What is wrong with my remote-access SSL VPN settings !?

Hi J Thai,

Thank you for sending a message to Sophos Community.

Since the VPN connection is already established. Have you created an FW Rule "VPN to LAN "rule to allow access to local resources?

Have you allowed it on the Permitted resources?

Also, have you checked the logs and what does it say when accessing the local resource?

For more reference, kindly follow the KB guide for trouble shooting:support.sophos.com/.../KB-000036884

Hello buddy,

Thanks for you reply. Here are my SSL VPN's permitted resources and firewall rule:

Just a few more questions I would like to ask you. Sorry for being a noob:

1. Do I have to add all the LAN subnets that I want to grant access for the SSL VPN into the Permitted network resources IPv4 beside the Local Subnet, or just creating a VPN_to_LAN firewall rule alone is enough ?
   
   
2. What purpose does the firewall rule I have created in the screenshot above have ? If another VPN_to_LAN rule is to be created, is a NAT rule for it also necessary ?
   
   
3. In addition, I would also want to have Internet connectivity under the Sophos XG host's WAN IP when I am connecting via this VPN interface. How will the VPN_to_WAN rule look like, and is a NAT rule for it also needed ?

Thank you very much again. 

Hello buddy,

Thanks for you reply. Here are my SSL VPN's permitted resources and firewall rule:

Just a few more questions I would like to ask you. Sorry for being a noob:

1. Do I have to add all the LAN subnets that I want to grant access for the SSL VPN into the Permitted network resources IPv4 beside the Local Subnet, or just creating a VPN_to_LAN firewall rule alone is enough ?
   
   
2. What purpose does the firewall rule I have created in the screenshot above have ? If another VPN_to_LAN rule is to be created, is a NAT rule for it also necessary ?
   
   
3. In addition, I would also want to have Internet connectivity under the Sophos XG host's WAN IP when I am connecting via this VPN interface. How will the VPN_to_WAN rule look like, and is a NAT rule for it also needed ?

Thank you very much again. 

Hello J Thai,

Thank you for the update.  

1. Do I have to add all the LAN subnets that I want to grant access for the SSL VPN into the Permitted network resources IPv4 beside the Local Subnet, or just creating a VPN_to_LAN firewall rule alone is enough ?

> Yes, you need to add all the LAN subnets that you want to access it over SSL VPN subnet in the permitted network resources IPv4.
And Yes if you want to access LAN subnets over VPN then you need a VPN to LAN. And if you want to VPN subnets to be accessible over LAN then you need LAN to VPN rule.

2. What purpose does the firewall rule I have created in the screenshot above have ? If another VPN_to_LAN rule is to be created, is a NAT rule for it also necessary ?

> Your rule is very confusing as because of the name you have given especially to the source and destination network.
You can refer the best practices guide below:-
> Configure remote access SSL VPN with Sophos Connect client - https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/VPN/RemoteAccessVPN/VPNRemoteAccessSSLVPNSophosConnectClient/index.html
> Sophos Firewall: Configure IPsec and SSL VPN Remote Access: https://www.youtube.com/watch?v=wXUmWX1kDx4

3. In addition, I would also want to have Internet connectivity under the Sophos XG host's WAN IP when I am connecting via this VPN interface. How will the VPN_to_WAN rule look like, and is a NAT rule for it also needed ?

Hi J Thai,

As stated, just follow the guide given, indicate all the desired Networks to be allowed both on FW and permitted network resources, and create a specific FW rule (source/Destination, VPN-LAN/LAN-VPN, etc.) for security.