XGS IPSec (RemoteAccess) Works from Computer but Not IOS

Question

Hi, 
 I'm setting up an XGS2300 and I'm so close I can taste it! 
 I'm having an issue with my RemoteAccess IPSec VPN and iPhone/iPad (iOS) clients. The connection attempts error. The client gets something generic like "could not establish connection" and the gateway reports " received IKE message with invalid SPI ([hex code]) from other side." 
 Connecting from computer clients using Sophos Connect and the scx file I exported from the gateway works like a charm. 
 I have tried shared secret AND certificates. I have tried manually entering IPsec VPN settings on the phone and downloading a mobileconfig file. 
 My gateway's local ID is the IP address and my remote ID is a generic fake IP (2.2.2.2). 
 Is there some magic checkbox or setting I'm missing? 
 Thanks, 
 Jeff

emmosophos · Accepted Answer

Hello there, 
 Thank you for contacting the Sophos Community. 
 What version of the XG are you running, I just tried on 18.5 MR4 and have no issues. 
 I used the built-in VPN in Iphone, with PSK, beside the user Account/Password. 
 No Local ID or Remote ID on the XG. 
 Is your XG the Edge router? 
 Regards,

JeffCooper · Answer

Found the issue. I never saw this tid-bit of info until I yesterday 
 " Important : Due to a limitation on Apple iOS, the Local ID parameter must be left blank." 
 https://support.sophos.com/support/s/article/KB-000043857?language=en_US 
 Once I removed the Local/Remote IDs, it worked. Though it looks like using a certificate forces an ID to be there, so we'll have to go with shared secret if we want to VPN from iOS. 
 Thanks, 
 Jeff

XGS IPSec (RemoteAccess) Works from Computer but Not IOS

Top Replies

Submitted a Tech Support Case lately from the Support Portal?