Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 20 replies
  • Answers 2 answers
  • Subscribers 31 subscribers
  • Views 3287 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSLVPN logs no longer showing source IP Address since upgrade from 18.5.4 to 19.0.1

LHerzog

Hey,

since we upgraded from SFOS 18.5.4 to 19.0.1 we can no longer see the source IP a SSL VPN user connected from in the VPN logs.

It simply shows nothing or the LAN IP Address of the Firewall in the SSL VPN IP-Range.

We only see the real source IP if the login is unsuccessful.

So this very important information is not logged currently!

Do you have that already as an Bug ID and when will you fix it?

Regards



This thread was automatically locked due to age.
Parents
  • 0

    We are on 19.5.1 for multiple clients and seeing the private ip address within the dhcp range of the vpn dhcp as the source of the connection.  It is even showing this in the logging going to datalakes.  I don't think this was fixed yet and it really needs to be so our logging is correct.  

  • 0 in reply to JTK

    Hello there,

    Thank you for contacting the Sophos Community.

    If you’re in v19.5 MR1 and you still have the issue, please open a case with support and share the Case ID. Feel free to reference this community post when doing so.

    Regards,

  • 0 in reply to emmosophos

    Essentially there are two different events in v19.5 MR1.

    The first one does not show the WAN IP:

    But the second one (Authentication) does show the src_IP





  • 0 in reply to LuCar Toni

    I just checked again and every successful authentication I see has no src_ip and the established connections are showing the VPN private subnet IP.  I also checked datalakes and every successful VPN connection doesn't show a locations because all src ips are internal DHCP VPN ips.

Reply
  • 0 in reply to LuCar Toni

    I just checked again and every successful authentication I see has no src_ip and the established connections are showing the VPN private subnet IP.  I also checked datalakes and every successful VPN connection doesn't show a locations because all src ips are internal DHCP VPN ips.

Children
No Data