HTTPS errors accessing web sites from SSL VPN after v15 to v16 upgrade

HI MiroslavCacija, 

is the Certificate applied on the SSL VPN policy same as the Certificate Prompt while accessing the WEB URL Via SSL .?

Yes, appliance certificate.

Hi Miroslav,

Please post the SSL configuration screenshots. Refer #1 in my guide here. Any catch?

Thanks

Edit

Hi Miroslav,

In the VPN_LAN rule, uncheck the "match known user" option. Also make VPN Source Network > ANY.

Configure a LAN_VPN FW-rule (without MASQ selected) and same conditions as in the VPN_LAN rule. 

Did you check #1 in the guide I mentioned. If you want this thread to get towards resolution, we would require the backend logs as suggested.

Thanks

Sachin,

The rule he created seems correct. Why a LAN to vpn policy rule is needed? Also why the match know users should break the firewall rule?

I do not understand your point of view. If your suggestions make the https works , this is not a normal behavior. It does not make sense!

Sorry about that!

lferraraa absolutely. I don't understand why, just after the upgrade something that was working perfectly, now doesn't works. Why should I change policy, if it was working without problems just before the upgrade ? HTTPS scanning is disabled, but still this type of traffic gets intercepted, and I cannot connect to any HTTPS site over VPN ... I'll contact support, as it seems that there is no configuration errors here in my case ... 

Hi Luk,

We require bidirectional rules to process traffic in both conditions, monitor the traffic through packet capture option in XG you can see that LAN_VPN traffic might not be forwarded out. Again, it will be a great learning curve if the traffic does route out with v16. But my takes on this will be to create one more rule that I feel is missing "LAN ANY VPN without MASQ". The match known user option is not required as the initial authentication (when

The match known user option is not required as the initial authentication (when connection is made from SSL client to XG) is managed by an intermediate PAM module which interacts with the VPN authentication and Access Server. So the User traffic is authenticated by default. Specifying the user match inside a FW-rule is not required.

Hope that clears the doubt.

Thanks