Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN SOPHOS XG 19.5 Build 197

Hey Guys,

I have followed the guides for creating an SSL-VPN that authenticates through Active Directory.

When I have my laptop internal to the network and initiate a VPN connect it works fine. Connection is established. The logs show this.

However once I disconnect the laptop from the network and connect a modem it doesn't establish a connection. (Firewalls are off for testing).

I can see the modem's IP ( but eventually I get a time out)

console> tcpdump "port 8443"

listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
19:27:38.605354 Port2, IN: IP 1.142.204.101.2482 > 139.186.212.247.8443: Flags [S], seq 2227587121, win 65320, options [mss 1420,nop,wscale 8,nop,nop,sackOK], length 0
19:27:39.501144 Port2, IN: IP 1.142.204.101.2482 > 139.186.212.247.8443: Flags [S], seq 2227587121, win 65320, options [mss 1420,nop,wscale 8,nop,nop,sackOK], length 0
19:27:41.523418 Port2, IN: IP 1.142.204.101.2482 > 139.186.212.247.8443: Flags [S], seq 2227587121, win 65320, options [mss 1420,nop,wscale 8,nop,nop,sackOK], length 0

19:27:53.529893 Port2, IN: IP 1.142.204.101.2482 > 139.186.212.247.8443: Flags [S], seq 2227587121, win 65320, options [mss 1420,nop,wscale 8,nop,nop,sackOK], length 0

Any idea's on what the problem might be? Thanks Could it be the modems ISP blocking?

I don't think the sslvpn.log is showing anything when I try to connect from an external source. Lots of stuff in there when I connect from inside the network (which is pointless but did it for testing). 



This thread was automatically locked due to age.
Parents
  • Hi Christopher Kurdian

    Please check no firewall rules are configured from WAN to LAN with ANY Service allowed. Further, check traffic flow  under MONITOR & ANALYZE || Diagnostics || Packet Capture and drop packet to investigate the issue. 

    Before checking about the steps make sure you have allowed 8443 TCP UDP ports on your ISP modem router as well for the Sophos XG firewall

    Regards

    "Sophos Partner: Infrassist Technologies Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

  • A very Big Thank You to you Bharat,

    With the information you gave me (something I wasn't aware of how to do). I was able to track down the issue.

    It was an old orphaned NAT rule!

    The SSL is now working. Even though this is a test and education environment, I guess it pays to keep it clean! 

    The process helped me identify the NAT ID causing the problem.

    The NAT Rule that caused the issue.

Reply
  • A very Big Thank You to you Bharat,

    With the information you gave me (something I wasn't aware of how to do). I was able to track down the issue.

    It was an old orphaned NAT rule!

    The SSL is now working. Even though this is a test and education environment, I guess it pays to keep it clean! 

    The process helped me identify the NAT ID causing the problem.

    The NAT Rule that caused the issue.

Children