Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 15 replies
  • Answers 4 answers
  • Subscribers 41 subscribers
  • Views 4333 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Connect Problem - Split and Full Tunnel at the same time on different users

WKEIT

This is more of an FYI post, then a support request. Although I'd like to hear from those that have ran into this issue and if you had any alternate ways of mitigating this.

I recently upgraded our XG 310 from 17.5-MR10 to 18.0-MR4, then immediately 18.0-MR5. After upgrading it, one of our long-time Sophos Connect VPN feature broke and it finally took 3 months for support to confirm it's broken.

I don't know if this existed in v17.5-MR11+ and prior to v18 FW versions. My open case is (04046519) and support has confirmed the problem and also confirmed no plans on fixing it. None of the release notes that I've dived into has indicated this capability being listed as a change, so I'm sure this was new on support's problem.

In prior versions of IPSEC-Sophos Connect VPN, you can set either split-tunnel or full-tunnel and deploy it to each client machine via the scx file configured from the SCAdmin utility. With the new firmware upgrade, the split/full tunnel capability is now handled by the Firewall side instead of the endpoints, even though you can still create profiles using the SCAdmin tool and load it onto a client computer.

Even though you can still set full-tunnel or split-tunnel using SCAdmin utility, Sophos Connect will not function correctly if you have your client profile set as Full-Tunnel but the firewall is set to split-tunnel (by way of not configuring the firewall as the default gateway option under the VPN menu).

I don't think development knew this would impact some customers that want to use both full tunnel and split-tunnel options at the same time and the loss of this capability (as well as the intent not to fix it with any future update) is frustrating, especially since it took ~3 months to confirm this issue.

In my use case, I have ~30 active VPN users, and only 10 need to be on full-tunnel to comply with security standards and data compliance. The other 20 can use Split so it doesn't saturate bandwidth.  I dont want everyone to be on full tunnel and eating up all the bandwith if they're just generally browing internet.

With the new changes, it breaks this option. Here's what works/doesn't work.

  • FW (use as default gateway) + SCX profile (full tunnel) - Works
  • FW (use as default gateway) + SCX profile (split-tunnel) - Works, but your connections will be all full-tunnel because of the FW setting and the client machine will have the FW internal IP as the default gateway.
  • FW (don't use as default gateway) + SCX profile (full tunnel) - Will not work because the client machine does not get a default route set. 0.0.0.0/0 is used as the default route and since the firewall is set up to not be the default route, packets have no way of routing.
  • FW (don't use as default gateway) + SCX profile (split tunnel) - Works, just make sure network subnets are configured on both the client SCX profile and the FW's allowed subnets under VPN.


This thread was automatically locked due to age.
  • 0

    Actually this is well known. 

    The reason is the way of implementation. IPsec is a SA based product. And Sophos Firewall using the configuration daemon on Webadmin will limit the SAs, the firewall will build up. 

    If you have a rather special setup of multiple setups, you should not limit the SAs on the firewall itself. 

    What is odd to me, i was confidant, this behavior is explained in the online help, which seems not to be the case. Therefore i will create a change request to add this information to the online help for IPsec. 

    __________________________________________________________________________________________________________________

  • 0

    Hi there,

    Thank you for reaching out and I sincerely apologize for the inconveniences caused by this issue. In regards to your open Support case and investigation, I'm going to be following up with our management team about this.

    Florentino
    Director, Global Community & Digital Support
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the 'Verify Answer' button.
    The Award-winning Home of Sophos Support Videos! - Visit Sophos Techvids
  • 0

    Thanks for writing this. I have run into this issue and it was driving me mad because it used to work fine and it was very useful to use the admin tool to create scx files for full and split tunnel users. 

  • 0 in reply to LuCar Toni

    Maybe I didn't scour enough on the forums but it was news to me. Not to start a tit-for-tat kind of thing, but I'd imagine if it was well known, I could have been communicated that the first week instead of 3 months of troubleshooting to land on the same result - which resulted in no resolution anyway.

    Thanks, LuCar. I'd appreciate the change request link here once it's posted. At least so others can reference the knowledge if they run into the same situation.  I'd like to understand why it functions the way it does and what it would impact. FloSupport reached out earlier and I am requesting this feature to be added for the future, but I would imagine it will be on the low totem pole until other initiatives are handled.

    For anyone else needing this capability, please vote for the feature: Allow both full and split tunnel IPSEC Sophos Connect through Firewall – Sophos Ideas

  • 0

    This is sad to read. The removal of this functionality makes the Sophos VPN feature useless for us.

    I have also been trying to find the bug for a week, at least I can stop looking now. Even in the admin interface it says this setting only affects the .scx file.

    So many things went wrong here, too bad. 

  • 0 in reply to Sebastian G

    Just to be sure: This function is not removed. You can simply not configure it on the firewall and the SC will interact like before. 

    The option in Webadmin is a security feature to actually force the firewall to only allow the predefined networks and not anything else. 

    Its true, the documentation is lacking this, therefore it will be added. 

    What is missing is the option to have multiple profiles like you have in SSLVPN. In IPsec, you can have a "Give me all SAs i want" and "Here only take those SAs and ignore everything else". 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    @LuCar Toni - to clarify and unless I'm missing something, it won't function the same because even if you disable it on the FW side, the profiles still won't work for Full Tunnel because a route doesn't get added at the client-side for it to function correctly under full-tunnel mode. You can add a persistent route, but then when SC disconnects, you're back at the same problem - no default route.

    See bullet #1, teal color is Sophos Support. Can't use both at the same time.

  • 0 in reply to WKEIT

    Try to press "Reset" on SFOS to reset the config. This should restore the config like it was back in the day. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    I'll attempt this on my next enterprise scheduled maintenance in a week. If anyone follows LuCar's suggestion and happens to get it working before mine, do update so we know this is the workaround.

    Thanks, LuCar.

  • 0 in reply to LuCar Toni

    First of all: thanks for the Information .
    Could you possible give a screencap or more detailed description of the actual change in configuration you described with "You can simply not configure it on the firewall and the SC will interact like before"

    Are you referring to the remote subnet setting in L2TP? Or is a Firmware reset / downgrade the only way?

Unfiltered HTML