SSL VPN Network Access

When you say you "quickly setup" that SSL VPN, did you rely on the generation of "automatic firewall rules" ?

Maybe this firewall rule doesn't fit anymore? Since the automatic rules are generated at the bottom of the fw rules list, maybe above there is another rule overriding it?

As a last thing, you could delete this user's SSL-VPN configuration and use the SSL-VPN configuration assistant again.

When you say you "quickly setup" that SSL VPN, did you rely on the generation of "automatic firewall rules" ?

Maybe this firewall rule doesn't fit anymore? Since the automatic rules are generated at the bottom of the fw rules list, maybe above there is another rule overriding it?

As a last thing, you could delete this user's SSL-VPN configuration and use the SSL-VPN configuration assistant again.

I have not performed a TCPDump as mentioned but this is weird. So I made a temporary user about 3 months ago to get my staff person connected while in another country, worked perfectly. When he got back I simply Disabled the account. Since they are making another trip I thought I will make a proper account and called it "secureuser"  and set it exactly as the previous disabled account. The account authenticates no problem but can't access the network resources. This bugged me so decided to make the original account active and test, worked like a charm. Both users are in the same VPN Grouping that I use in the firewall rule, maybe for whatever reason, Groups don't work or there is a bug, I'm now curious if I list the users individually if they both will work.

Under Match Known users on the VPN rule I did add the new user and still didn't work. Flippin weird.

Hello,

I would recommend you to do a Packet Capture from the GUI to confirm what Firewall Rule the traffic is using; most likely, it is using a different firewall rule than you expect.

Regards,

Sounds very logical, how would I setup such a test on packet capture, would it be just looking at port 8443?

I would do
host 10.182.10.10  and proto ICMP
(substitute accordingly to the IP given to the client)
Then try a Ping to the network you are trying to access

Now I didn't run a packet capture but inspecting the logs and running a filter by tun0 all my users are using the correct FW rule and Nat Rule.

So I don't normally use the assistant, I simply create a new user withe same setup as working VPN users.

If I understand your problem correctly, this is your problem --- if you directly add the user to the SSLVPN policy, the netwrok resource access works fine but if you add a user to a group and then add the group to the policy, the network resource access does not work. If this understanding is correct, can you help answer these queries:

1) Which SFOS release are you running on your firewall ?
2) Is it a split tunnel or full tunnel ?
3) Can you login to the advanced shell of the firewall (ssh to firewall then enter 5 and then enter 3) and check the output of the following command:
cat /cfs/system/openvpn/conf.d/<username>

Replace the username with the name of the user you are testing with. If you are using split tunnel, can you check in the output if the IP/network of the network resource you are trying to access is present in the push route directives or not. Sample output:
cat /cfs/system/openvpn/conf.d/test
...
push 'route 192.168.2.0 255.255.255.255'
...

Actually I think I found the issue, I believe the issue is the SSL IP range, since it was created in v18 and this replacement firewall is on 19 , I actually created the IP subnet as it is supposed to be under v19. I am having my user test today.

That was the issue, I simply had to delete the range created in the earlier version and create the IP assignment as a subnet. Thanks to everyone who took the time to reply and help me resolve the issue.