Cannot ping remote devices when connected to VPN via Sophos Connect

Hi Daniel Hargrove,

Thank you for reaching out to the Community! 

I don't think the firewall rule placement is the issue as a rule is based on the source zone plus the source network. 

I'd suggest you run a packet capture on the firewall from Diagnostics > Packet capture on the destination IP address and share the screenshot with us. Use this BFP string: "host <IP address that you're pinging> and icmp" 

• Monitor traffic using Packet Capture Utility in the Sophos XG Firewall GUI

Thanks,

Hi Harsh 

Many thanks for getting back to me. 

I have configured the capture filter but when I turn this on it immediatly turns itself off. 

The settings I have used are as follows: 

Number of Bytes - 1024 (not to sure if this is enough)

Wrap capture buffer once full - checked 

BPF string - "host 192.168.11.210 and icmp" 

Any ideas? 

Many thanks, Dan 

Hi Daniel Hargrove,

Try not to add the double-quote, and you can also just run a packet capture on the source IP address without icmp. 

Thanks, 

OK - So I now have some results. 

I can see the following: 

In Interface - TUN0

OutInterfae - Port3.11 

Ethernet Type - IPv4 

Source IP - 10.81.234.7 (my remote laptop)

Destination IP - 192.168.11.210

Packet Type - ICMP

Status - Violation 

Reason - Fiewall 

Any thoughts? 

Thanks, Dan 

OK - So I now have some results. 

I can see the following: 

In Interface - TUN0

OutInterfae - Port3.11 

Ethernet Type - IPv4 

Source IP - 10.81.234.7 (my remote laptop)

Destination IP - 192.168.11.210

Packet Type - ICMP

Status - Violation 

Reason - Fiewall 

Any thoughts? 

Thanks, Dan 

Hi Daniel Hargrove,

Thank you for the update. Is ping allowed on the VPN zone? Go to Administration > Device Access to verify. 

If it's already allowed, then configured firewall rule has something wrong. If you could share the support access id from your firewall by sending me a personal message, I can double-check the configuration and update you with the next step. 

Thanks,

Hi Daniel Hargrove,

Thank you for providing the support access; I've replied to your personal message. 

It seems ping wasn't allowed on the VPN zone on your firewall. Pelase go to Administration > Device Access and allow ping on the VPN zone and let me know if that resolves your issue. 

Thanks,

Hi Daniel Hargrove,

I noticed the SSL VPN network definition isn't correct in VPN to LAN firewall rule. Please correct it as per the network configured under SSL VPN settings > IPv4 lease network and let me know if that resolves your issue. 

Thanks,