Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

  • Site to site VPN to a vendor site with the same subnet at both ends

    Hello all, we are looking at a situation where we need to set up a site to site VPN to a vendor who is using a Fortigate gateway, and the same subnet is being used at both ends. I have reviewed the below link which covers this situation for Sophos to…
  • XFRM showing 'not configured' after public IP changes on spoke

    Hello, we are currently using Sophos Firewalls in a Hub-and-Spoke topology running SFOS 20.0. Some spokes are using WAN connections with dynamic IPs which will change from time to time. On those units we can observe that the corresponding XFRM interface…
  • Sophos XGS IPESEC to Fortinet Firewall

    Hello, We are having problems establishing an IPSEC tunnel between an XGS and a Fortigate firewall. Currently we receive the message “IKE SA proposals don't match. Check the phase 1 policy settings on both devices: IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5…
  • Disable IPSEC Anti Replay Protection SFOS v20

    Hello, Im trying to test out Cloudflare magicwan and the guide says to disable ipsec anti replay protection. The guide shows a command for sfos v19 however this doesn't seem to exist in v20. The command is: set vpn ipsec-performance-setting anti…
  • Sophos XGS IPSEC PSK and remote ID issue

    Hello, we have set up several Policy Based IPSEc tunnels. These have different remote gateways, but some of them have the same remote IDs. Some connections crash after a certain time. Could this be due to the PSK in conjunction with the remote ID? As…
  • XG230 to RED-SDRED

    Hello, good day, I hope you can help me, I have the following problem. We have an XG230 that manages 10 RED15W, 1 RED50, and 3 SD-RED60, along with this firewall (XG230) a Fortinet brand firewall was implemented, but it is expected that both firewalls…
  • Network concept considerations

    Hello Sophos Community, I am a Sophos beginner and have questions regarding the options for site connection via REDs or site-to-site VPN, as I have no practical experience here. What are my requirements? The idea is to connect 3 locations, whereby…
  • CVE-2020-20813

    Hello, I verified that my Sophos XGS SFOS 20.0.0 GA-Build222 has OpenVPN 2.4.7 which is vulnerable to CVE-2020-20813 which according to NIST has a high level. As I use SSL VPN for remote access, I need to know if my firewall is vulnerable. Best Regards…
  • Trouble routing a packet from site A via site B to site C (with SNAT)

    I have something strange for the following situation. VPN connection between site A and site B (tried both policy-based and route-based) and a policy-based VPN-connection between site B and site C. Intention is to reach site C from site A while there…
  • User Authentication over S2S IPSec VPN

    We have currently have two locations, each with a XG330 v19.5.4 MR4 and an EPL fiber connection between them that has a S2S IPSec tunnel setup and a static route on both ends pointing to the other. Each FW is setup with the local DC for user authentication…
  • SSL VPN Pattern upgrade to 17.5.15

    Dear Support, If having XG210 ( SFOS 17.5.15 MR-15 ) with SSL VPN pattern current version ( 1.0.008 - 05:32:30, Sep 11 2020) Using the web interface, can a manual pattern upgrade to the version ( sslvpn_1.02_1.0.009.tar.gz.sig ) occurs without any…
  • Sophos XG : NET::ERR_CERT_COMMON_NAME_INVALID

    HI all, Hoping you can help. Recently an external website we access has been updated and hosted elsewhere. Following the move we now get the following error but only when connecting via the VPN (Remote access). We can browse to the site without issue…
  • XGS - SSL VPN not working from neighbouring WAN IP (hosted offices)

    Hi I have customer with SSL VPN working fine 99% of the time. However users cannot connect from the same WAN subnet. Ie say the WAN IP of the XG is 85.85.12.5/27 If a user tried to VPN from anoter network which is on the same ISP (ie 85.85.12…
  • What's the impact of DNS settings in General SSL VPN settings

    Hi, I've deployed doznes of SSL VPN clients, having DNS set to on-premises AD LAN DNS server 10.1.1.10 in General SSL VPN settings for all clients. Now when client with laptop connects to SSL VPN, I can see his/her default DNS resolving goes through…
  • Site2Site IPSec VPN with both endpoints only IPv6

    Hello, I want to setup a S2S IPsec VPN between our Head office and Branch Office. The branch office has only IPv6. I have setup on btoh side the S2S VPN, but i cant get it to connect. And i even dont see any connection trys in the logs. For all other…
  • Sophos XGS time based VPN

    Hallo, how is it possible to control the IPSEC Remote VPN Access time-based on the XGS, so that the users can only establish a connection at certain times? Thank You!
  • IPSEC Failover for LAN Gateway

    I don't know if this is the right configuration so bear with me. I have a connection that essentially functions as a direct ethernet line back to the main office, called an EPLAN. It is set up in my Branch Office in the LAN zone. Everything works OK…
  • Sophos Connect 2.3 MR1 iPSec DNS problems but SSL OK

    Hi there, After the firmware update to SFOS 20.0.1 MR-1-Build342, we have rolled out the Sophos Connect Client v2.3.1. It turns out that DNS resolution does not work with IPsec. It looks like the wrong DNS servers are being entered here (ipv6). With SSL…
  • No option for downloading SSL VPN configuration on Sophos XGS2300 user portal

    Hi. I just recently changed my SSL User account on Sophos, and after that, I can not access Sophos through SSL VPN and receive "received connection reset from gateway" on the Sophos connect client. When I log in to the user portal to download the new…
  • Can't access servers after expanding network over IPsec

    Hi Everyone, I can't figure out why can't I access any of my servers over VPN (IP Sec) after expanding my network from /24 to /22 I'm running SFOS 20.0.1 MR-1-Build342 Here's my setup: Before network expansion Network, LAN Zone, IPv4/netmask…
  • IPSec MOBIKE IKEv2 extension disabling

    How can I disable MOBIKE IKEv2 extension support in IPSec?
  • SSL VPN connection reset by Gateway

    Hi, i have the same Probleme like mentioned here Not able to connect SSL VPN but i am not able to find the setting he has changed in the xgs menu. ( i did already all Troubleshoot steps, even have compared all settings with another xgs device…
  • RED Interface Question

    At our main site we have two Sophos XGS3100 in a highly available (active/passive) configuration. At a second site we have a single Sophos XGS 2100. On our Sophos XGS3100 we have a RED interface for a Sophos SD RED60 at a third site in a Standard…
  • Route based SSL-VPN problem

    Hello everyone and thanks in advance for your support. We have a person 192.168.1.X who connect to OUR network (192.168.0.0/16) via SSLVPN (Use tunnel as default gateway or not, doesn't make any difference) Sometimes things go wrong randomly (i…
  • How to clear IPSEC VPN SA via CLI on Sophos XGS?

    Hi, is it possible to clear single IPSEC VPN security associations via Device Console or Advanced Shell on Sophos XGS? E.g. I would like to disconnect all VPNs to one specific gateway. Thank you. Greetings, Torsten