Thread Info
  • State Verified Answer
  • +3 person also asked this people also asked this
  • Locked Locked
  • Replies 12 replies
  • Answers 2 answers
  • Subscribers 8 subscribers
  • Views 12132 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cisco VPN Client not route after update 9.409-9

tcassano

Hi,

i have updated my Sophos UTM SG310 to the version in subject.

Before i did the update I could get access on every network devices over Ipesc Cisco with the iPhone of my company.

Now after the update I'm not able to do it anymore.

The Connecting and the authentication are ok (VPN Connected) but I can't ping any device on any network (Request timeout).

SSL and PPTP works fine.

 

Can somebody help me about this issue ?

 

Tommaso

 



This thread was automatically locked due to age.
Parents
  • 0

    Hi Tomasso,

    Does #1 in Rulz give any hints?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi bob,

    the VPN connection is establishing and I didn’t see error on firewall logs. Everything looks working but i can't ping or browser my network.

    I thing that is a bug because I saw other reports in the community with the same issue.

    I'll try the suggestion made by Alex and let you know if it works.

    Thank you all to your support.

    Tommaso

  • 0 in reply to tcassano

    Hi,

    I observe same/similar problem.

    I am trying to setup Cisco vpn client access between my UTM 9.409-9 (running in a VM on a machine behind a Fritzbox)

    and my iPhone S6.


    IPSec SA is established but ping traffic is dropped.

    When I use use 'cat /proc/net/xfrm_stat' I see the counter 'XfrmInStateProtoError' increasing.

    Do you know what that counter means?

     

    I also dumped the traffic following the instructions here:

    https://community.sophos.com/kb/de-de/116179

    I can see the decrypted icmp packets as expected. Only strange thing in the wireshark analysis:

    Under Encapsulating Security Payload I find

             --> 'Authentication Data [incorrect, should be ....]'

    I am not sure though whether this is the cause or whether I put the wrong information in field  'Authentication key' of wireshark. The instructions say: 

    • Authentication key: enter the preshared key used to encrypt the tunnel. Eg. test

    I do not use preshared key. I use certificates. Do you know which value should be used in that case for the Authentication key?

     

    Thanks and BR,
    Michael

     

  • 0 in reply to MichaelAbels

    Hi,

    in the meantime I found out where to look for the session authentication keys. I use "ip xfrm state" to read them.

    When applying these keys to wireshark the authentication works fine.

    So in summary it seems SAs are correct but still traffic is dropped!?

    BR,
    Michael

     

  • 0 in reply to MichaelAbels

    Pinging is regulated on the 'ICMP' tab of 'Firewall'.  Note that the "Any" service includes only TCP and UDP.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi Bob,

    I enabled all of the ICMP traffic.

    Anyway I guess the decrypted packet is not even reaching the firewall. It is dropped
    by IPSec beforehand as indicated (I think) by the xfrm statics counter. 

    BR,
    Michael

  • 0 in reply to MichaelAbels

    ...and one addition: In my VPN setup logs I do not see any Errors.

    Thanks & Happy new year,
    Michael

Reply Children
No Data
Unfiltered HTML