SSL VPN Access

Hi Nazir,

Thank you for reaching out to Sophos Community.

I've moved the post to Sophos Firewall,

Let me ensure I understand you correctly. The SSL tunnel has been established, and the issue is Ping going to the branch office.

Kindly check the following

• Is Ping turned on under Device Access for VPN?
• Double-check if any Local ACL was created to drop VPN traffic
• Have you created a Firewall Rule to allow ICMP services
• Do the ranges don’t overlap with your internal subnet?
• Check the log viewer
• Do a packet capture to verify the traffic

Hi Erick, 

thanks a lot form your kinded replay, I have dubble check the PING is active under the VPN also check there is no CLA active 

the Firewall roul also looks good but still I am not able to ping the branch and head office 

Hi Nazir,

Thank you for the information.

Kindly do check it in the Log viewer and also do a GUI packet Capture to analyze the traffic. 

HI Erick, 

in GUI log viewer I see nothing, but in Packet capture I see the below information..

Hi Nazir,

The packet is hitting Rule ID 38, Kindly check Rule ID or place the allow rule (VPN - LAN) on the very top.

Also, you may refer to the following KB 

• Packet capture

Hi Nazir,

The packet is hitting Rule ID 38, Kindly check Rule ID or place the allow rule (VPN - LAN) on the very top.

Also, you may refer to the following KB 

• Packet capture

Dear Erick, 

thanks for your kind support, 

the Rule ID 38 is set on the very top and I have checked the Packet capture once more but it still has the same problem I am not pinging from SSL VPN the branch office but I can ping the main office when I allow WAN as the destination zoon I see in Packet capture that the rule ID 38 pop up  ( one thing I want to mention that the Branch office is connected to with main office with IPsec tunnel. even I set the very top rule ID 38 with source zone any >any  and destination zone any >any still not work see the 2 screenshot 

Under Remote Access VPN > SSL VPN > Your Policy > Tunnel Access section, did you add the networks you want VPN clients to be able to see, both at main office and branch office?