Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 19 replies
  • Answers 5 answers
  • Subscribers 33 subscribers
  • Views 18345 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How can I change the SSL VPN Control Channel to be TLS 1.2?

JohnDoe2

I was looking at the connection logs from the stoplight and noticed that the Control Channel was using TLS 1.0/SSL3.0. Is there a way I can change that to use TLS 1.2? I looked through all the VPN options and I didn't see anything that would allow me to make sure only TLS 1.2 was used...



This thread was automatically locked due to age.
Parents
  • 0

    I think it's only 1.0!

    When using OPENVPN from ex. iPhone, I can set that lowest supported TLS version is either 1.1 or 1.2, it get the message:

     

    "Authentication failed"

    "Server TLS version is too low"

     

    When setting it to 1.0 is connects.

    -----

    Best regards
    Martin

    Sophos XGS 2100 @ Home | Sophos v19 Architect

  • 0 in reply to twister5800

    Hello All

    We have now kept the minimum version set to TLS1.2 on V18 MR1 at the moment we have no plan for 17.5.

    Wed Apr 15 15:21:37 2020 Socket Buffers: R=[65536->65536] S=[65536->65536]
    Wed Apr 15 15:21:37 2020 UDPv4 link local: [undef]
    Wed Apr 15 15:21:37 2020 UDPv4 link remote: [AF_INET]192.168.50.132:8443
    Wed Apr 15 15:21:37 2020 MANAGEMENT: >STATE:1586944297,WAIT,,,,,,
    Wed Apr 15 15:21:37 2020 MANAGEMENT: >STATE:1586944297,AUTH,,,,,,
    Wed Apr 15 15:21:37 2020 TLS: Initial packet from [AF_INET]192.168.50.132:8443, sid=cc028869 51acbba6
    Wed Apr 15 15:21:37 2020 VERIFY X509NAME OK: C=IN, ST=GUJARAT, L=VADODARA, O=Sophos, OU=GES, CN=sc.local, emailAddress=administrator@sc.local
    Wed Apr 15 15:21:37 2020 VERIFY OK: depth=0, C=IN, ST=GUJARAT, L=VADODARA, O=Sophos, OU=GES, CN=sc.local, emailAddress=administrator@sc.local
    Wed Apr 15 15:21:38 2020 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
    Wed Apr 15 15:21:38 2020 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
    Wed Apr 15 15:21:38 2020 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
    Wed Apr 15 15:21:38 2020 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
    Wed Apr 15 15:21:38 2020 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
    Wed Apr 15 15:21:38 2020 [sc.local] Peer Connection Initiated with [AF_INET]192.168.50.132:8443
    Wed Apr 15 15:21:39 2020 MANAGEMENT: >STATE:1586944299,GET_CONFIG,,,,,,
    Wed Apr 15 15:21:40 2020 SENT CONTROL [sc.local]: 'PUSH_REQUEST' (status=1)
    Wed Apr 15 15:21:40 2020 PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.81.234.5,ping 45,ping-restart 180,route 192.168.20.0 255.255.255.0,route 192.168.10.0 255.255.255.0,route 192.168.4.0 255.255.255.0,topology subnet,route remote_host 255.255.255.255 net_gateway,inactive 900 7680,ifconfig 10.81.234.6 255.255.255.0'
    Wed Apr 15 15:21:40 2020 OPTIONS IMPORT: timers and/or timeouts modified
    Wed Apr 15 15:21:40 2020 OPTIONS IMPORT: --ifconfig/up options modified
    Wed Apr 15 15:21:40 2020 OPTIONS IMPORT: route options modified
    Wed Apr 15 15:21:40 2020 OPTIONS IMPORT: route-related options modified
    Wed Apr 15 15:21:40 2020 Preserving previous TUN/TAP instance: Ethernet
    Wed Apr 15 15:21:40 2020 Initialization Sequence Completed

    Regards,

    Aditya Patel
    Global Escalation Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

  • 0 in reply to Pieter van Kampen

    Hello ALL, 

    Just an update, the fix version V18 Mr1  for this issue was pulled and now pushed to fix on V18.5. 

    Hence, the fix will be planned for V18.5

    Regards,

    Aditya Patel
    Global Escalation Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

  • 0 in reply to Aditya Patel

    v18.5?

    v18 MR-1 just came out, is there any date on when we will see v18.5 EAP, or at least v18 MR-2 and v18 MR-3?

     

    Thanks!

    If a post solves your question use the 'Verify Answer' button.

    XG 115w Rev.3 8GB RAM v19.5 MR1 @ Home.

  • 0 in reply to Prism

    This should be resolved in MR3. https://community.sophos.com/xg-firewall/b/blog/posts/xg-firewall-v18-mr3

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Hmmm...

    Tue Oct 13 15:21:04 2020 Control Channel: TLSv1, cipher SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

    Can you verify?

    -----

    Best regards
    Martin

    Sophos XGS 2100 @ Home | Sophos v19 Architect

  • 0 in reply to twister5800

    Same thing here on v18 MR3, strange enough on v18 MR2 It has using TLSv1.2.

    Tue Oct 13 10:24:47 2020 Control Channel: TLSv1, cipher SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

    If a post solves your question use the 'Verify Answer' button.

    XG 115w Rev.3 8GB RAM v19.5 MR1 @ Home.

  • 0 in reply to Prism

    I am sorry, missed the version. The TLS1.2 fix was moved to MR4. (NC-53896) 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    Will NC-53896 also bring AES-GCM support ? Or at least we will get a updated version of OpenVPN, currently It's running 2.3.6, which is from 2015...

    If a post solves your question use the 'Verify Answer' button.

    XG 115w Rev.3 8GB RAM v19.5 MR1 @ Home.

  • 0 in reply to Prism

    @LuCar Toni: is this still to come in MR4?

    Sat Oct 31 15:49:13 2020 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

  • 0 in reply to LuCar Toni

    Will this actually be available on MR4 ? Or only v18.5 ?

    If a post solves your question use the 'Verify Answer' button.

    XG 115w Rev.3 8GB RAM v19.5 MR1 @ Home.

  • 0 in reply to LuCar Toni

    Confirmed I think,

    Wed Dec 30 15:53:51 2020 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Reply Children
No Data