This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN Client can connect but no traffic is generated to VPN zone

Hi all,

I was able to use SSL VPN properly with Sophos XG v19. Now I've upgraded to v20 and I'm experiencing issue with SSL VPN.

To setup the SSL VPN I followed this guide: https://techvids.sophos.com/watch/wtqMJE1La6TkFjAiaT2d3H

I draw a network scheme to better explain how the network is configured:

I'm using an iPhone with OpenVPN installed as a client. It can connect and authenticate properly, the OpenVPN iPhone app shows that XG assigned the IP 10.10.70.1

I've a firewall rule that allow traffic from VPN to DMZ,WAN and LAN:

In the firewall log I can't see any traffic generated through the VPN, traffic flows regularly into the XG on port 8443 (I've check with tcpdump ssh-ing into XG firewall).

I've also tried to attach a Linked NAT rule to Masquerade (MASQ) all traffic that comes from VPN zone. The client can't reach any DMZ hosts neither any internet host (I would like to use the VPN as the default gateway).

Can anyone help me to solve this issue?

Thanks in advance

This thread was automatically locked due to age.

Top Replies

Sreenivasulu Naidu 8 months ago in reply to Angelone +2 verified

With legacy mode (Settings -> Advanced settings -> Security level in Openvpn conect client on iOS), traffic is passing through the sslvon ra tunnel and able to reach the DMZ hosts. This is the behaviour…

0 Erick Jan 9 months ago

Hi Angelone,

Thank you for reaching out to Sophos Community.

We regret to hear about your experience. Let me ensure I understand you correctly.

Your SSL VPN was working properly before the upgrade to version 20.

How about packet capture? Any traffic generated?

I recommend contacting Sophos Support to check this issue further, and kindly share the case ID here.

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Angelone 9 months ago in reply to Erick Jan

Hi Erick,

SSL VPN was working properly with v19.5.

Regarding to the packet capture, using "port 8443" as BPF string I see traffic that comes into the firewall but I cannot see any traffic through the itun0 interface (I've checked using tcpdump).

If this can help I needed to comment out the string "comp-lzo no" in the ovpn file otherwise the iPhone gave me the error "server pushed compression settings that are not allowed and will result in a non-working connection".

Thanks for your help.
Cancel
Vote Up 0 Vote Down

Cancel
0 Giridhar Katti 9 months ago in reply to Angelone

Hi Angelone - Can you please DM me and PRANEETH Kumar the access id of your device. We will take a look at the issue.
Cancel
Vote Up +1 Vote Down

Cancel
0 Angelone 9 months ago in reply to Giridhar Katti

Hi Giridhar Katti , I tried to enable the support access but the Access ID remains in the "Connecting to server" state
Cancel
Vote Up 0 Vote Down

Cancel
0 Kaushal Kansara 9 months ago in reply to Angelone

Hi Angelone ,

Currently i am looking into Access ID issue.

Can you please share uma.log from /log dir in one on one to investigate why access id is not generated?

Also provide output of following commands executed via backend of SFOS.

nslookup eu2.apu.sophos.com

traceroute eu2.apu.sophos.com

ping eu2.apu.sophos.com ( APU server will not respond to ping request although, i would like to check dns resolution)
Cancel
Vote Up 0 Vote Down

Cancel
0 Giridhar Katti 9 months ago in reply to Angelone

Can you DM Sreenivasulu Naidu with zoom/teams link to debug the issue together ?
Cancel
Vote Up 0 Vote Down

Cancel
0 Angelone 9 months ago in reply to Giridhar Katti

Thanks a million for the support. At the moment I’m not at home, I will send the link and the logs as soon as I will come back home in few days
Cancel
Vote Up 0 Vote Down

Cancel
0 Angelone 9 months ago in reply to Kaushal Kansara

Hi Kaushal Kansara ,

attached you can find the zip file that contains the elements you've asked for.

The output of the commands are contained in command_debug.txt file. I'll send you the password to extract the archive, the traceroute contains information about my IP address that I prefer to not share here.

Thanks for you support.

sophos_debug.zip
Cancel
Vote Up 0 Vote Down

Cancel
0 Kaushal Kansara 9 months ago in reply to Angelone

Hi Angelone

Thanks for sharing logs.

Please accept friend request so that i can DM.
Cancel
Vote Up 0 Vote Down

Cancel
0 Kaushal Kansara 9 months ago in reply to Kaushal Kansara

Hi Angelone ,

I have looked at the logs and observing that SFOS is retrying the connection with EU2 server. Although connections associated with given SFOS is not being seen on EU2 server.

Can we have a call to investigate this?
Cancel
Vote Up 0 Vote Down

Cancel