Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 4 replies
  • Subscribers 27 subscribers
  • Views 644 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN SOPHOS XG 19.5 Build 197

Christopher Kurdian

Hey Guys,

I have followed the guides for creating an SSL-VPN that authenticates through Active Directory.

When I have my laptop internal to the network and initiate a VPN connect it works fine. Connection is established. The logs show this.

However once I disconnect the laptop from the network and connect a modem it doesn't establish a connection. (Firewalls are off for testing).

I can see the modem's IP ( but eventually I get a time out)

console> tcpdump "port 8443"

listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
19:27:38.605354 Port2, IN: IP 1.142.204.101.2482 > 139.186.212.247.8443: Flags [S], seq 2227587121, win 65320, options [mss 1420,nop,wscale 8,nop,nop,sackOK], length 0
19:27:39.501144 Port2, IN: IP 1.142.204.101.2482 > 139.186.212.247.8443: Flags [S], seq 2227587121, win 65320, options [mss 1420,nop,wscale 8,nop,nop,sackOK], length 0
19:27:41.523418 Port2, IN: IP 1.142.204.101.2482 > 139.186.212.247.8443: Flags [S], seq 2227587121, win 65320, options [mss 1420,nop,wscale 8,nop,nop,sackOK], length 0

19:27:53.529893 Port2, IN: IP 1.142.204.101.2482 > 139.186.212.247.8443: Flags [S], seq 2227587121, win 65320, options [mss 1420,nop,wscale 8,nop,nop,sackOK], length 0

Any idea's on what the problem might be? Thanks Could it be the modems ISP blocking?

I don't think the sslvpn.log is showing anything when I try to connect from an external source. Lots of stuff in there when I connect from inside the network (which is pointless but did it for testing). 



This thread was automatically locked due to age.
  • +2

    Hi Christopher Kurdian

    Please check no firewall rules are configured from WAN to LAN with ANY Service allowed. Further, check traffic flow  under MONITOR & ANALYZE || Diagnostics || Packet Capture and drop packet to investigate the issue. 

    Before checking about the steps make sure you have allowed 8443 TCP UDP ports on your ISP modem router as well for the Sophos XG firewall

    Regards

    "Sophos Partner: Infrassist Technologies Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Bharat J

    Thanks, Bharat for your reply, much appreciated.

    For the purpose of testing, I did disable all rules on the firewall with the "WAN to LAN with ANY Service" in mind (expect the default rule). Hopefully disabling rules is enough. When I get home tonight I will re-check anyway and clean this up if necessary and re-test. 

    I did call my ISP for previous SMTP issues (they were blocking them). They did say they have now opened everything up for me, so I hopeful this isn't the issue. (I might call them anyway to check and make sure)

    Thanks for the tip, will Configure capture filter as you suggested and report back.

    I do use the same modem to connect to other VPN's so I don't believe the modem and modem's (ISP) is the issue.

  • 0 in reply to Bharat J

    A very Big Thank You to you Bharat,

    With the information you gave me (something I wasn't aware of how to do). I was able to track down the issue.

    It was an old orphaned NAT rule!

    The SSL is now working. Even though this is a test and education environment, I guess it pays to keep it clean! 

    The process helped me identify the NAT ID causing the problem.

    The NAT Rule that caused the issue.

  • 0 in reply to Christopher Kurdian

    Hi Christopher Kurdian

    Original service is Any cause the issue 

    Glad you fix it, cheers!

    Thanks and Regards 

    "Sophos Partner: Infrassist Technologies Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

Unfiltered HTML