This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

AP55 won't connect to Central through XGS (SFOS 19.0.1 MR-1-Build365) cause of TLS Handshake Failure

GGriese over 2 years ago

We try to register an AP55 to Sophos Wireless - works like a charm when working without the XGS

When connection the AP55 behind the XGS we always receive a Timeout and the log entry (SSL/TLS inspection):

wifi.cloud.sophos.com

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS handshake fatal alert: bad certificate(42).

sophos.com and all necessary other sites and ports are open and excluded from SSL/TLS inspection, equally sophos.com and all other necessary sites are allowed (i can see the log entry in the firewall log that access to wifi.cloud.sophos.com is allowed) but registration times out.

As we tried to connect without the XGS the AP has the actual updated firmware.

Any ideas which rules/exclusions to build and get the registration running?

THX

This thread was automatically locked due to age.

Top Replies

GGriese over 2 years ago in reply to PhilippRusch +2 verified

Thanks for that point We got them running - Problem was the FQDN-Configuration (allowing the APs to reach Central) - only some of them can be defined with wildcards (e.g.: *.prod.hydra.sophos.com works…

Parents

0 PhilippRusch over 2 years ago

Do you have Wireless Protection enabled on that XGS-system? You should disable XGS-Wireless when using Sophos Central Wireless, both won't work togehter in the same network.

Mit freundlichem Gruß, best regards from Germany,

Philipp Rusch

New Vision GmbH, Germany
Sophos Silver-Partner

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 GGriese over 2 years ago in reply to PhilippRusch

Wireless Protection is disabled
Cancel
Vote Up 0 Vote Down

Cancel
0 PhilippRusch over 2 years ago in reply to GGriese

Do you have the transparent webproxy in place?

Mit freundlichem Gruß, best regards from Germany,

Philipp Rusch

New Vision GmbH, Germany
Sophos Silver-Partner

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 GGriese over 2 years ago in reply to PhilippRusch

No, no web-policies in any fw-rule active

(We are migrating from UTM to xg and at the moment there is no user active, so no actual web-surfing ;)
Cancel
Vote Up 0 Vote Down

Cancel
0 PhilippRusch over 2 years ago in reply to GGriese

I was talking about the Proxy, which is configured under "Protect / Web / General settings"

Mit freundlichem Gruß, best regards from Germany,

Philipp Rusch

New Vision GmbH, Germany
Sophos Silver-Partner

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
+1 GGriese over 2 years ago in reply to PhilippRusch

Thanks for that point

We got them running - Problem was the FQDN-Configuration (allowing the APs to reach Central) - only some of them can be defined with wildcards (e.g.: *.prod.hydra.sophos.com works, but *.sophos.com won't work for wifilogs.sophos.com)

[FQDNS following this article Sophos Central Wireless: Network requirements]

Problem solved ;-)
Cancel
Vote Up +2 Vote Down

Cancel
0 LHerzog over 1 year ago in reply to GGriese

thanks for posting the solution.

I can confirm it happens from time to time, that Sophos' own FQDN hosts stop working and you need to allow the full FQDN (if possible) or move some sub-domain levels up - like going from *.sophos.com to *.prod.hydra.sophos.com.

community.sophos.com/.../central-accesspoints-offline-due-to-prod-hydra-sophos-com-fqdn-host-issue-since-18-5-mr4-and-also-in-19-0-mr1
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 LHerzog over 1 year ago in reply to GGriese

thanks for posting the solution.

I can confirm it happens from time to time, that Sophos' own FQDN hosts stop working and you need to allow the full FQDN (if possible) or move some sub-domain levels up - like going from *.sophos.com to *.prod.hydra.sophos.com.

community.sophos.com/.../central-accesspoints-offline-due-to-prod-hydra-sophos-com-fqdn-host-issue-since-18-5-mr4-and-also-in-19-0-mr1
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data