Unable to access Sophos XG when over remote SSL VPN with static IP

Hello TimAlbrecht,

Thank you for reaching out to the community, may we know the firmware version of the SFOS currently being used ?

I should also mention that I added my entire SSL VPN subnet (10.100.4.0/24) in the ACL, not just the host IP address.  For example, my dynamically assigned IP is 10.100.4.2 and I can access the firewall thru HTTPS.  If I assign it 10.100.4.129, I can't access the firewall.

Hi TimAlbrecht

Please share SSL VPN policy snapshot as well as device access settings 

Regards

https://imgur.com/a/ojFQNAv

Hey TimAlbrecht, 

There is no need of creating an ACL for the VPN users, simply under the device access > for the VPN zone enable the tick for HTTPS, SSH & PING !!

Hey TimAlbrecht, 

There is no need of creating an ACL for the VPN users, simply under the device access > for the VPN zone enable the tick for HTTPS, SSH & PING !!

Yes there is a need in creating an ACL if I only want to give the user with the static IP access to the firewall instead of any user that connects to the VPN

Even when I remove the ACL and check the box for HTTPS access for the VPN zone, I still cant connect if I set a static IP.  It only works if I let it assign a dynamic IP.

Hi  TimAlbrecht 

Please check with the firewall rule instead of the ACL rule 

Please create VPN-LAN firewall rule and keep the rule on the TOP

And under device access > for the VPN zone enable the tick for HTTPS, SSH & PING 

Thanks and Regards

I have the correct rules in place.  The issue is that I cant HTTPS into the Sophos over the VPN if I assign a static IP to my user.  If I disable that function in the Remote SSL VPN global settings and just allow it to assign a static IP (same subnet) then I can HTTPS to the firewall.  It doesnt matter if I use an ACL or if I check the box to allow VPN access under Device Access.   

Hi  TimAlbrecht 

Yes, it is possible to access your Sophos XG firewall with static IP with ACL rule as per the below snapshot : 

Source Network/host is the static IP of the remote user

The destination host can be any or Sophos XG IP

Thanks and Regards 

The source zone you have shown is wrong.  It needs to be VPN, not WAN since Im coming in over the VPN.

Hi  TimAlbrecht 

Yes I know the Source Zone is incorrect that is another way to access your Sophos XG firewall from outside if your end user has Public static IP 

As per the below document we don't have to create Local ACL for SSL VPN as it required Policy to access the internal resource 

Please go through the link to meet your requirement 

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/VPN/RemoteAccessVPN/VPNRemoteAccessSSLVPNSophosConnectClient/index.html#add-a-firewall-rule 

Thanks and Regards