This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM 9.402-7 SSL VPN users no longer able to browse network

We have an SG-210 that I updated from 9.355-1 to 9.402-7, and now our SSL VPN users can no longer browse our network via IP address or computer name. The users are able to connect to the firewall and obtain an IP address, and there are no errors in the logs. Has something changed with how SSL VPN users are handled?

Any help would be appreciated; it's very important that our remote people can connect to our network shares.

Thanks.

This thread was automatically locked due to age.

0 DanielGalvan over 8 years ago

We had the same issue when we upgraded to 9.402-7. Support advised me that this is a known issue. They are rolling out a fix in the next release. The issue has to do with the clients not receiving the correct route. They were to provide a workaround by editing the openvpn server config and adding the route to my LAN. Unfortunately it broke other profiles, but I am able to connect and browse the LAN. Hope this helps!
Cancel
Vote Up 0 Vote Down

Cancel
0 MasonWebster over 8 years ago in reply to DanielGalvan

Ok, thanks. I got it working for one of the accounts that was on the VPN allow list twice, once from an AD group and then again by their specific username. Having the user on there twice didn't bother it before, but once I removed the user's name from the list, leaving only the AD group, and re-downloaded the config file, it started working again.
Cancel
Vote Up 0 Vote Down

Cancel
0 bendeichp over 8 years ago in reply to DanielGalvan

Hi Daniel,

can you explain the issue in detail? Is there a KB article?
Unfortunately we experienced a very similar effect. After upgrading to 9.402007 all SSL VPN Clients can login, but no ping to the company net or other connections are possible.

In the Client logfile it looks good on the first sight but the last entry says:

Mon May 23 08:47:53 2016 Initialization Sequence Completed With Errors ( see openvpn.net/faq.html )
Mon May 23 08:47:53 2016 MANAGEMENT: >STATE:1463986073,CONNECTED,ERROR,1.2.3.4,5.6.7.8

Any hints or any help is appreciated.

Thanks,
Pascal
Cancel
Vote Up 0 Vote Down

Cancel
0 twister5800 over 8 years ago

Try this :-)

https://community.sophos.com/products/unified-threat-management/f/52/t/77374

-----

Best regards
Martin

Sophos XGS 2100 @ Home | Sophos v20 Technician
Cancel
Vote Up 0 Vote Down

Cancel
0 Akisu over 8 years ago

We had a similar problem.

After some checks we figured out, that a SSL client gets too many routes pushed. We had inside the SSL configuration several allowed Groups and Users. The connecting SSL client gets all routes pushed for every participation in a allowed Group. By removing all the allowed Groups and just adding the Users a single time the problem was solved.
Cancel
Vote Up 0 Vote Down

Cancel
0 DanielGalvan over 8 years ago in reply to bendeichp

Sophos support and the change log state that 9.403-4 resolves the issue by pushing the LAN route to the clients. But honestly I am afraid to update after reading someones comments about his UTM box being unresponsive after performing this update.
Cancel
Vote Up 0 Vote Down

Cancel
0 DanielGalvan over 8 years ago in reply to DanielGalvan

went ahead and pulled the trigger, all seems to be operating well! The VPN no route issue is gone.
Cancel
Vote Up 0 Vote Down

Cancel