Firewall single Official IP with NAT causes SSLVPN not to work

Question

Hi everybody, 
 I have done an Update from SFOS 18 to SFOS 19 and since the Update I am not able to connecto to SSLVPN any more. 
 In CLI I can see that all incomming Packets are dropped for SSLVPN when running ( drop-packet-capture "port 1194"). 
 But I can access SSH and HTTPS Management from Internet. 
 So I guesss the Problem is somehow caused by having NAT-Rules on the same official IP (Mailserver Port 25 and HTTPS-Server Port 443) and therefore the Appliance does not accept running SSLVPN on Port 1194 or Port 8443. 
 
 I would appreciate if somebody has a Solution on that, as I only have one Official IP and SSLVPN is not working at all (neither Site2Site, nor Client-VPN) 
 In SFOS 18.5 exactly the same setup was working. 
 
 Thank you! 
 Markus

Markus Steinbauer · Accepted Answer

Hi, 
 I think I managed to solve it on my own after enabeling Debug Mode on Management Interface and checking /log/sslvpn.log in advanced shell. 
 The Reason was that a unused SSLVPN-Client config was still in Place, but maybe was not migrated propperly and due to that the SSLVPN Service crashed all the time as a File could not be found. 
 After deletion of Site-to-Site SSLVPN Configs (Client and Server) the Service started again. 
 
 Anyway: thank you for the Hints! 
 
 best Regards, 
 Markus

Erick Jan · Answer

Hi Markus, 
 Thank you for reaching out to Sophos Community. 
 Have you tried to use any how-to videos, documentation, Sophos Assistant, or KBA to try to check the issue? 
 Also, In addition, can you also check the IP4 lease range setting in the SSL VPN? Kindly see the reference below. 
 Sophos Firewall: SSL VPN "IPv4 lease range" changes in SFOS 19

Firewall single Official IP with NAT causes SSLVPN not to work

Top Replies