SSL VPN XGS 4500 - TCP RST

Hi Marcel Hoffmann

Thank you for reaching out to the community, 

Please verify the configuration as per the below link and ty to connect the user : 

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/VPN/RemoteAccessVPN/VPNRemoteAccessSSLVPNSophosConnectClient/index.html

Please share logs as per the below link 

https://support.sophos.com/support/s/article/KB-000036858?language=en_US 

Thanks and Regards

Hello Marcel,

Adding to what Bharat, has mentioned, make sure you don't have a DNAT rule configured with service ANY or the Port used for SSL VPN. 

You could confirm also what Firewall Rule the traffic is hitting from the client using the GUI PCAP of the XG

Regards,

RST will be send, if auth is unsuccessful. I would not look into this much more. Check the auth. Check if all users are effected. Then check the authentication log of the firewall. 

Hi,

I think the problem is more simple. The target port is not open when connecting (checking with port forward test). I have no other DNAT rule for this Port/IP (but I use this port on an alias IP). I also tried UDP or a port that is definitely not used by other services without success. 

Currently I opened a case with sophos on this but unfortunately nobody is responding until now.

Hi Marcel Hoffmann 

Please share the same DNAT rule you have configured and forwarded service 8443 and NAT rule associated with same DNAT rule

Please share the output for the below command : 

console>drop-packet-caputer 'host <Public IP> and port 8443 (Public IP address from where you are connecting SSL VPN user from outside)

console>tcpdump 'host <Public IP> and port 8443 

Simultaneously go to MONITOR & ANALYZE | Diagnostics | Packet Capture and click on Configure and add host <Public IP> and port 8443  and check the traffic flow from GUI as well as from CLI as per the above command 

Thanks and Regards

Hello,

problem is solved now. The cause was the default certificate of the certification authority. I had to regenerate it, afterwards the connection was possible.

Regards

Marcel