Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 15 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 13782 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't get XG 115 SSL VPN to pass traffic

Jason Page

Okay, 

I've joined this forum because I'm now 8+ hours into trying to get basic SSL client VPN services working to a new (and very expensive) XG115 that I've recently installed on a small network.

When I first started setting this up I observed that a how-to guide had been recently authored and thought "great, this will make things easy!".  Wrong.

If I can't get this sorted this expensive XG is going to be on its way back to the vendor I got it from.

The guide is here;

https://community.sophos.com/kb/en-us/122769

I was able to follow everything indicated with one exception, in the "tunnel access" of the how-to it indicates you should be able to select an IP group you previously created, but on my XG (FW SFOS 17.0.8 MR-8) I don't get this option, I only get the option to choose the physical interfaces and VLANs administered on the Firewall.

I am able to download the configuration and get the tunnel established.  The firewall rules show no traffic passing through (0 bytes sent 0 bytes received).  If I status the user in current activities I see my user connected and it even shows a small amount of upload traffic, but the client can't ping anything or access anything on the LAN side of the network.

After spending multiple hours trying to get something so basic to work I started digging for anything else that might help;

I looked at this post https://community.sophos.com/products/xg-firewall/f/vpn/93396/can-t-get-ssl-vpn-to-pass-traffic and then this one community.sophos.com/.../ssl-vpn---can-connect-but-no-traffic

which included a bewildering array of advice including that a FW rule was needed in the LAN to VPN direction (this is not indicated in the How-To article), that MASQ NAT should be enabled, that in the VPN policy "use as default gateway" must be turned on, etc.

I have tried all of this stuff and it still does not work.  The Firewall logs don't even show it filtering any traffic through the VPN rule.  I have re-downloaded the configuration each time I've made a change (stupid btw) and tried connecting on multiple computers and operating systems.

This was supposed to be up and running a week ago and I've never had so many problems getting basic client access working with a UTM.  Can someone help me please? To make matters worse there is nobody technical at the site so every time I need to work on this I am driving across town and sitting there trying to troubleshoot this thing for hours.  The business owner simply needs to be able to VPN into the site from their PC when they are away and access machines via remote desktop.  Should be easy, done it many times with other products, apparently in Sophos XG land nothing is easy.



This thread was automatically locked due to age.
  • 0

    FW Rule

    SSL VPN Users

    Accept

    Source Zone VPN - Source Networks ANY

    Destination Zone LAN - Destination Networks ANY - Services ANY

    Match Unknown Users UNCHECKED

    Intrusion Prevention - None

    Traffic Shaping - None

    Web Policy - Allow All

    Application Policy - Allow All

    Rewrite Source Address - unchecked.

     

  • 0 in reply to Jason Page
    Ethernet adapter Ethernet 5:
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : Sophos SSL VPN Adapter
       Physical Address. . . . . . . . . : 00-FF-63-E6-42-7C
       DHCP Enabled. . . . . . . . . . . : Yes
       Autoconfiguration Enabled . . . . : Yes
       Link-local IPv6 Address . . . . . : fe80::2992:2a1f:499b:d414%26(Preferred)
       IPv4 Address. . . . . . . . . . . : 10.81.234.6(Preferred)
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Lease Obtained. . . . . . . . . . : Saturday, July 7, 2018 9:55:41 PM
       Lease Expires . . . . . . . . . . : Sunday, July 7, 2019 9:55:40 PM
       Default Gateway . . . . . . . . . :
       DHCP Server . . . . . . . . . . . : 10.81.234.254
       DHCPv6 IAID . . . . . . . . . . . : 436272995
       DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-21-81-3B-62-A4-4C-C8-3A-0E-9C
       DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                           fec0:0:0:ffff::2%1
                                           fec0:0:0:ffff::3%1
       NetBIOS over Tcpip. . . . . . . . : Enabled

    C:\Users\3214142>route print
    ===========================================================================
    Interface List
      3...a4 4c c8 3a 0e 9c ......Intel(R) Ethernet Connection (4) I219-LM
     26...00 ff 63 e6 42 7c ......Sophos SSL VPN Adapter
      6...d4 6a 6a 00 2e 45 ......Dell Wireless 1820 802.11ac
     16...d4 6a 6a 00 2e 46 ......Bluetooth Device (Personal Area Network)
      1...........................Software Loopback Interface 1
     18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
     20...00 00 00 00 00 00 00 e0 Microsoft Teredo Tunneling Adapter
     13...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
    ===========================================================================
    IPv4 Route Table
    ===========================================================================
    Active Routes:
    Network Destination        Netmask          Gateway       Interface  Metric
              0.0.0.0          0.0.0.0      172.20.10.1      172.20.10.3     50
          10.81.234.0    255.255.255.0         On-link       10.81.234.6    291
          10.81.234.6  255.255.255.255         On-link       10.81.234.6    291
        10.81.234.255  255.255.255.255         On-link       10.81.234.6    291
           10.254.0.1  255.255.255.255      10.81.234.5      10.81.234.6    291
            127.0.0.0        255.0.0.0         On-link         127.0.0.1    331
            127.0.0.1  255.255.255.255         On-link         127.0.0.1    331
      127.255.255.255  255.255.255.255         On-link         127.0.0.1    331
          172.20.10.0  255.255.255.240         On-link       172.20.10.3    306
          172.20.10.3  255.255.255.255         On-link       172.20.10.3    306
         172.20.10.15  255.255.255.255         On-link       172.20.10.3    306
          173.14.9.65  255.255.255.255      172.20.10.1      172.20.10.3    306
          173.14.9.65  255.255.255.255      10.81.234.5      10.81.234.6    291
         192.168.10.1  255.255.255.255      10.81.234.5      10.81.234.6    291
            224.0.0.0        240.0.0.0         On-link         127.0.0.1    331
            224.0.0.0        240.0.0.0         On-link       172.20.10.3    306
            224.0.0.0        240.0.0.0         On-link       10.81.234.6    291
      255.255.255.255  255.255.255.255         On-link         127.0.0.1    331
      255.255.255.255  255.255.255.255         On-link       172.20.10.3    306
      255.255.255.255  255.255.255.255         On-link       10.81.234.6    291
      255.255.255.255  255.255.255.255      10.81.234.5      10.81.234.6    291
    ===========================================================================
    Persistent Routes:
      None
     
    C:\Users\3214142>ping 10.81.234.6
    Pinging 10.81.234.6 with 32 bytes of data:
    Reply from 10.81.234.6: bytes=32 time<1ms TTL=128
    Reply from 10.81.234.6: bytes=32 time<1ms TTL=128
    Reply from 10.81.234.6: bytes=32 time<1ms TTL=128
    Reply from 10.81.234.6: bytes=32 time<1ms TTL=128
    Ping statistics for 10.81.234.6:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 0ms, Maximum = 0ms, Average = 0ms
     
    C:\Users\3214142>tracert 192.168.10.1
    Tracing route to 192.168.10.1 over a maximum of 30 hops
      1   109 ms   116 ms   116 ms  192.168.10.1
    Trace complete.
    C:\Users\3214142>ping 192.168.10.1
    Pinging 192.168.10.1 with 32 bytes of data:
    Reply from 192.168.10.1: bytes=32 time=124ms TTL=64
    Reply from 192.168.10.1: bytes=32 time=112ms TTL=64
    Reply from 192.168.10.1: bytes=32 time=100ms TTL=64
    Reply from 192.168.10.1: bytes=32 time=130ms TTL=64
    Ping statistics for 192.168.10.1:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 100ms, Maximum = 130ms, Average = 116ms
     C:\Users\3214142>tracert 192.168.10.30
    Tracing route to 192.168.10.30 over a maximum of 30 hops
      1     7 ms     6 ms    14 ms  172.20.10.1
      2    88 ms    76 ms    75 ms  172.26.96.161
      3    85 ms    91 ms    68 ms  172.16.78.252
      4     *        *        *     Request timed out.
      5     *
     
     
  • +1 in reply to Jason Page

    Hi,

    are you an old UTM veteran? 

    Because i think, you made an old "UTM" mistake.

    You took #PortX in the SSLVPN config.

    Check the "Hosts and Service" - "IP Host" tab.

    Those host definitions are only "the XG interface" itself. Not the Network. Common UTM mistake. 

    Create a new network object with your LAN Network at redownload the config.

    Should work. 

    The point is, why the VPN to LAN policy does not log anything but the ping to the interface works fine, is that the xg does a loop back on the interface so the policy is not inplace. Just for your information. 

  • 0 in reply to LuCar Toni

    At the time I started doing this I created a LAN object that included the LAN IP addresses... however I never get the opportunity add it to the SSLVPN Config.

     

    My only choices are the interfaces. I even restarted the firewall and same thing.

     

    Even if I click the option dialog to create a new rule, that rule just shows up in the LAN object list but is not selectable at the time I'm editing the SSLVPN configuration.

     

    I spent a couple of hours trying to fix that problem then I ran into this provisioning video from Sophos; www.youtube.com/watch He just "selects all" and carries on like it's no big deal, so I assumed that it would work with the interfaces. Is not being able to add an IP network object to the SSLVPN config a known bug?

  • +1 in reply to Jason Page

    Hi,

    Interface is the XG Interface IP.

    So basically you can only communicate with the LAN Interface of XG. 

    Just create a new network object with your (i assume) /24 network and select it in the permitted network resources.  In your screenshot, there are only interface IPs (/32). 

    And the routes of the clients are only /32. 

    173.14.9.65  255.255.255.255      10.81.234.5      10.81.234.6    291
         192.168.10.1  255.255.255.255      10.81.234.5      10.81.234.6    291

  • 0 in reply to LuCar Toni

    So I have this LAN object already created;

     

    But it is not available for selection when I am editing the VPN policy;

     

    What am I missing?

  • +1 in reply to Jason Page

    You should try to create a NETWORK host instead of a RANGE host. Then you will be able to select it in the Permitted network ressources.

    Let me know if it works.

  • 0 in reply to Jason Page

    Okay, so I was able to do this (my rule above never shows up).

    Click "new item" and create a new subnet item.  I tried this several times with an IP range and never got it to work but I tried it with subnet and it took it this time....

    So, re-downloaded client & configuration, connect tunnel, still can't connect to any resources on the LAN side of the network.

    For the first time ever though I see out bytes in my firewall rule (only 120 bytes) but 0 in bytes.

    Do I need another firewall rule in the other direction?  The How-To guide makes zero mention of needing this rule.

  • 0 in reply to Jason Page

    Created a LAN to VPN rule with ANY allowed and still doesn't work.