Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 27 subscribers
  • Views 1662 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN - unable to connect to destinations behind a Layer 3 FW/WLC

ChrisGER

Ho Community,

i'm just a little helpless about the following scenario on an XG firewall (current firmware).

Requirement
Android devices connect via OpenVPN to the XG firewall, which is directly connected to the ISP (no problems).
The destination devices are located behind a internal Firewall/WLAN-Controller.

Situation
The devices can communicate with the XG via the port of the FW/WLC without any problems and also access the Internet.
From XG to internal FW/WLC is a seperate vLAN in production.

The internal FW/WLC has routing sets, to forward the vLAN's without any NAT directly to the XG Firewall to forward them to the internet (NAT on the XG).
If a Android device is successfull connected to XG (SSL VPN) connection successfull - it's not possible to reach a device, that is behind the internal FW/WLC.
Routeing configuration fpr all vLANs are correctly on the XG firewall.
Reconfigure the routing (static dynamic) trough console command dose not fix the issue.

My Problem
If the Android device is connected trough SSL VPN to XG Firewall, the XG send no package to the internal Firewall (logging internal FW trough wireshark).

- VPN to LAN (MASQ) is also not the solution ;(
- Set routing to static route for VPN -> nothng changed.


Question
Any idea hwo to send requests from the XG trough port3 to the internal Firewall/WLC device during a SSL VPN connection.


ASCII (from external to internal destination)
Extranet ----> SSL VPN (XG Firewall at Port1) --- VLAN0005 (port3) ---> FW/WLC (Port 1) ----> VLAN0070 ----> FTP Service / HTTP Web Interface.
 
Any idea what's wrong or a example what to check to get connected ?
 
 
thanks forward and regards
Chris



This thread was automatically locked due to age.
Parents
  • 0

    Hi  

    The issue seems to be with firewalling only, it required VPN to VLAN zone and VLAN zone to VPN firewall rule and network which are required to access should be added in the VPN configuration, I would recommend opening a support case for further investigation.

  • 0 in reply to Keyur

    Keyur said:

    Hi  

    The issue seems to be with firewalling only, it required VPN to VLAN zone and VLAN zone to VPN firewall rule and network which are required to access should be added in the VPN configuration.....



    Hi Keyur,
    thanks for your quick response. the simpke infrastructure picture is my home based infrastructure [;)]


    the DMZ Layer 3 Firewall is in place to deploy and manage the existing CAPWAP dual-AP's (up to 18 APs).
    Outgoing traffic (internet access) is working well and without any issues.

    VPN connect to Sophos XG (SSL VPN) from the extranet is working well, but it looks like, the existing static-route configuration is not working for VPN connections.
    During monitoring activities, thereis no package forwarded trough port3 on the XG firewall [:S]
    May you have an idea how I can stay sure that destination addresses behind the DMZ firewall can also be reached from the VPN tunnel (Outgoing port is port 3 of the XG to the DMZ).

    Thx forward and best regards
    ChrisGER

  • 0 in reply to ChrisGER

    The Client is actually sending the traffic to XG through the tunnel and the destination is placed in permitted Networks in SSL VPN? 

  • 0 in reply to LuCar Toni

    LuCar Toni said:

    The Client is actually sending the traffic to XG through the tunnel and the destination is placed in permitted Networks in SSL VPN? 

     

     
    Hello LuCar Toni,
    from my point of view - yes


    Port3 - the transfer net from XG to the WLC/L3 Firewall as shown in my graph.
    VPN-VLAN00xx is the destination that's attached to WLC/L3 device.
    Static routeing for the subnet is configured at the XG.
    How can i check it more deeply where the traffic gets stuck ?

    Thx forward and regards
    Chris
     
  • 0 in reply to ChrisGER

    #Port3 is not a Network, it is the interface.

    This is not like on UTM. There is no preconfigured Network Object. Instead its the Zone Object. 

Reply Children
No Data