more to receive updates). The problem with the tls version in the phone can be the key... any idea on how I can force to use a compatible tls version?

Reply Children
Unfiltered HTML