Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 6 replies
  • Answers 2 answers
  • Subscribers 41 subscribers
  • Views 3717 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Connect not working for an off site partner

Josh Rogalski

We are a Sophos XG 750 customer, we utilize Sophos Connect as our VPN for offsite connections.   We have a partner who is trying to connect using the client, and they are getting an error.  Everything seems to be the same except they are a business and we are unsure what their outbound firewall blocking policies are.  The error they get is something akin to:  "Policy mismatch error".  They opened up port 8443 so we are told.  Anyone have any advice on what the issue could be?  

Some of the errors from the log file state:

2023-11-07 16:29:18 Server poll timeout, restarting

2023-11-07 16:35:40 TLS Error: TLS key negotiation failed to occur within 60 seconds

   2023-11-07 16:35:40 TLS Error: TLS handshake failed



This thread was automatically locked due to age.
Parents
  • 0

    Turns out that UDP port 8443 was indeed opened up, but that specific partner was blocking the majority of outbound traffic.  They only opened it up for one of our interfaces on the XG, but for some reason the XG was switching the connect client over to the one higher in the list.  Not sure why, but after opening that IP in their firewall everything worked great.  So as mentioned by those below, definitely a port issue on their end.  Recommend if you run into this, that you check if you have more than one WAN, and relay that information even if you are pointing the VPN to a totally separate WAN interface.  Thanks everyone!

Reply
  • 0

    Turns out that UDP port 8443 was indeed opened up, but that specific partner was blocking the majority of outbound traffic.  They only opened it up for one of our interfaces on the XG, but for some reason the XG was switching the connect client over to the one higher in the list.  Not sure why, but after opening that IP in their firewall everything worked great.  So as mentioned by those below, definitely a port issue on their end.  Recommend if you run into this, that you check if you have more than one WAN, and relay that information even if you are pointing the VPN to a totally separate WAN interface.  Thanks everyone!

Children
No Data
Unfiltered HTML