This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG Qnap VPN-Verbindung mit L2TP geht nicht

Hallo Zusammen,

ich versuche nun schon seit Tagen eine Verbindung zwischen einer extern stehenden Qnap und unserer Sophos XG Firewall über L2TP hinzubekommen.
Hintergrund ist, das Qnap soll als externer Speicher angesprochen werden. Eine Verbindung über OpenVPN zwischen Qnap und Sophos funktioniert. Allerdings habe ich dabei das Problem, dass das Qnap immer eine neue IP-Adresse bekommt. Für unser Backup-System benötige ich aber fixe IP der Qnap.

Kurz die Konstellation:

Sophos XG 125 mit SFOS 18.0.4 MR-4
Auf der Gegenseite eine NAS von Qnap mit v4.3.6 und installiertem QVPN

Die Qnap soll sich über QVPN mit der Sohpos verbinden. Wie gesagt, per OpenVPN funktioniert es, nicht aber per L2TP.

Ich habe L2TP nach dieser Anleitung auf de Sophos eingerichtet: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/VPNL2TPRemoteAccessConnectionCreate.html

Egal welche Richtlinie ich auch einstelle, das Qnap kann keine Verbindung herstellen.

Auf dem Qnap habe ich schon versucht, im Log-Verzeichnis einen Hinweis zu finden, konnte in der nc.log aber nur folgende zwei Zeilen finden:
2021-05-18 10:09:01,416 [Information] [Message] create [type=3] [level=1] [app=QVPN Service] [category=VPN Client] [attachment=] [QVPN Service] Connected the L2TP/IPSec profile: "Backup".
2021-05-18 10:09:01,424 [Information] [Message] not match any policy

Auf dem Qnap sind folgende Infos hinterlegt:

Die Konfiguration auf Seiten der Sophos ist wie folgt:

Hat einer von Euch einen Tipp für mich oder womöglich sogar eine gleiche Konfiguration die funktioniert?

This thread was automatically locked due to age.

Parents

0 FormerMember over 2 years ago

Hi Jogi65,

Thank you for reaching out to Sophos Community.

Request to follow steps below to check l2tp events.

==> Login to SSH > 5. Device Management > 3. Advanced Shell

==> To check strongswan.log:

# tail -f /log/strongswan.log | grep -i "<L2TP_connection_name>"

==> To check l2tpd.log:

# tail -f /log/l2tpd.log

==> Try to connect L2TP from Qnap and share session output here or in PM.

Also, check which authentication method is set for L2TP.

Login to SSH > 4. Device console

console> show vpn configuration

Check authentication events under log viewer as well.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jogi65 over 2 years ago in reply to FormerMember

Hi Yashi,

below are the screenshots. Surprisingly, I could not see any entry about authentication in the log viewer.

Thanks,
Jochen
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 2 years ago in reply to Jogi65

Hi Jogi65,

Could you please share a snapshot of 'Remote network details' from L2TP(remote access) configuration?

Have you added a specific subnet or is it ANY?
Cancel
Vote Up 0 Vote Down

Cancel
0 Jogi65 over 2 years ago in reply to FormerMember

Hi Yash,

Here the screenshot. I did not select ANY but some subnets.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Jogi65 over 2 years ago in reply to FormerMember

Hi Yash,

Here the screenshot. I did not select ANY but some subnets.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Jogi65 over 2 years ago in reply to Jogi65

and the rest
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 2 years ago in reply to Jogi65

Hi Jogi65,

Thank you for sharing configuration snapshots.

Could you please try once with 'Remote subnet' as ANY?
Cancel
Vote Up 0 Vote Down

Cancel
0 Jogi65 over 2 years ago in reply to FormerMember

Hi Yash,

unfortunately the result is the same.
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 2 years ago in reply to Jogi65

Hello Jogi,

Following this, try not selecting NAT-T.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jogi65 over 2 years ago in reply to emmosophos

Hi Emmanuel,

Thank you for your feedback.
This is the result of my attempt without NAT-T.

Regards

Jochen
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 2 years ago in reply to Jogi65

As per the snapshot, the remote client(Qnap) is initiating IKE requests with AES-SHA1 proposals(encryption & authentication algorithm). However, on Sophos Firewall DefaultL2TP policy is being used for the L2TP connection.

Could you please configure Qnap to initiate requests with the same policy parameters as the DefaultL2TP policy?
Cancel
Vote Up 0 Vote Down

Cancel
0 Jogi65 over 2 years ago in reply to FormerMember

Hi Yash,

I'm a little further along now. I have created my own IPSec policy based on the DefaultL2TP policy and adjusted the parameters there.

However, it still can't connect.

Regards

Jochen
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 2 years ago in reply to Jogi65

Could you please once try to set up L2TP adapter once on a windows machine and check whether it connects or not?
Cancel
Vote Up 0 Vote Down

Cancel
0 Jogi65 over 2 years ago in reply to FormerMember

Hi Yash

I get the following error message on Windows 10.
"The remote connection has been denied because the specified username and password combination is not recognized or the selected authentication protocol is not allowed for the RAS server."
Username and password are definitely correct.

The same, by the way, when I select DefaultL2TP as policy in Sophos.

The settings for the VPN connection are as follows:
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 2 years ago in reply to Jogi65

Could you please double-check on username/password?

We tried replicating the issue with a Windows device and had same errors upon using an incorrect username
Cancel
Vote Up 0 Vote Down

Cancel