HTTPS errors accessing web sites from SSL VPN after v15 to v16 upgrade

Miroslav,

can you share a screenshot of the error message you get? Also can you share the policy rule applied to SSL VPN users?

Thanks

Before the upgrade, when connected to SSL VPN, I could browse normally RD WEB ( or any HTTPS web on the remote network ), now I'm getting error, because Sophos is intercepting HTTPS traffic:

When using the same web site form inside ( via RDP ), it asks for certificate from my local CA, and everything works. But, when connected via VPN, it asks for Sophos certificate ( since the upgrade to v16 ). But, HTTPS scanning is disabled in VPN rule. And I cannot access the site ( any HTTPS site ) form VPN. Strange.

HI MiroslavCacija, 

is the Certificate applied on the SSL VPN policy same as the Certificate Prompt while accessing the WEB URL Via SSL .?

Yes, appliance certificate.

Hi Miroslav,

Please post the SSL configuration screenshots. Refer #1 in my guide here. Any catch?

Thanks

Edit

Hi Miroslav,

In the VPN_LAN rule, uncheck the "match known user" option. Also make VPN Source Network > ANY.

Configure a LAN_VPN FW-rule (without MASQ selected) and same conditions as in the VPN_LAN rule. 

Did you check #1 in the guide I mentioned. If you want this thread to get towards resolution, we would require the backend logs as suggested.

Thanks

Sachin,

The rule he created seems correct. Why a LAN to vpn policy rule is needed? Also why the match know users should break the firewall rule?

I do not understand your point of view. If your suggestions make the https works , this is not a normal behavior. It does not make sense!

Sorry about that!

lferraraa absolutely. I don't understand why, just after the upgrade something that was working perfectly, now doesn't works. Why should I change policy, if it was working without problems just before the upgrade ? HTTPS scanning is disabled, but still this type of traffic gets intercepted, and I cannot connect to any HTTPS site over VPN ... I'll contact support, as it seems that there is no configuration errors here in my case ... 

lferraraa absolutely. I don't understand why, just after the upgrade something that was working perfectly, now doesn't works. Why should I change policy, if it was working without problems just before the upgrade ? HTTPS scanning is disabled, but still this type of traffic gets intercepted, and I cannot connect to any HTTPS site over VPN ... I'll contact support, as it seems that there is no configuration errors here in my case ...