SSL VPN Settings don't work

Thomas,

Make sure that the patterns are updated. If it does not work, generate the built-in CA and try again.

Also make sure users are ssl vpn enabled.

Let us know.

Thanks

hi,

thx for your quick answer,

the users are ssl vpn enabled and assigned a vpn policy. however, changing the ssl vpn settings (in the vpn section) has no effect, every time I open the settings they're back to default.

additionally, I cannot regenerate the certificate authority, terminating with the error message: Certificate Authority details could not be updated or certificates could not be regenerated. regenerating the appliance certificate has no effect.

all the best

Thomas

hi,

thx for your quick answer,

the users are ssl vpn enabled and assigned a vpn policy. however, changing the ssl vpn settings (in the vpn section) has no effect, every time I open the settings they're back to default.

additionally, I cannot regenerate the certificate authority, terminating with the error message: Certificate Authority details could not be updated or certificates could not be regenerated. regenerating the appliance certificate has no effect.

all the best

Thomas

Uhm...

What version are you running?

I have seen a similar behavior where the CA was not working correctly.

Try to change one field of the CA and save.

Then regenerate the built-in Certificate and try again to login to user portal.

I'm running 16.05 the latest release. There is nothing I can do to the CA. It's empty and if I fill in values I can save it but it ends with the error mentioned above.

Thomas,

Can you try to regenerate the certificate from the console?

Thanks

how do I do that?

by the way, I also tried a lean install and it ends up the same ....

Thomas,

The CA should be Appliamce SSL and not default.

To reset the certificate, connect to console using putty and then under device management (I guess) you find reset web certificate.

Unfortunately, regarding the VPN settings nothing really changed...

however, I have to head back to the office now as there is no way to connect to the device remotely: This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox may only connect to it securely. As a result, it is not possible to add an exception for this certificate.

there is no Firefox security exception for this.....

Ok. Let us know.

I fixed the problem....... it was a long shot...

So here is what happened (and still happens to others).... 

It basically all depends on the information you put in when you open your sophos account. In this case my customer put an extraordinarily long company name in the company field plus it contained special characters (umlaut and ampersand).

Thus, the very moment the xg firewall goes online it connects to the sophos server and creates a certificate using the information stored within the sophos account. However, if this information contains special characters and/or is extremely long the created certificate does not work. The only way out I found was to log into the sophos account and and change the information to non-special characters and keep it short and simple and then reinstall the xg from scratch...

grazie per il tuo aiuto.... 

Nice!

I was quite sure that there was the certificate. Thanks for sharing your experience.

Regards