Connect Client v. SSL VPN - Permitted Network Resources

Hello MikeX,

If you are using the exported tgb file to import into Sophos Connect then by default it is a tunnel all policy. If you cannot get to certain private networks behind the firewall then it is a routing issue. Please check if the Virtual IP assigned to the Sophos Connect Client has a route to and back.

If you are using Sophos Connect Admin then you can assign specific networks to allow from Sophos Connect. So please check those networks if this is how you are configuring the policy.

Please send an update on the results.

Thank you,
Ramesh

Ramesh,

It works .... kind of!

If I explicitly add the 10.127.0.0/9 into the Networks in Connect Admin (in addition to my regular internal Lan IP range), I CAN get to that 10.127.0.0/9 network.

If I leave it as Tunnel All, I can't get to the 10.127.0.0/9, but can still get to my regular LAN.

note: If Sophos tech support wants to look at this, let me know and I will open a case.

Hello MikeX,

Since it works when you explicitly specify the network then it seems like a firewall rule that could be the possible cause of the problem you are seeing when you have a tunnel all policy from the Client side.

Thank you. Hope to hear back on the possible cause of he problem.

Ramesh

It wasn't a rule.  I uninstalled the SSLVPN and the Connect client now works. 

I remember reading somewhere if you have both clients, you need to install them in a certain order. 

Thank you MikeX for the update. Also regarding this "I remember reading somewhere if you have both clients, you need to install them in a certain order. " Yes it was when we first released Sophos Connect last year we had this problem. But start Sophos Connect 1.2 and up that is no longer a issue.

Please upgrade to the latest version Sophos Connect 1.3 EAP1 which will be available soon. Provide feedback on how it is working out in your deployment. There are two new features (Run logon script and Prompt for OTP on Phase 1 rekey) in this release. If you use any of these then it would be good if you can upgrade.

Ramesh

Hi Ramesh,

Firstly thanks for the help towards the community. I have Sophos Connect working on my home lab. IP assigned are 10.10.10.5 to 10.10.10.50

" Please check if the Virtual IP assigned to the Sophos Connect Client has a route to and back " - i dont understand what you meant by that statement , do we have to create a " Policy route " under " Routing " 

At the moment i have just two firewall rules for Sophos Connect , one for IKE Services, which has Any for Source and Destination Zones

and another FW rule for VPN to WAN , please refer to attachments

Also with Sophos Connect , can we restrict access only to certain Networks , like how we have in SSL VPN (remote access) Permitted Network resources

Appreciate your cooperation

Thanks

Raju 1732.Sophos Connect firewall rules.docx

Hello Raju,

You need to do the following.

1) I would say you should have two different firewall rules. This rule includes the following VPN to LAN and LAN to VPN. In this rule you should control the allowed destination networks.

2) Have a separate rule for VPN to WAN. This rule should include a corresponding a NAT rule to translate the source to the WAN IP of the firewall.

Hope this will resolve the questions you have. Please provide update if the change works for you.

Regards

Ramesh

Hi Ramesh,

Thanks for your reply ,have enabled the below which now allows devices connected via Sophos Connect access Internet

Appreciate your help

Regards

Raju