Android + OpenVPN 3.4.0 + SSL VPN = No Traffic

Hello The G-Man ,

Thank you for reaching out to the community, this is known - NC-124753, it is fixed in v19.5 MR-4 (Already available now) and v20.0.1 MR-1.
VPN Enhancements: Sophos Firewall is now compatible with OpenVPN 3.0 clients. Users can download the compatible configuration file from the user portal.

Hello Vivek,

I am using v19.5 MR-4. I think you are confusing this with the 'route-delay 4' issue, which is different to this. That command is already removed in my config, did not resolve my issue.

okay, did you re-download the config once you made a global change in the ssl vpn settings ?
refer - When will SSL VPN users need to re-download the configuration ?

Hi Vivek,

Yes I did. I temporarily enabled "Compress SSL VPN traffic" that updates ovpn config 'comp-lzo yes' which allows the connection to work again. However I don't think this option is recommended (VPN compression vulnerabilities) and we also have Windows clients that I don't want to be affected when we download configs.

Hi Vivek,

Yes I did. I temporarily enabled "Compress SSL VPN traffic" that updates ovpn config 'comp-lzo yes' which allows the connection to work again. However I don't think this option is recommended (VPN compression vulnerabilities) and we also have Windows clients that I don't want to be affected when we download configs.

Hello there,

I could reproduce your issue temporarily after upgrading Open VPN to 3.4.0 and having compression enabled.

However, after disable Compression in the Sophos Firewall and disconnecting the OpenVPN connection from the mobile phone (after the automatic disconnect), I was able to Ping again.

I would recommend you to open a case if you are still facing the issue and especially if you are able to replicate it. 

Regards,

Emmo,

Can you please step this solution out step by step?

I have clients out in the field already with profiles downloaded, does the steps you have tried involve re-downloading profiles?

I have tried compression on and off again with no change to behaviour. My existing profiles have "comp-lzo no".

XGS2100.

Thanks,

Hello Hugh,

Originally, I was running an old version of OpenVPN, downloaded the configuration with Compress SSL VPN Traffic enabled in the Sophos Firewall, connected, and it worked.
Upgraded OpenVPN to 3.4.0, connected but I wasn’t able to Ping
In the Firewall, I disable Compress SSL VPN Traffic, and this automatically disconnected the SSL VPN user
After the client connected automatically again, I manually disconnected OpenVPN from the mobile phone
Connected again, and Ping started working

Regards,

Hi Emmanuel,

What you describe still requires re-downloading profiles which is not ideal if you have lots in the field. 

Is there not a fundamental issue here - if compression is already disabled on both the firewall and the client, why is the firewall pushing asymmetric compression? Disabled should mean disabled, and this problem should in theory not occur in the first place?

I have opened a support case: 07203703

Hello Greg,

As I mentioned, that worked for me, and I didn't re-download the configuration. 

Also, ask the end users to check that in OpenvPN under Settings > Advanced Settings > Lecagy is selected.

Thank you for the Case ID.

Regards,

Hi Emmanuel,

I just want to point out to others that may be reading that it worked for you because you downloaded your profile when Compress SSL VPN Traffic was enabled. This function sets comp-lzo to yes in the profiles. If it is disabled comp-lzo is set to no in the profiles, which I imagine will be the case for a lot of users that had already downloaded profiles months/years previously and had no issue until this point. For those users - they will have to re-download the profiles (or manually edit existing ones) for this workaround to function.

Further information on OpenVPN and deprecated compression here: https://community.openvpn.net/openvpn/wiki/Compression 

Sreenivasulu Naidu's post below advises a future solution will be looked at which will hopefully take this into account.

Sophos Firewall is still clearly pushing compression on connection, even though it is marked as disabled. 

We need a fix ASAP to stop the firewall pushing compression.

Hello Hugh,

In the meantime, you can follow the workaround shared by Naidu's "Compression should be turned ON and keep the 'Legacy' mode on OpenVPN Connect."

Hello Greg,

Thank you for pointing out the part where I downloaded the configuration previously once Compression was selected.

Regards,

Unfortunately this is not an option for me as all my exported profiles currently have 'comp-lzo yes' and I cant get my mobile clients to re-download profiles due to geographical restrictions