Sophos Connect 2.3 with disabled IPv6 component

- upgraded our Windows Connect Clients from 2.2.9 to 2.3
- when now connecting with SSL VPN:

The client is connected (all is working) but the state in Sophos Connect will not switch to connected and stays in "is connecting"... -> not possible to disconnect anymore.

Client Log:

(...)
2024-05-17 09:32:30 add_route_ipv6(::/1 -> 2001:db8:: metric -1) IF 4
2024-05-17 09:32:30 ERROR: route addition failed using service: Element nicht gefunden. [status=1168 if_index=4]
2024-05-17 09:32:30 add_route_ipv6(8000::/1 -> 2001:db8:: metric -1) IF 4
2024-05-17 09:32:30 ERROR: route addition failed using service: Element nicht gefunden. [status=1168 if_index=4]
2024-05-17 09:32:30 add_route_ipv6(::/3 -> 2001:db8:: metric -1) IF 4
2024-05-17 09:32:30 ERROR: route addition failed using service: Element nicht gefunden. [status=1168 if_index=4]
2024-05-17 09:32:30 add_route_ipv6(2000::/4 -> 2001:db8:: metric -1) IF 4
2024-05-17 09:32:30 ERROR: route addition failed using service: Element nicht gefunden. [status=1168 if_index=4]
2024-05-17 09:32:30 add_route_ipv6(3000::/4 -> 2001:db8:: metric -1) IF 4
2024-05-17 09:32:30 ERROR: route addition failed using service: Element nicht gefunden. [status=1168 if_index=4]
2024-05-17 09:32:30 add_route_ipv6(fc00::/7 -> 2001:db8:: metric -1) IF 4
2024-05-17 09:32:30 ERROR: route addition failed using service: Element nicht gefunden. [status=1168 if_index=4]
2024-05-17 09:32:30 Initialization Sequence Completed
2024-05-17 09:32:30 MANAGEMENT: >STATE:1715931150,CONNECTED,ROUTE_ERROR,192.168.50.6,[SSL VPN Gateway IP],443,,,2001:db8::5

- we have the problem on ANY our clients

Edited TAGs
[edited by: emmosophos at 4:53 PM (GMT -7) on 22 May 2024]

Top Replies

LuCar Toni 29 days ago in reply to K-M +3 verified

There was a KB released for this situation: https://support.sophos.com/support/s/article/KB-000046098?language=en_US

0 Giridhar Katti 1 month ago
Hi Quallensaft - Can we get the tsr(technical support report). Install the SCC 2.3, go to "About" page, there's generate technical support report button, it generates the scvpntsr.zip file. Please share that for further investigation.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Quallensaft 1 month ago in reply to Giridhar Katti

I could reproduce the issue and found the reason. On the computer the IPv6 component was disabled via the following registry key:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters -> DisabledComponents -> 255 (Hex FF)

Seems the 2.3 client is not (anymore) compatible with disabled IPv6 component on Windows.
Cancel
Vote Up +2 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni 1 month ago in reply to Quallensaft

So i have IPv6 disabled with the checkbox in Windows itself:

I assume you used the registry for management reasons?

https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows

This issue comes up, as you disabled IPv6 also for the TAP Interface.

So could you try the: "Disable IPv6 on all nontunnel interfaces" option instead? This should leave IPv6 enabled on the tap interface and get you the same outcome.

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Quallensaft 1 month ago in reply to LuCar Toni

The checkbox does not the same (IPv6 is still enabled). For "real" disable v6 stack in Windows you have to use the registry.
Also the checkbox has no impact on connect (but only tested the non-vpn interfaces) -> still working in 2.3, so no problem.

From my side it is no problem anymore. We disabled v6 because of some DNS issues with dual-stack in the past, we enabled the v6 stack again (no need to disabled it anymore) and it is also working with 2.3 now.

Maybe some other customers also use the registry to complete disable the v6 stack in Windows. But it's up to Sophos to fix this.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 K-M 1 month ago in reply to Quallensaft

yep, exactly. Microsoft also tells you to use the registry key...

thanks for clarifying, we are using the key, too. So we could get problems. Is there an ID for it and can you subscribe us to it?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Quallensaft 1 month ago in reply to K-M

If you have complete disabled the v6 stack, you WILL get the problem we had. The DEV-team is working on it -> ID is 07358965

As LuCar Toni mentioned you can also try set the registry key to (not tested with 2.3):

Disable IPv6 on all nontunnel interfaces Decimal 16
Hexadecimal 0x10
Binary xxx1 xxxx
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Cancel
0 emmosophos 30 days ago

Hello Community,

This is now being investigated under NCL-1845

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Cancel
0 K-M 29 days ago in reply to emmosophos

Will you keep it updated here?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Vivek Jagad 29 days ago in reply to K-M

Yes we'll K-M ...

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Global Support & Services

Log a Support Case | Sophos Service Guide
Best Practices – Support Case

Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
+1 LuCar Toni 29 days ago in reply to K-M

There was a KB released for this situation: https://support.sophos.com/support/s/article/KB-000046098?language=en_US

__________________________________________________________________________________________________________________
Cancel
Vote Up +3 Vote Down

Sign in to reply

Reject Answer

Cancel