Sophos SSL VPN Dishing Out Same IP to Multiple Users

Hello there,

Thank you for contacting the Sophos Community.

This is expected behavior as the DHCP is handled by a different service than the real DHCP, you can however set a static IP for the Sophos Connect Client users under Configure >> Authentication >> Users >> XXXXX >> SSL VPN Policy >> IPsec Remote Acess, and set one IP from the range of IPs you use for Sophos Connect.

Regards,

Tried this and for SSL on the sophos connect client this doesnt work. I assume given that it says IPsec remote access IP it applies only to IPsec remote tunnels rather than SSL and there is no ability to set a static for this at a per user level currently?

Hello there,

My bad, I skipped the part about the Sophos Connect, yes currently there’s no way to set a static IP per user Level for SSL VPN.

I am not sure though if this KB would work for you as a workaround.

Regards,

I'm afraid that workaround is not really salable to more than one user. 

Bit odd that given how crucial client VPN access is quite how lacking the XG is in terms of configurability and the disjoint of features shared and not shared between IPSEC and SSL very disapointing having moved from watchguard to this.  

Confirmed with Support that the default behaviour for the SSL VPN [assume the same for IPSEC] is that as soon as a user drops / disconnects that IP is then made available to the next client that connects. There is no lease time set for IP addresses dished out via the SSL VPN and no means of setting a lease time on the backend. We have had to set a short DNS scavenging time to avoid issues.

To me this is an issue that needs resolving even our old and pretty rabbish watchguard let us set a lease time for IP addresses dished out via IP sec and SSL and I cant believe that others are not seeing a similar issue.

Hello there,

Thank you for the feedback as mentioned this is expected at the moment when using SSL VPN, you can, however, use Sophos Connect (IPsec) to achieve the static IPs. 

The SSL VPN static IPs is targeted for v19

Regards,

Hello there,

Thank you for the feedback as mentioned this is expected at the moment when using SSL VPN, you can, however, use Sophos Connect (IPsec) to achieve the static IPs. 

The SSL VPN static IPs is targeted for v19

Regards,

Thanks for the update, static IP's for SSL would be handy i can see it was raised as a feature request back in 2015 and has yet to be implemented. It would also be good to see some of the other features available under ipsec profile also in the SSL one such as disabling saving of username and password. Simply making use of the built in dhcp server for managing IP address allocation for SSL and IP sec would also solve a lot of problems. 

Hello there,

Thank you for the feedback, I will pass your feedback to our PM team.

Regards,