Sophos XG VPN connection issue

Updated XG to 19.0.1.

If still not working we have to check with ISP for 8443 port is open from their end or not 

Please take SSH access of Sophos XG Firewall as per the link : https://support.sophos.com/support/s/article/KB-000038697?language=en_US  and share tcpdump again share the logs.

Please Go to System-->Admininstration --->Device Access and share a screenshot 

To disable Login restriction, Go to Authentication > User > Login restriction* and select Any node as highlighted below. 

Have you filled out the default certificate on your XG firewall?

Are you using the third-party signed certificate for SSL VPN? 

Seems the issue is related to "server_certificate: certificate verify failed". Please check the default CA details are filled up or proper on XG to complete the cert verification.

If possible you may try by regenerating default CA (by editing and saving it with details) but that will result in the regeneration of all your certificates and will restart the SSL VPN service and may require re-import of the configuration file of SSL VPN to the end-user machine to connect over SSL VPN. Please ensure you may do this activity in odd hours with proper downtime for the safer side, so anything may impact then you may restore the backup.

Note: Before proceeding with default CA regeneration, you may take a backup of the current configuration for safety measures. 

Regards

Can I use a different port if 8443 is blocked by ISP?

Yes, but make sure the same port is open from ISP end too 

Regards

My ISP is using CGNAT and blocks the ports.

Try this methods-

Verify the firewall rule
If the SSL VPN connects successfully, but users cannot connect to the allowed resources behind the Sophos Firewall, verify if a firewall rule is created and configured. If any specific service is selected in this rule, try allowing any service and check the connectivity.

tidy_fix_alt

Verify the accessibility of the resources
Sign in to the command-line interface (CLI) and select 4. Device Console. Confirm that the internal allowed resource is accessible from the Sophos Firewall itself. As an example, you can ping an internal resource from the Sophos Firewall's console. If the allowed resources are not accessible from the Sophos Firewall, they would not be accessible from the WAN side.

Verify the permitted network resources
Make sure that the physical ports (#Port1, #Port2, #Port3, and so on) of the Sophos Firewall are not allowed in the Permitted network resources (IPv4) section of VPN > SSL VPN (remote access). If allowed, the SSL VPN user would not access the internal network; instead, create a new IP Host/Network for SSL VPN user access.

Verify the drop packet capture for SSL VPN
Sign in to the command-line interface (CLI) and select 4. Device Console to run the following command, which uses the default SSL VPN port 8443.

drop-packet-capture “port 8443”

tidy_fix_alt

SSL VPN is restarting frequently
Verify that the WAN port of the Sophos Firewall is not allowed under VPN > SSL VPN (remote access) > Tunnel access > Permitted network resources (IPv4). If it is allowed, the SSL VPN client could disconnect frequently.

Note: As a last resort, try uninstalling the SSL VPN remote access client and reinstall it.

Internet traffic is not going through the firewall
Even though the option Use as default gateway in the SSL VPN remote access policy is turned on, internet traffic is going through the local internet connection of the endpoint rather than the SSL VPN adapter.

To resolve this issue and force the internet traffic through the SSL VPN adapter, verify the endpoint's routing table and prioritize the SSL VPN adapter through its metric. You can also turn off the other local interface routes of the endpoint if you do not need them; that way, it will force the internet traffic to flow over the SSL VPN adapter and thus through the Sophos Firewall.

This may help you,

Rachel Gomez

If they are providing service for port forwarding we have to inform them to forward 8443 TCP/UDP port or you can ask for dedicated Publis Static IP from ISP.

Regards

Hi Jason,

Can you check the following or share if possible the following below:

1.Log viewer (to check if any firewall rules blocking or dropping)

2. Client logs