Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • Replies 29 replies
  • Subscribers 34 subscribers
  • Views 64671 views
  • Users 0 members are here
Options
Suggested

Sophos Firewall: SSL VPN "IPv4 lease range" changes OR global settings update gives error "You must enter a network IP address." in SFOS v19.

Alok

Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.

Overview

This Recommended Read reviews recent changes made in SFOS v19 related to SSL VPN IPv4.

What is the change in SFOS v19 related to the SSL VPN IPv4 lease? 

SFOS v19 improves supported SSLVPN concurrent tunnels by 4-5x. 

As a result, there’s a change in the configuration of SSL VPN IPv4 lease range. SFOS v19 uses IP subnet value; however, earlier versions used IP range and subnet. 

 Migration will convert the IP range and subnet config from old versions to subnet values in v19. 

 SSLVPN Global config: 

Admin has to update IP lease range from IP address to subnet once after migration to avoid errors like "You must enter a network IP address." on global settings update.

Does the change impact me? What issue may I face? 

On upgrading to SFOS v19, some users may notice that SSL VPN is connecting, but resources aren’t accessible over SSLVPN for the following conditions: 

  • If you’re using SSL VPN before the v19 version and 
  • If you have allowed access of SSLVPN users using IP host object of limited range (same as SSLVPN global settings) in the firewall rule. 

As v19 changes the limited IPv4 lease range to the larger subnet, users with IP addresses outside the limited range will be restricted by Firewall rules to access the resources. 

How do we resolve this issue? 

Update the IP host object of limited range to include the new IP range (subnet). 

Alternatively, you can use the system host available for SSLVPN IPv4 lease ##ALL_SSLVPN_RW. 

More details on Configure IPsec remote access VPN with Sophos Connect client



Updated links to latest
[edited by: Raphael Alganes at 2:23 PM (GMT -8) on 19 Nov 2024]
Parents

  • Why is it that /24 is the smallest network that this supports now? I actually need to insure that my clients do not exceed the /27 on assignment as they are accessing a network that restricts us to that /27.

  • in reply to Cameron Savage1

    Just to provide more context around why we brought this changes in, from v19 to improve scale and performance we have made SSLVPN multi-instance up to 8 depends upon no of CPUs. With this changes each instance will create “tun” interface and it will require individual subnet to handle traffic distribution and routing internally. To avoid the user input complexity  we do slicing of subnet internally from the configured IP value.

     In case if you have 192.168.0.0/27 configured in v18.5 and migrates to 8 instance config in v19,  it won’t have much usable hosts as below:

    Hope this helps.

Reply
  • in reply to Cameron Savage1

    Just to provide more context around why we brought this changes in, from v19 to improve scale and performance we have made SSLVPN multi-instance up to 8 depends upon no of CPUs. With this changes each instance will create “tun” interface and it will require individual subnet to handle traffic distribution and routing internally. To avoid the user input complexity  we do slicing of subnet internally from the configured IP value.

     In case if you have 192.168.0.0/27 configured in v18.5 and migrates to 8 instance config in v19,  it won’t have much usable hosts as below:

    Hope this helps.

Children
  • in reply to Alok

    so in this scenario you'll lose up to 50% of the available IPs, and when you count them in the DHCP leases on XG, you'll find yourself with 16 IPs leased while you configured a range with 32 IPs.

    Sound's like a nightmare to debug.

    where is that doc change you were mentioning above? I could not find it in the interactive release notes today.

  • in reply to LHerzog

    We are talking about "smallest" Network. If you are concern about the range, you can pump this value up to higher values without no problem. And DHCP works not like that in SSLVPN. Essentially SSLVPN works with Pools, you can see here. Not with DHCP Lease Ranges. See Documentation of OpenVPN. 

    __________________________________________________________________________________________________________________

Unfiltered HTML