SSLVPN through XG to UTM

Hi JeffreyJaspers 

As per my understanding you are trying to connect SSL VPN is SSL VPN Client >> Sophos XG firewall >> ISP >> Sophos UTM, did you check the logs in UTM? did you check the dropped packet in the XG firewall for SSL VPN port?

If you create a plain firewall rule for your IP in the Sophos XG firewall, without any scanning or restrictions, what are you observation?

Hi Keyur,

Keyur said:

As per my understanding you are trying to connect SSL VPN is SSL VPN Client >> Sophos XG firewall >> ISP >> Sophos UTM, did you check the logs in UTM?

This is correct. I don't manage the UTM from the office environment but this device does not seem to matter. If I create this rule you talk about, the traffic flow through it and I see it being allowed from the logviewer. But the SSLVPN is not connecting. SO my toughts were that maybe somewhere in the traffic flowing back, someting is missing or being dropped or anything.

Kind regards,

Jeffrey

Keyur were you able to investigate why it is failing?

Kind regards,

Jeffrey

Just to be sure, you replaced your WAN IP in your Log with 1.2.3.4 - correct? 

Do you have a DPI Inspection rule in Place? 

Yes that is correct. 1.2.3.4 is not the original IP, just put it there for security reasons

Hi JeffreyJaspers 

Do you have enabled DPI inspection in the firewall rule from where the traffic for SSL VPN passing? We have checked but there is no such issue has been reported. Are you able to collect logs from UTM when you try to connect an SSL VPN?

Keyur Like I said, I do not manage the UTM device. But also from the XG perspective I don't see any traffic going to the company UTM IP (eith the latest firmware installed). I do see this traffic in the XG logs with the old fimware installed. This behaviour tells me that the traffic cannot leave the XG.

And no, I don't have IDS in place at the moment.

Keyur anything else I can try?

So you do not have a SSL Engine Rule currently configured? 

Could you quickly verify, there is not rule in place right now? 

That is correct, no such rule is in place

"NC-59156 [CSC] Traffic not passing after upgrade to SF 18.0 MR1" this here from the XG Firewall v18 MR-1-Build396 resolved the problem.

"NC-59156 [CSC] Traffic not passing after upgrade to SF 18.0 MR1" this here from the XG Firewall v18 MR-1-Build396 resolved the problem.