Can't get remote network

Question

I just started trying to deploy the new Sophos Connect client and went through the directions. It will connect and I get an IP but the remote network shows up as 0.0.0.0 
 Of course, I can't access any devices on the remote end. Anything else I should check? This is a brand new XG install with all the defaults. All I did was create a user and enable Sophos Connect.

rmk_2018 · Accepted Answer

Hello Matthew, 
 
 As per your last email I see they are in the same subnet. Please make them different subnets. Once you fix that and reconnect with Sophos Connect it will be good to go. 
 
 Ramesh

rmk_2018 · Answer

Hello Matthew, 
 
 Yes you need to configure the firewall rules to allow traffic from VPN to LAN and LAN to VPN zones. After you create this firewall rule you will be able to access your internal hosts. 
 
 Please let us know if this works for you. 
 Ramesh

rmk_2018 · Answer

Hello Matthew, 
 Got it. I think the problem you have may be related to the overlapping DHCP range for SSL VPN and Sophos Connect Client. Please verify that you are not using the same range for the two. 
 Ramesh

rmk_2018 · Answer

Hello Matthew, 
 Sorry you hit upon another problem. Please see this post to get this problem resolved. 
 https://community.sophos.com/products/xg-firewall/f/sophos-connect/111782/17-5-3-mr3---creating-an-ipsec-connection-damages-the-configuration-of-the-sophos-connect-server 
 
 Also this bug has been fixed in the next version of Sophos Connect 1.3. So for now you have to use this work around. Change the tgb file or scx file and import the connection file again. It will work. 
 
 Please let us know. 
 Ramesh

rmk_2018 · Answer

Hello Matthew, 
 
 Sorry for the delay. If the policy is configured for tunnel all then you need to add a firewall rule from VPN to WAN.

If you do not want to have a tunnel all policy then use Sophos Connect Admin and configure a split tunnel policy. In this case you will not need the VPN to WAN rule. 
 
 Please let me know if this works for you after you give that a try. 
 
 Thank you, 
 Ramesh

Marte Cooksey · Answer

I'm posting this for the benefit of anyone that has this problem, connected via Sophos Connect with no remote network access. 
 All the setup info I've found focuses on VPN>Sophos Connect client settings, only discussing firewall rules for WAN access due to default 'Tunnel all' configuration with Sophos Connect. (No mention of any other firewall rules, Host and services objects or where the mystery users that we select come from or how to create them if they don't exist.... grrrrr). 
 As I have two Site to Site IPSec VPNs up and working, I'm a little familiar with the process of making them work so........ This is what I did to make Sophos Connect work with the XG 115 and actually access the remote network. 
 1. I followed the setup info provided from Sophos for VPN>Sophos Connect client (Assigned an IP range on a completely different private subnet from any other network in my topology, just like I would for a remote site). Downloaded Sophos Connect client installer and exported the connection .tgb file. 
 2. Loaded Sophos Connect on the target laptop. Imported the .tgb connection file (machine was off-site, simulating a hotel room somewhere). 
 a. Sophos Connect would connect to the XG but no access from there. I could ping the remote network gateway IP but nothing else on the remote network. Not sure about WAN as I did not set up a firewall rule for that (So the documentation is correct, I was able to establish a connection using those instructions. I just couldn't do anything with it except ping the gateway). 
 3. Here is where I departed from Sophos' documentation regarding Sophos Connect setup. 
 a. Utilizing my experience setting up Site to Site IPSec VPN connections, I added an IP range entry in Hosts and services>IP host for the IP range entered previously in VPN<Sophos Connect client. Named it something like Sophos_Connect. 
 b. I added this host to my existing Firewall>Traffic to Internal Zones>Outbound VPN Traffic (and Inbound VPN Traffic) rules that I created when setting up the Site to Site VPNs. Specifically, I added it to Destination Networks (for Outbound) and Source Networks (for Inbound). 
 4. Like freaking magic, the Sophos Connect client machine was now able to ping and access resources on the remote network. I now had RDP access, which was my goal.