This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't access Admin GUI unless I SSH first

I have two home deployments of Sophos Firewall v20, one at home and one at a family vacation home. I've set up VPN, routes, and rules between without issue. But the strangest issue that I can't seem to resolve is that with the vacation home the Admin GUI on HTTPS port 4444 is inaccessible (no response) unless I SSH to the host first, then it's accessible just fine. I've poked around the rules everywhere and I can't seem to find anything that may affect this. This is true from ALL networks, local and remote. My only reliable way to connect to the GUI is via Sophos Central. I've gone as far as disabling all of my rules/VPNs/routes and using default configuration and it still isn't accessible without an initial SSH connection. Any thoughts as to what may be causing this?

Thanks,

Rich

This thread was automatically locked due to age.

Top Replies

Rich Grodzicki 7 months ago in reply to emmosophos +4 verified

I've tried accessing the device both remotely through my VPN as well as locally. However, I have solved the issue and it was my own doing. I had some advanced-firewall bypass-stateful-firewall-config…

0 emmosophos 7 months ago

Hello Rich,

Thank you for contacting the Sophos Community.

What type of IPsec tunnel are you using? Policy route or Route Base?

What is the output of if you are using Route Base cat /proc/net/xfrm_stat

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Rich Grodzicki 7 months ago in reply to emmosophos

Emmanuel,

I'm actually not using an IPsec tunnel as I was getting some terrible performance. However when I was using IPsec initially I was experiencing the same issue.

Rich
Cancel
Vote Up 0 Vote Down

Cancel
0 Bharat J 7 months ago in reply to Rich Grodzicki

Hi Rich Grodzicki ,

Can you re-configure IPSec VPN and check with tcpdump and drop packet capture.Tcpdump will put on right direction where to look as per the traffic flow for WebAdmin console issue with IPsec. Suspecting issue with MSS value.

OR

Check with SSL site-to-site option available if works.

Regards

"Sophos Partner: Networkkings Pvt Ltd".

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 apijnappels 7 months ago

How did you configure Administration -> Device access for HTTPS? Could you perhaps show a screenshot for that?

Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos 7 months ago in reply to Rich Grodzicki

Hello Rich,

Thank you for the follow-up.

So, how are you accessing the Devices?

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
+1 Rich Grodzicki 7 months ago in reply to emmosophos

I've tried accessing the device both remotely through my VPN as well as locally.

However, I have solved the issue and it was my own doing. I had some advanced-firewall bypass-stateful-firewall-config directives in place to mitigate some asymetric routing issues that were not configured properly. After removing those directives I was able to access the WebGUI just fine. I then recreated the directives properly (and more specifically) and things continue to work. It seems bypassing the stateful firewall for a subnet also bypasses the WebGUI. Strange that SSH'ing to the host re-enabled the WebGUI.

Thanks for trying to help!
Cancel
Vote Up +4 Vote Down

Cancel
0 emmosophos 7 months ago in reply to Rich Grodzicki

Hello Rich,

Thank you for updating the community on how you solved the issue.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel