Sophos Connect Client not using internal DNS

Hello Christian,

Have you configured a SSL VPN policy on XG? If yes then please check what are the DHCP IP range and DNS servers assigned there. It is possible that the DHCP range for SSL VPN and Sophos Connect is overlapping. It is possible that DNS servers assigned in SSL VPN policy is IPv6.

If your answer is No, then I would need a Technical Support Report (TSR) from Sophos Connect after you establish the connection. You can get the TSR from the Menu->About page on Sophos Connect. You can send it to me in a private message.

Thank you,

Ramesh

Hello Ramesh,

and thank you for your answer! I'm not so sure what you mean with SSL VPN policy.

What I have is a additional IPSEC Site2Site connection and the SSL VPN settings, wich are pretty much default I guess (please see screenshot).

So my answer is no [:)] 
I have sent you a PM with the TSR.

Hello Ramesh!

I recently upgraded to MR4 because of another bug with the certificates ( link ). If I downgrade to MR3 I can't connect anymore.
So that's a really unsatisfying situation [:S]
Do you know when the bug will be fixed? Our whole migration get's stuck because of this. I'm considering in using openvpn client...

Hello Christian,

Sorry you ran into this problem. We will have a fix for it in SFOS early next week. 

Ramesh

Thank you for your answer, Paul Jr!
Your idea can help in a small environment, but we need several things like AD, WSUS and so on. So editing the hosts file isn't an option.

Hello Ramesh,

that's good news - thank you!

For a small number of clients, yes! Those are stationary clients in homeoffices. Although that's not the best example, perhaps [:D] 
Maybe we won't need this anymore after migration to Win10...

Hey ChristianD 

Apologies again for any inconvenience caused by this.

This issue (NC-45246) is resolved in today's re-released MR4-1 version - [SF 17.5 MR4-1 (17.5.4.429)]

Regards,

Thank you very much. I will be testing now and give you a feedback!

Sorry, but I cannot test it because of certificate error again [:S]

Remote certificate authentication is successful.

Local certificate authentication isn't working
Errors: no issuer certificate found / no trusted RSA public key found

I tested with the applicance-cert (wich I imported manually on the client) and our domain-cert.
I also generated a self-signed cert on the XG - again no luck.

Sorry, but I cannot test it because of certificate error again [:S]

Remote certificate authentication is successful.

Local certificate authentication isn't working
Errors: no issuer certificate found / no trusted RSA public key found

I tested with the applicance-cert (wich I imported manually on the client) and our domain-cert.
I also generated a self-signed cert on the XG - again no luck.

Hello Christian,

Any update on this please? Please check the Sophos Connect Client policy and make sure the policy is correct in terms of certificates. Then maybe export and reimport the policy on Sophos Connect.

Ramesh

Hi Ramesh,

actually I gave up this morning... All I can say is that everytime I make a change in the policy I click on Apply afterwards and Export connection. On the client-side I delete the "old" profile and import the new one.
I tried 3 different certificates: Appliance cert, our domain cert and a self generated cert - Everytime I get the same errors: no issuer certificate found and no trusted RSA public key found

Sorry if my dumbness is the cause of this [*-)]

I opened a support case.

Hi ChristianD 

My apologies for any inconvenience caused and no worries at all, we are here to help. Would it be possible to PM me with your support case details so I can follow up with you accordingly?

Thanks,

Hello,

Same problem for me. I opened a case with French support,they noticed the problem on my computer but can't find a solution.

The "Sophos Connect" window indicates the right dns servers, but ipconfig /all shows that there are only ipv6 servers in there.

Hi yvesGourle,

I suppose you are testing with the latest release of Sophos Connect Client? Sorry to hear that the problem isn't solved.
I didn't test anymore since I opend this threat, because we needed a solution immediatelly. We are using OpenVPN client.

regards

Hi Christian,

Yes, last XG firmware and last Connect version...The problem occurs on some computers but not on all. And obviously we can't see what makes them different.

Regards,

Yves

Ok, that's strange [^o)]

Could you please post any update on this?

there is another post about the same problem

https://community.sophos.com/products/xg-firewall/f/sophos-connect/109857/sophos-connect-vs-dns/409609

Workaround is suggested, I'll try. Also it seems it occurs only on 1903 (or insiders above) versions.

Thank you Yves, I'll follow this post. Good luck on the workaround!