This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Zone <-> VPN Routing - XG Firewall

Hi everyone,

I recently switched over to XG Firewall from pfSense, thus kindly excuse my insufficient knowledge.

For a testing setup I have virtualized XG on ESXi.

My plan is to connect using a SSL VPN session to the manage zone, which is the only one which allows SSH traffic.

XG has multiple NICs and zones, listed below:

NIC - ZONE - IP

NIC1 - WAN -> upstream DHCP IP

NIC2 - manage - 10.1.1.0/24, XG acting as DHCP server

NIC3 - update - 10.1.2.0, XG acting as DHCP server

NIC4 - LAN - 10.1.3.0, XG acting as DHCP server

I have followed the online guide to setup a SSL VPN tunnel, the client successfully connects to the XG.
The VPN clients have a remote subnet of 192.168.0.0/24 and a local subnet of 10.10.0.0

Using the Firewall rules, I have enabled access from

Source
Zone:VPN
Network: remote subnet

to

Destination
Zone: LAN
Network: local subnet

as described in the tutorial. Further I have allowed access

Source
Zone:LAN
Network: local subnet

to

Destination
Zone: LAN, manage
Network: Any

Thus, if I'm not mistaken, the VPN client connecting should hop from 192.168.0.x via 10.10.0.x to 10.1.1.x to access resources in the manage zone.
However the client fails to ping either 192.168.0.1, 10.10.0.1 or any machine in the manage subnet.
As I'm using a split VPN tunnel, I manually set the gateway on the local vpn user interface to 192.168.0.1

Would greatly appreciate any help, have been cracking my head about this issue for the past 2 days; apart from the issue described XG is a really nice appliance.

This thread was automatically locked due to age.

Top Replies

FormerMember over 4 years ago +1

Hi Hans Wurstler , Thank you for reaching out to the Community! Could you please ensure that the physical ports of the Sophos XG Firewall are not allowed in the Permitted Network Resources (IPv4) of…

Parents

0 FormerMember over 4 years ago

Hi Hans Wurstler,

Thank you for reaching out to the Community!

Could you please ensure that the physical ports of the Sophos XG Firewall are not allowed in the Permitted Network Resources (IPv4) of the Tunnel Access section under VPN > SSL VPN (Remote Access)? If allowed, the SSL VPN user would not be able to access the internal network, instead, create a new IP Host/Network for SSL VPN user access.

Check out the following KBA for more info: Sophos XG Firewall: How to troubleshoot SSL VPN remote access connectivity and data transfer issues.

Thanks,
Cancel
Vote Up +1 Vote Down

Cancel

Reply

0 FormerMember over 4 years ago

Hi Hans Wurstler,

Thank you for reaching out to the Community!

Could you please ensure that the physical ports of the Sophos XG Firewall are not allowed in the Permitted Network Resources (IPv4) of the Tunnel Access section under VPN > SSL VPN (Remote Access)? If allowed, the SSL VPN user would not be able to access the internal network, instead, create a new IP Host/Network for SSL VPN user access.

Check out the following KBA for more info: Sophos XG Firewall: How to troubleshoot SSL VPN remote access connectivity and data transfer issues.

Thanks,
Cancel
Vote Up +1 Vote Down

Cancel

Children

0 Hans Wurstler over 4 years ago in reply to FormerMember

Hi,
thank you for your reply.
From my understanding I have only allowed the zones to be accessed, not the actual physical ports.
Further, to what zone are the VPN subnets as created as stated in the tutorial assigned to?
The tutorial leaves this unanswered.
I have now created subnets for the identical ranges of the zones - as each zone only contains one subnet (at least in my understanding), this however has not changed anything.

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to Hans Wurstler

Hi Hans Wurstler,

You have to configure networks in the permitted network in the SSL VPN profile; interface/ports do not work.

VPN subnet is by default part of the VPN zone; it is not true that each zone contains a single subnet; you could have multiple subnets in the same zone. More info here: https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/concepts/ZoneManage.html.

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel