This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG Site-to-Site IPSec VPN - 802.1X authentication failing

I've recently replaced an ageing Sonicwall with an XG230 running SFOS 18.0.3 MR-3

The XG is at our Head Office and I have 17 remote sites equipped with Draytek 2860/2 routers. The sites are connected with IPSec site-to-site VPNs for which the XG is the responder. All work well and the VPNs are stable.

At each of our sites, we advertise a corporate Wi-Fi network that uses 802.1X for authentication. The RADIUS server is located in our Head Office.

Some of the remote sites use the Draytek built in Wi-Fi, some have Ubiquity APs.

Since implementing the XG, clients fail to connect to the corporate Wi-Fi at all of the remote sites (Head Office is unaffected). I can see, from the RADIUS server logs, that the clients are making contact but at some point during the authentication process, it is failing - I suspect that nothing is getting back to the clients.

The XG logs would, to my inexperienced eye, tend to support this.

It's over two weeks since I logged this problem with Sophos Support and two weeks since I last heard anything from the, which was to say the issue had been escalated to an escalation engineers.

In the meantime, I have had to re-configure our Wi-Fi to use WPA2/PSK authentication. It's not great that I have had to downgrade security due to an apparent problem with a security appliance!

Has anybody else got this problem, or even better, have a workaround? Or do you have a similar set-up that is working?

Thanks



This thread was automatically locked due to age.
Parents Reply Children
  • Route based needs to be supported from both ends. So you need to change that on the remote site, if possible. 
    you can try to tcpdump on radius port on XG and check, if XG is send out the Radius packets via WAN instead through the tunnel. That would be an indication, that the routes of IPsec are not correct.