Sophos SG210, remote SSL VPN users, accessing Azure SQL via UTM to Azure IPSEC tunnel

Hello there,

Thanks for reaching out to Sophos Community

When they are connected on SSL VPN what are the results of traceroute going to AzSQL? Also, are there any deny/drop log from the firewall logs from SSL VPN pool -> AzSQL?

Many thanks for your time and patience and thank you for choosing Sophos

Cheers,

Hello there,

Thanks for reaching out to Sophos Community

When they are connected on SSL VPN what are the results of traceroute going to AzSQL? Also, are there any deny/drop log from the firewall logs from SSL VPN pool -> AzSQL?

Many thanks for your time and patience and thank you for choosing Sophos

Cheers,

Hello Raphael,

I'll gather this information over the next day or so (when time allows).

A little more headway.  The tracert are as follows:

VPN USER:

tracing route to <one of MSFT's gateway/keeper IPs where SQL instance resides>

1  X ms  Y ms Z ms  10.242.2.1         Our SSL POOL IP assigned to them.
2      *        *        *         Request timed out.
...

30  *        *        *         Request timed out.

Local user:

tracing route to <same as above>

1  X ms  Y ms Z ms  10.225.X.Y         UTM internal LAN IP
2  X ms  Y ms Z ms  Static IP of WAN Gateway
3 ... 6   ISP's network
7... X ms  Y ms Z ms MSFT IPs

So to my newb eyes it appears that the SSL VPN subnet isn't routing traffic to/through the UTM.....

Hello

Thanks for this details. Are your SSL VPN clients configured to full tunnel to the Firewall->Internet or split tunneling? Also are there any deny/drop messages in the logs when SSL VPN clients tries to reach AzSQL? 

Cheers,

For the full vs split, is it a matter of having "ANY" listed in the "Local Networks" under the SSL Profile? If so, currently we have all our REDs, IPSEC tunnel networks, Azure IP for the gateway and vnet CIDR, 0.0.0.0/0 for IPv4, and of course local networks, listed.

Hopefully will have some time to do testing with a remote user soon to get the logs looked into.

Hello, 

Yes correct, under the Local Networks, you must have "Any" (Full Tunnel) if you remove that and then add the "Local Networks", then traffic that is not designated to those Local Networks should go out the user's regular gateway (Split)