This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN Client can connect but no traffic is generated to VPN zone

Hi all,

I was able to use SSL VPN properly with Sophos XG v19. Now I've upgraded to v20 and I'm experiencing issue with SSL VPN.

To setup the SSL VPN I followed this guide: https://techvids.sophos.com/watch/wtqMJE1La6TkFjAiaT2d3H

I draw a network scheme to better explain how the network is configured:

I'm using an iPhone with OpenVPN installed as a client. It can connect and authenticate properly, the OpenVPN iPhone app shows that XG assigned the IP 10.10.70.1

I've a firewall rule that allow traffic from VPN to DMZ,WAN and LAN:

In the firewall log I can't see any traffic generated through the VPN, traffic flows regularly into the XG on port 8443 (I've check with tcpdump ssh-ing into XG firewall).

I've also tried to attach a Linked NAT rule to Masquerade (MASQ) all traffic that comes from VPN zone. The client can't reach any DMZ hosts neither any internet host (I would like to use the VPN as the default gateway).

Can anyone help me to solve this issue?

Thanks in advance

This thread was automatically locked due to age.

Top Replies

Sreenivasulu Naidu 9 months ago in reply to Angelone +2 verified

With legacy mode (Settings -> Advanced settings -> Security level in Openvpn conect client on iOS), traffic is passing through the sslvon ra tunnel and able to reach the DMZ hosts. This is the behaviour…

0 Sreenivasulu Naidu 10 months ago in reply to Kaushal Kansara

Hi @Angelone, for the sslvpn ra traffic issue, we can take a look at your setup in a joint debug over a call. Please DM me (sreenivasulu.naidu@sophos.com). From the attached logs, there is no sslvpn.log, traffic issues could not be figured out from this log. When you are seeing traffic on port 8443, just do a tcpdump on tun0 (assuming you are using XG and not XGS), if you see packets on tun0 (on XG), this is unencrypted packet, see the packet is routed correctly to your host on DMZ and verify the return path of the packet.
Cancel
Vote Up 0 Vote Down

Cancel
0 Angelone 10 months ago in reply to Sreenivasulu Naidu

Hi Sreenivasulu Naidu and Kaushal Kansara , we can schedule a call with pleasure. I'm going to DM rigth now.

Thanks for your valuable support
Cancel
Vote Up 0 Vote Down

Cancel
+1 Sreenivasulu Naidu 9 months ago in reply to Angelone

With legacy mode (Settings -> Advanced settings -> Security level in Openvpn conect client on iOS), traffic is passing through the sslvon ra tunnel and able to reach the DMZ hosts. This is the behaviour seen in v19.x and in v20.
Cancel
Vote Up +2 Vote Down

Cancel
0 DanielGM 9 months ago

Hello community,

I'm facing the same issue as Angelone. After upgrading my Sophos XG Firewall to v20, my VPN SSL clients using the OpenVPN app on Android devicescan no longer communicate with the network.

The VPN clients successfully authenticate and receive an IP address but cannot access network resources. No configuration changes were made on the clients or firewall after the upgrade.

I've tried restarting the VPN service and OpenVPN app on the devices, but the issue persists.

Could you please advise if there's a known configuration adjustment required for OpenVPN clients or the Sophos firewall after upgrading to v20?

Any help would be greatly appreciated.

Thanks in advance!
Cancel
Vote Up 0 Vote Down

Cancel
+1 LuCar Toni 9 months ago in reply to DanielGM

Are you affected by this? Sophos Firewall: Temporary Fix OpenVPN (3.4.0) No Compression (Android Devices)

__________________________________________________________________________________________________________________
Cancel
Vote Up +2 Vote Down

Cancel
0 Giridhar Katti 9 months ago in reply to DanielGM

What's the OpenVPN version you are using ? Could you check if the below link from Lucar helps ?
Cancel
Vote Up 0 Vote Down

Cancel
0 DanielGM 9 months ago in reply to LuCar Toni

Hi LuCar Toni ,

I confirmed that I'm affected by the OpenVPN 3.4.0 version. I tested on an older Android device without the update, and it worked perfectly.

I downgraded to OpenVPN version 3.3.4, and the issue was resolved.

Thank you for your quick and helpful reply. Have a nice weekend!
Cancel
Vote Up 0 Vote Down

Cancel
0 DanielGM 9 months ago in reply to Giridhar Katti

Hi Giridhar Katti ,

Yes the Lucar's link help me to understand and solve the issue.

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel