Sophos FW Unable to download ssl vpn configuration after v20 update

Hi Firat K  - We will check this issue on Tuesday. In the mean time, can you also share the access-id of the device to take a look at the config ?

CC - Ranjith N  and PRANEETH Kumar 

Hello, thank you very much,

Can't get id also. No problem with the internet connection, (except sophos services i think)

HI Firat K ,

Currently i am looking into Access ID issue.

Can you please share uma.log from /log dir in one on one to investigate why access id is not generated?

Also provide output of following commands executed via backend of SFOS.

nslookup eu2.apu.sophos.com

traceroute eu2.apu.sophos.com

ping eu2.apu.sophos.com ( APU server will not respond to ping request although, i would like to check dns resolution) 

While Kaushal is taking a look at the access id related problem, can you

- try to re-download the patterns and share the /log/u2d.log. This will give us insights if theres a problem with downloading the patterns.

The pattern update must go through for successfully downloading the sslvpn config file.

I Tried with no success.

Hi Firat, 

Pattern download for sslvpn had failed; same is seen with other patterns as well. This need to be fixed first.

On your SFOS, Network->DNS-> DNS host entry - check the ip address of u2d servers configured here (ex: u2d.sophos.com) and see if you are able to ping these ip addresses from the SFOS's CLI. Or check nslookup of the u2d hosts configured.

Hi Firat, 

Pattern download for sslvpn had failed; same is seen with other patterns as well. This need to be fixed first.

On your SFOS, Network->DNS-> DNS host entry - check the ip address of u2d servers configured here (ex: u2d.sophos.com) and see if you are able to ping these ip addresses from the SFOS's CLI. Or check nslookup of the u2d hosts configured.

Thank you for your reply, there is no dns host entry. should i write them? (i tried to ping u2d.sophos.com with no reply)

Pls do below on your SFOS

nslookup xg-up2date-patterns.sophosupd.com    

// use below command to manually download sslvpn_1.02_1.0.009.tar.gz.sig and look at the details printed on the console

curl xg-up2date-patterns.sophosupd.com/sslvpn_1.02_1.0.009.tar.gz.sig -O -v

// if the download is successful, check md5 of the downloaded file and it should match with the below md5

md5sum sslvpn_1.02_1.0.009.tar.gz.sig

44cb69ce7284316227eecad1babf3db8  sslvpn_1.02_1.0.009.tar.gz.sig

If there are issues with the download, check if dns service is running on SFOS

service -S | egrep 'bind|dnsd'

dnsd                 RUNNING

Or you can DM me, we can take a look at your SFOS over Zoom/Teams call.

Hi Firat K 

Please share the whole file uma.log if possible.

Also provide hostname of device.

Please accept  friend request so i can DM you as well.

From the screen shot, i can see that following logs, which looks like it is successful.

"2023-12-25-13:32:17Z uma[28993]:    info Control tunnel established (pid:11589)"

Can we have a Zoom/Teams call?

Please suggest suitable time.

Hi Firat K ,

Thanks for sharing system ID of device.

As mentioned in DM, i have analysed eu2.apu.sophos.com server logs and was looking for system id shared.

Although , i could not found any request coming from current device.

Which means, device might not be able to reach to eu2.apu.sophos.com due to local restriction.

Can we have a Zoom/Teams call?

It seem to be a country specific packets being blocked that causes SFOS unable to reach up2date servers; if up2date servers are not reachable, the pattern updates fail for sslvpn templates and config generation fails. Same behaviour is seen with APU access where the packets are not reaching the server. This is not anything related to v20.