Sophos XG in vSphere/ESXi - can't access vmware host client through SSL VPN

Dma0,

if you are trying to access the Admin Interface from VPN, make sure to enable the Web Administration HTTPS for VPN zone under Administration > Device Access.

Thanks

Thank you Luk. No, I'm not trying to access the admin interface for Sophos XG, but rather the admin interface for vSphere/ESXi.

Ok. Did you create a vpn to LAN firewall rule?

Thanks

Yes, I did. While I haven't tried accessing everything on the LAN, what I have tried to access works fine. The only exception is the Host Client for vSphere.

Try to create a LAN to vpn firewall rule too. Make sure on both rules LAN to vpn and vpn to LAN) to remove any filter.

Thanks

Thanks again. Yes, this is something that someone else had also suggested in response to a general question on getting VPN up and running. I have created the rule as you've suggested but alas, still no luck. The firewall log shows the packets from the remote connection to vSphere being allowed, but no ping, no access to the web host client. Hmm.

I will perhaps apologize in advance for (yet another) dumb question, but might it have anything to do with the fact that the IP address for vSphere is a static IP address that was set in vSphere (and not as a static DHCP lease in Sophos)?

stupid question? Does the vSphere has XG configured as its default gateway?
If not, enabling masquerade on SSLVPN->LAN rule might be a workaround

DMA0,

can you share the output of drop-packet-capture "port 443" while you are accessing the Vmware ESXi?

Does a telnet to ESXi on port 443 work?

Make sure that ESXi is able to reach XG and vice-versa internally.

Thanks.

DMA0,

can you share the output of drop-packet-capture "port 443" while you are accessing the Vmware ESXi?

Does a telnet to ESXi on port 443 work?

Make sure that ESXi is able to reach XG and vice-versa internally.

Thanks.

Thanks Luk - sixteen again's note was able to resolve the problem for me so looks like no need. I do appreciate it though.