Sophos XG Firewall 16.01.1 on XG135 - Unable to run SSL VPN (Remote Access) - Please Help...

Question

Hello, 
 After configuring the VPN SSL client (as described into the documentation) our SSL VPN clients can't connect to the firewall: 
 Mon Nov 21 16:35:58 2016 TCP: connect to [AF_INET]x.x.x.x:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive. Mon Nov 21 16:36:03 2016 MANAGEMENT: >STATE:1479742563,RESOLVE,,,,,, Mon Nov 21 16:36:03 2016 MANAGEMENT: >STATE:1479742563,TCP_CONNECT,,,,,, Mon Nov 21 16:36:13 2016 TCP: connect to [AF_INET]x.x.x.x:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive. Mon Nov 21 16:36:18 2016 MANAGEMENT: >STATE:1479742578,RESOLVE,,,,,, Mon Nov 21 16:36:18 2016 MANAGEMENT: >STATE:1479742578,TCP_CONNECT,,,,,, Mon Nov 21 16:36:28 2016 TCP: connect to [AF_INET]x.x.x.x:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive. Mon Nov 21 16:36:33 2016 MANAGEMENT: >STATE:1479742593,RESOLVE,,,,,, Mon Nov 21 16:36:33 2016 MANAGEMENT: >STATE:1479742593,TCP_CONNECT,,,,,, Mon Nov 21 16:36:43 2016 TCP: connect to [AF_INET]x.x.x.x:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive. Mon Nov 21 16:36:48 2016 MANAGEMENT: >STATE:1479742608,RESOLVE,,,,,, Mon Nov 21 16:36:48 2016 MANAGEMENT: >STATE:1479742608,TCP_CONNECT,,,,,, 
 The firewall is behind a NAT router which forwards the traffic correctly (we tried to setup the tunnel from the LAN too without success). 
 As you can see the PCAP tool logs the 8443 port traffic from the VPN client 
 
 The configuration:

We tried to use a new self signed certificate too, but nothing changes... 
 
 Some additional info: 
 We changed the appliance LAN and WAN IP after the setup wizard. 
 The appliance is in HA mode. 
 
 Thank you for your help. 
 Stefano

sachingurung · Accepted Answer

Hi Stefano, 
 How is the network structured? Is there an adjacent network device to XG communicating with the internet? Provide us a network diagram. 
 Show us a picture of FW-rules for SSL VPN. On what port does SSL VPN is configured to communicate, any changes? 
 Remove the auxilliary appliance from HA and try to connect the SSL VPN, does that help ? 
 Thanks

Aditya Patel · Answer

HI Stefano27383, 
 I would need some more information on this issue. 
 Are you using External Authentication server or is the user local ? 
 After changing the settings on SSL , did you re-download the configuration file and import it ? 
 Is your WAN IP private or Public Address ? 
 Do you see the logs on Authentication for SSL connection. ?

sachingurung · Answer

Hi David, 
 VPN traffic will not be load balanced in HA. When a failover happens, the connection is handled by the standalone device that acts on the HA failure of the other device. I doubt that is the reason for IPSec tunnel to go down when switching from Active to Passive. Did support provide you an RCA? 
 Thanks