Sophos Firewall: v19.5 MR2: Feedback and experiences

We were waiting for the SSL VPN routing problem with static IP assigned to the client to be solved with MR2. Unfortunately it still is not solved. It got worse instead. After assigning a static SSL VPN IP to one client it cannot access the LAN network anymore. Connection is established but no traffic to LAN is possible. If we remove the static SSL VPN IP from the user everything works fine. But we need static IP so we can access the device from the LAN on FQDN. With MR1 we had the problem that the device could access the LAN with static IP assigned but traffic from LAN to the connected device was not possible because of routing problem in the XGS. Does anybody have the same problem and is there a solution? The issue ID for this is NC-114163.

We were waiting for the SSL VPN routing problem with static IP assigned to the client to be solved with MR2. Unfortunately it still is not solved. It got worse instead. After assigning a static SSL VPN IP to one client it cannot access the LAN network anymore. Connection is established but no traffic to LAN is possible. If we remove the static SSL VPN IP from the user everything works fine. But we need static IP so we can access the device from the LAN on FQDN. With MR1 we had the problem that the device could access the LAN with static IP assigned but traffic from LAN to the connected device was not possible because of routing problem in the XGS. Does anybody have the same problem and is there a solution? The issue ID for this is NC-114163.

Same problem here. Requests from the client are hitting the Sophos Firewall but replies are not routed in to the tunnel interface but to the WAN.



After deleting the static IP from the user settings everything works fine and replies are hitting the tunnel interface

Hello Enrico,

Can you share your previous Case ID, and if you haven't, can you create a new Case ID, and reference the NC number and the previous Case ID.

Regards,

Hello Marek,

Would it be possible for you to open a case with Support, reference this community post and the NC-114163.

Regards,

Hi Enrico - We tried to reproduce this issue in our lab, both on VM and XGS. We see that the traffic is passing from the client static ip to the LAN and vice-versa. We dont see any problem.

We would like to take a look at your setup. I will DM you, to check if we can get the Access ID

Case has been opened. Support Engineer pointed an easy way how to test this with the Route Lookup from the Sophos Firewall Diagnostics Tools:

Route to the static IP VPN client:

172.16.255.250 is located on the Port2
172.16.255.250 is reached through the router X.Y.Z.W

Route to the dynamic IP VPN client:

172.16.255.10 is located on the tun0
172.16.255.10 is not behind a router

Hello Marek,

Thank you, I cannot find the Case ID under your account; can you share it.

Regards,

Hello Marek,

Thank you for the Case ID, you shared via PM; I can see the case is already escalated to GES for further investigation and troubleshooting.

Regards,

I've seen similar cases, where routes to move traffic across tun0 were not automatically created in certain cases and were instead being sent out the default route. I specifically remember that I could only create the proper routes via the CLI but don't remember exactly why. But I do remember not seeing the expected routes when using the ""ip route show table all" CLI command.

In my case it was across some IPSec tunnels instead of SSL VPN connections, but there's overlap in how those are treated in a Sophos. I would compare the full routing tables when the user is connected with a static versus the same user connected with a dynamic. I didn't like creating my routes like that because they are difficult to find unless you already know they exist, but it did work 

Hi Enrico van Egmond1  - We had a discussion on this issue internally. Can you please disable this "any" "any" rule(3rd rule in the list) from the SDWAN routes ? It should solve your problem.

After disabling the SD-WAN route the Static IP SSL VPN works good. Traffic is routed correctly from VPN connected device to LAN and from LAN to the VPN connected device with the static IP. It's still strange why this is no problem on dynamic IP's with SSL VPN connected devices.