Thread Info
  • State Verified Answer
  • +3 person also asked this people also asked this
  • Locked Locked
  • Replies 12 replies
  • Answers 2 answers
  • Subscribers 8 subscribers
  • Views 12128 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cisco VPN Client not route after update 9.409-9

tcassano

Hi,

i have updated my Sophos UTM SG310 to the version in subject.

Before i did the update I could get access on every network devices over Ipesc Cisco with the iPhone of my company.

Now after the update I'm not able to do it anymore.

The Connecting and the authentication are ok (VPN Connected) but I can't ping any device on any network (Request timeout).

SSL and PPTP works fine.

 

Can somebody help me about this issue ?

 

Tommaso

 



This thread was automatically locked due to age.
  • 0

    Hi Tomasso,

    Does #1 in Rulz give any hints?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0

    This latest update 9.409-9 also caused some issue on my VPN connection. However, I did solve it at last.

     

    This is what I did.

     

    Go to Network Protection - Firewall - Advanced turned off Block invalid packets

     

    Then go to Management - Backup/Restore & restore my configuration to 9.408-4.

     

    I'm not sure what is going wrong with this new firmware 9.409-9 but this is how I solve my VPN connection issue. You may give it a try if still can't get it solve. Hope can help.

  • 0

    Hi Tommaso,

    Try the suggestion made by Alex and let us know if that helps. It is reported as a BUG in the latest version under the ID NUTM-6375.

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0 in reply to BAlfson

    Hi bob,

    the VPN connection is establishing and I didn’t see error on firewall logs. Everything looks working but i can't ping or browser my network.

    I thing that is a bug because I saw other reports in the community with the same issue.

    I'll try the suggestion made by Alex and let you know if it works.

    Thank you all to your support.

    Tommaso

  • 0 in reply to tcassano

    Hi,

    I observe same/similar problem.

    I am trying to setup Cisco vpn client access between my UTM 9.409-9 (running in a VM on a machine behind a Fritzbox)

    and my iPhone S6.


    IPSec SA is established but ping traffic is dropped.

    When I use use 'cat /proc/net/xfrm_stat' I see the counter 'XfrmInStateProtoError' increasing.

    Do you know what that counter means?

     

    I also dumped the traffic following the instructions here:

    https://community.sophos.com/kb/de-de/116179

    I can see the decrypted icmp packets as expected. Only strange thing in the wireshark analysis:

    Under Encapsulating Security Payload I find

             --> 'Authentication Data [incorrect, should be ....]'

    I am not sure though whether this is the cause or whether I put the wrong information in field  'Authentication key' of wireshark. The instructions say: 

    • Authentication key: enter the preshared key used to encrypt the tunnel. Eg. test

    I do not use preshared key. I use certificates. Do you know which value should be used in that case for the Authentication key?

     

    Thanks and BR,
    Michael

     

  • 0 in reply to MichaelAbels

    Hi,

    in the meantime I found out where to look for the session authentication keys. I use "ip xfrm state" to read them.

    When applying these keys to wireshark the authentication works fine.

    So in summary it seems SAs are correct but still traffic is dropped!?

    BR,
    Michael

     

  • 0 in reply to MichaelAbels

    Pinging is regulated on the 'ICMP' tab of 'Firewall'.  Note that the "Any" service includes only TCP and UDP.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to sachingurung

    Hi sachingurung,

    I tried the suggestion of Alex whitout any success. In the firewall log I don't see any drop packet from my connection. In the IPSec VPN log I've only seen the following error:

    ------
    executing down-client: 2>&1 PLUTO_VERSION='1.1' PLUTO_VERB='down-client' PLUTO_CONNECTION='D_for MYNAME to Internal (Network)-1' PLUTO_NEXT_HOP='PUBLIC IP ASSIGNED TO MY DEVICE' PLUTO_INTERFACE='eth1' PLUTO_REQID='16817' PLUTO_ME='PUBLIC-IP-OF-MYCOMPANY' PLUTO_MY_ID='example.com' PLUTO_MY_CLIENT='MYLANIP/23' PLUTO_MY_CLIENT_NET='MYNETIP' PLUTO_MY_CLIENT_MASK='255.255.254.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_PEER='PUBLIC IP ASSIGNED TO MY DEVICE' PLUTO_PEER_ID='C=it, L=Limbiate (MI), O=AM Instruments Srl, CN=Tommaso Cassano, E=MYEMAIL' PLUTO_PEER_CLIENT='MY-LOCAL-VIRTUAL-IP/32' PLUTO_PEER_CLIENT_NET='MY-LOCAL-VIRTUAL-IP' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=it, L=Limbiate (MI), O=AM Instruments Srl, CN=AM Instruments Srl VPN CA, E=@' /usr/libexec/ipsec/updown classic
    2017:01:02-09:54:34 fw-2 pluto[1928]: "D_for MYNAME to Internal (Network)-1"[2] PUBLIC IP ASSIGNED TO MY DEVICE:14061 #8: ERROR: netlink response for Add SA esp.9a04d59a@PUBLIC-IP-OF-MYCOMPANY included errno 22: Invalid argument
    2017:01:02-09:54:34 fw-2 pluto[1928]: | NAT-T: new mapping PUBLIC IP ASSIGNED TO MY DEVICE:14031/14061)
    2017:01:02-09:54:34 fw-2 pluto[1928]: "D_for MYNAME to Internal (Network)-1"[2] PUBLIC IP ASSIGNED TO MY DEVICE:14061 #8: ERROR: netlink response for Add SA esp.9a04d59a@PUBLIC-IP-OF-MYCOMPANY included errno 22: Invalid argument
    2017:01:02-09:54:34 fw-2 pluto[1928]: "D_for MYNAME to Internal (Network)-4"[2] PUBLIC IP ASSIGNED TO MY DEVICE:14061 #7: received Delete SA(0x00f67c8c) payload: deleting IPSEC State #8
    ------
     
    Other than that, everything looks good and also the routing table are correcty created.
     
    It seems that my connection ends up in a black hole :-)
     
  • 0 in reply to BAlfson

    Hi Bob,

    I enabled all of the ICMP traffic.

    Anyway I guess the decrypted packet is not even reaching the firewall. It is dropped
    by IPSec beforehand as indicated (I think) by the xfrm statics counter. 

    BR,
    Michael

  • 0 in reply to MichaelAbels

    ...and one addition: In my VPN setup logs I do not see any Errors.

    Thanks & Happy new year,
    Michael

Unfiltered HTML