This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XGS v19: Strange behaviour over IPSec VPN (Sophos Connect)

Hey folks,

I am currently implementing a new Sophos XGS at a customers site and have some strange effects while using the IPSec VPN through Sophos Connect (have not tested any other).

When brwosing the web, some sites are not accessible (no loading and connection error after some time). While viewing some dumps I came across the fact, that the Firewall sents out ICMP fragmentation messages to the Webserver, as the response packages where too large.

So far so good, but now comes the tricky part. The IPSec interface of the Sophos Connect client has a MTU of 1400 set (default), so each client connection sends out a MSS of 1360. Everything normal until now! The ipsec0 interface of the Sophos XGS has a MTU of 1387 set, which makes no sense to me and might be the problem for the fragmentation messages, as they were sent by the firewall not my client.

Can someone explain this to me? Is this a bug, or what am I not getting here?

Thanks

This thread was automatically locked due to age.

Top Replies

LuCar Toni over 1 year ago +1 suggested

Could you try to disable firewall acceleration and or ipsec acceleration first? See: community.sophos.com/.../troubleshoot-a-broken-application-in-sfos

Parents

0 LuCar Toni over 1 year ago

Could you try to disable firewall acceleration and or ipsec acceleration first? See: community.sophos.com/.../troubleshoot-a-broken-application-in-sfos

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Cancel
0 ddcool over 1 year ago in reply to LuCar Toni

Hi LuCar Toni, is there a way to just disable ipsec acceleration without the FastPath for SSL/TLS inspection?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 1 year ago in reply to ddcool

Fastpath is not SSL/TLS Inspection. Actually it is not used to do it yet. So the fastpath is only a performance feature. You can deactivate it temporary to see, if this fixes the issue. Then you can see, if you are affected by the current issue with IPsec + fastpath, which is under investigation.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 ddcool over 1 year ago in reply to LuCar Toni

Oh there is a current issue. Can you tell me the NC number and if this affects only specific firmware versions? Is this issue planned to be fixed in v19 MR1?
I thought SSL/TLS inspection will also be speed up by the PastPath.

Also let me know, if you need any informations for your investigation.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 1 year ago in reply to ddcool

I do not have a NC Number. You should try the commands first to see, if this helps or not.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 ddcool over 1 year ago in reply to LuCar Toni

Will do, but this takes some time, as we have a live environment here :)

Also I'd like some more informations about this issue, if you could give them to me. I did not found any entries for that in the known issues and the forum.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 ddcool over 1 year ago in reply to LuCar Toni

Will do, but this takes some time, as we have a live environment here :)

Also I'd like some more informations about this issue, if you could give them to me. I did not found any entries for that in the known issues and the forum.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data