I have just experienced the most bizarre situation. Customer has two backup internet connections on Port 2 and Port 3 that run through another router. Port 4 is the main internet connection. When downloading SSL configuration, the Sophos had local LAN IP addresses of Port 2 and Port 3 higher in the priority list. There was no way to change this and of course SSL VPN is never going to connect to a 192.168.xx.xx address.
There is nowhere anywhere in the Sophos unit to specify what WAN ports to use for SSL VPN and no way to change priority order.
Here is the stupid thing. I created a new zone "WAN2" and moved Port2 and Port3 to "WAN2". I then moved them back to "WAN". Now the WAN IP addresses in the SSL VPN configuration have changed order.
So, it looks like the order of WAN IP addresses in the SSL VPN configuration that a user downloads are the order in which the ports are assigned to the WAN zone. If you want to set the order for SSL VPN connections, set all your ports to some random zone and then assign them back to the WAN zone in the order you want the Sophos SSL VPN to use them.
Dumb - and needs to be fixed, but I'm still waiting for issues from 2012 to be fixed so I won't hold my breathe.
Hopefully this helps someone
Hi Stuart James: Thank you for sharing this information or working details with community users and definitely this will be helpful to get the clarity in terms of SSL VPN WAN precedence. We may define the…
Hi Stuart James: Thank you for sharing this information or working details with community users and definitely this will be helpful to get the clarity in terms of SSL VPN WAN precedence. We may define the "Override Hostname" which will fix the connection on that defined (WAN Port) ISP IP only.Override Hostname: This sets the SSL VPN client configuration file to use this public IP when establishing the connection.Also, another way around for this one is DNS override hostname which resolves to the IP address of one's choice.However, for defining priority order-based settings, such requirements are already under review (possibly may integrate in future with Sophos connect client) by the PM team, and meantime I would also suggest you to upvote any existing matching thread or raise a new thread on Ideas Portal.
Regards,Vishal RanpariyaTechnical Account Manager | Sophos Technical SupportSophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts | If a post solves your question use the 'This helped me' link.
The problem is not that it was using a LAN IP (although it's astounding that Sophos is not clever enough to see this and use the natted IP instead), the problem is that there is no way to change the order of precedence on which interface an SSL VPN uses.
I'm not going to waste my time logging a feature request. Sophos never delivers on these. There are requests with thousands of votes not done. There are even requests from 2015 where Sophos has said this is a good idea, we'll add it for release in 2018. It's still not done. Sophos do not listen to their customers, they just do whatever they think is best.
Here's a good example - to add a new terminal server to STAC, I have to give my customer full unrestricted admin console access because you can't add it through the GUI. Such a simple, basic, fundamental thing that is critical to maintaining security of the firewall but instead I've had to give nearly every customer full admin console access so that they can manage their business properly.