Can not use WAF because of 443/UDP on SSL VPN

you can not use SSLVPN on Port443 in conjunction with WAF on Port 443.

The problem is, that SSLVPN automatically binds on all interfaces. 

I hope sophos will implement a way that the user can select one or more interfaces  (in case of multiple WAN Ports) in the SSLVPN configuration, since using alternative Ports is sometimes an issue.

Ok i understand but TCP443 ist not UDP443 ... if this problem really exist it is a shame and ive got a very big Problem. I Need to install 60+ SSL VPN Profiles on Private PCs ...  

Hi Frank Fühner,

Could you please share the error screenshot or logs?

Did you check by changing the SSL VPN port? Are you able to configure WAF?

Hello,

Could you try to change your SSLVPN port, and instead of using UDP 443 maybe use UDP 8443 or 10443.

This is the fastest way to have your SSLVPN and WAF working together. Because I think Sophos cannot add a new feature to select an interface in particular for SSLVPN this fast...

Regards.

Hi Frank

I missed that detail that you ask specifically for UDP

I checked this on a spare firewall and it should technically be possible to bind

WAF: TCP/443

SSLVPN: UDP/443

As you can see both services only bind to either TCP or UDP:

XG230_WP02_SFOS 18.0.1 MR-1# netstat -tulpen | grep 443
tcp 0 0 xxxxxx:443 0.0.0.0:* LISTEN 0 12006865 17648/httpd
udp6 0 0 :::8443 :::* 0 12008562 18010/sslvpn

But as you noticed the GUI will show an error message, that it's not allowed to configure both services on the same port, even if they are technically separated by protocol.

The solution would be that sophos implements the ability to bind SSLVPN to one or more interfaces.  Its important that they don't limit it to "1" interface, otherwise you lose the ability fro client tunnel failover. 

See: See: https://community.sophos.com/sophos-xg-firewall/b/blog/posts/xg-firewall-v18-mr5-is-now-available