Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 139 replies
  • Answers 4 answers
  • Subscribers 76 subscribers
  • Views 47081 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Firewall: v19.5 MR2: Feedback and experiences

LuCar Toni

Release Post:   Sophos Firewall OS v19.5 MR2 is Now Available  

The old V19.5 MR1 Post: Sophos Firewall: v19.5 MR1: Feedback and experiences 

To make the tracking of issues / feedback easier: Please post a potential Sophos Support Case ID within your initial post, so we can track your feedback/issue. 



This thread was automatically locked due to age.
Parents
  • 0

    We were waiting for the SSL VPN routing problem with static IP assigned to the client to be solved with MR2. Unfortunately it still is not solved. It got worse instead. After assigning a static SSL VPN IP to one client it cannot access the LAN network anymore. Connection is established but no traffic to LAN is possible. If we remove the static SSL VPN IP from the user everything works fine. But we need static IP so we can access the device from the LAN on FQDN. With MR1 we had the problem that the device could access the LAN with static IP assigned but traffic from LAN to the connected device was not possible because of routing problem in the XGS. Does anybody have the same problem and is there a solution? The issue ID for this is NC-114163.

  • 0 in reply to Enrico van Egmond1

    Same problem here. Requests from the client are hitting the Sophos Firewall but replies are not routed in to the tunnel interface but to the WAN.



    After deleting the static IP from the user settings everything works fine and replies are hitting the tunnel interface

  • 0 in reply to MarekDalke

    Hello Marek,

    Would it be possible for you to open a case with Support, reference this community post and the NC-114163.

    Regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
  • 0 in reply to emmosophos

    Case has been opened. Support Engineer pointed an easy way how to test this with the Route Lookup from the Sophos Firewall Diagnostics Tools:

    Route to the static IP VPN client:

    172.16.255.250 is located on the Port2
172.16.255.250 is reached through the router X.Y.Z.W


    Route to the dynamic IP VPN client:

    172.16.255.10 is located on the tun0
172.16.255.10 is not behind a router
  • 0 in reply to MarekDalke

    Hello Marek,

    Thank you, I cannot find the Case ID under your account; can you share it.

    Regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
  • 0 in reply to emmosophos

    Hello Marek,

    Thank you for the Case ID, you shared via PM; I can see the case is already escalated to GES for further investigation and troubleshooting.

    Regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
  • 0 in reply to MarekDalke

    I've seen similar cases, where routes to move traffic across tun0 were not automatically created in certain cases and were instead being sent out the default route. I specifically remember that I could only create the proper routes via the CLI but don't remember exactly why. But I do remember not seeing the expected routes when using the ""ip route show table all" CLI command.

    In my case it was across some IPSec tunnels instead of SSL VPN connections, but there's overlap in how those are treated in a Sophos. I would compare the full routing tables when the user is connected with a static versus the same user connected with a dynamic. I didn't like creating my routes like that because they are difficult to find unless you already know they exist, but it did work 

Reply
  • 0 in reply to MarekDalke

    I've seen similar cases, where routes to move traffic across tun0 were not automatically created in certain cases and were instead being sent out the default route. I specifically remember that I could only create the proper routes via the CLI but don't remember exactly why. But I do remember not seeing the expected routes when using the ""ip route show table all" CLI command.

    In my case it was across some IPSec tunnels instead of SSL VPN connections, but there's overlap in how those are treated in a Sophos. I would compare the full routing tables when the user is connected with a static versus the same user connected with a dynamic. I didn't like creating my routes like that because they are difficult to find unless you already know they exist, but it did work 

Children
No Data
Unfiltered HTML