Help us enhance your Sophos Community experience. Share your thoughts in our Sophos Community survey.

Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 15 replies
  • Answers 4 answers
  • Subscribers 41 subscribers
  • Views 4375 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Connect Problem - Split and Full Tunnel at the same time on different users

WKEIT

This is more of an FYI post, then a support request. Although I'd like to hear from those that have ran into this issue and if you had any alternate ways of mitigating this.

I recently upgraded our XG 310 from 17.5-MR10 to 18.0-MR4, then immediately 18.0-MR5. After upgrading it, one of our long-time Sophos Connect VPN feature broke and it finally took 3 months for support to confirm it's broken.

I don't know if this existed in v17.5-MR11+ and prior to v18 FW versions. My open case is (04046519) and support has confirmed the problem and also confirmed no plans on fixing it. None of the release notes that I've dived into has indicated this capability being listed as a change, so I'm sure this was new on support's problem.

In prior versions of IPSEC-Sophos Connect VPN, you can set either split-tunnel or full-tunnel and deploy it to each client machine via the scx file configured from the SCAdmin utility. With the new firmware upgrade, the split/full tunnel capability is now handled by the Firewall side instead of the endpoints, even though you can still create profiles using the SCAdmin tool and load it onto a client computer.

Even though you can still set full-tunnel or split-tunnel using SCAdmin utility, Sophos Connect will not function correctly if you have your client profile set as Full-Tunnel but the firewall is set to split-tunnel (by way of not configuring the firewall as the default gateway option under the VPN menu).

I don't think development knew this would impact some customers that want to use both full tunnel and split-tunnel options at the same time and the loss of this capability (as well as the intent not to fix it with any future update) is frustrating, especially since it took ~3 months to confirm this issue.

In my use case, I have ~30 active VPN users, and only 10 need to be on full-tunnel to comply with security standards and data compliance. The other 20 can use Split so it doesn't saturate bandwidth.  I dont want everyone to be on full tunnel and eating up all the bandwith if they're just generally browing internet.

With the new changes, it breaks this option. Here's what works/doesn't work.

  • FW (use as default gateway) + SCX profile (full tunnel) - Works
  • FW (use as default gateway) + SCX profile (split-tunnel) - Works, but your connections will be all full-tunnel because of the FW setting and the client machine will have the FW internal IP as the default gateway.
  • FW (don't use as default gateway) + SCX profile (full tunnel) - Will not work because the client machine does not get a default route set. 0.0.0.0/0 is used as the default route and since the firewall is set up to not be the default route, packets have no way of routing.
  • FW (don't use as default gateway) + SCX profile (split tunnel) - Works, just make sure network subnets are configured on both the client SCX profile and the FW's allowed subnets under VPN.


This thread was automatically locked due to age.
Parents
  • 0

    This is sad to read. The removal of this functionality makes the Sophos VPN feature useless for us.

    I have also been trying to find the bug for a week, at least I can stop looking now. Even in the admin interface it says this setting only affects the .scx file.

    So many things went wrong here, too bad. 

  • 0 in reply to Sebastian G

    Just to be sure: This function is not removed. You can simply not configure it on the firewall and the SC will interact like before. 

    The option in Webadmin is a security feature to actually force the firewall to only allow the predefined networks and not anything else. 

    Its true, the documentation is lacking this, therefore it will be added. 

    What is missing is the option to have multiple profiles like you have in SSLVPN. In IPsec, you can have a "Give me all SAs i want" and "Here only take those SAs and ignore everything else". 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    @LuCar Toni - to clarify and unless I'm missing something, it won't function the same because even if you disable it on the FW side, the profiles still won't work for Full Tunnel because a route doesn't get added at the client-side for it to function correctly under full-tunnel mode. You can add a persistent route, but then when SC disconnects, you're back at the same problem - no default route.

    See bullet #1, teal color is Sophos Support. Can't use both at the same time.

  • 0 in reply to WKEIT

    Try to press "Reset" on SFOS to reset the config. This should restore the config like it was back in the day. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    I'll attempt this on my next enterprise scheduled maintenance in a week. If anyone follows LuCar's suggestion and happens to get it working before mine, do update so we know this is the workaround.

    Thanks, LuCar.

Reply Children
No Data
Unfiltered HTML