This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN Stopped Working - SFOS 16.05.1 MR-1

I recently updated my Sophos XG Firewall to the latest firmware SFOS 16.05.1 MR-1 from v15. After updating, I noticed my SSL VPN stopped working. After trying everything I could read to get it to work, I started from scratch, and recreated the SSL VPN, following the guide published here: https://community.sophos.com/products/xg-firewall/f/vpn/86979/i-need-instructions-step-by-step-setting-up-xg-105-ssl-vpn-remote-access

After having everything setup as per the guide, each time I try and connect, I get the same error:

tls error: tls key negotiation failed to occur within 60 seconds.

I have tried both the Sophos SSL client, as well as SecurePoint SSL, and receive the same issue when trying to connect over UDP.

I'm not sure what to try next.

Thanks,

Shawn

This thread was automatically locked due to age.

Parents

0 MattColford over 8 years ago

Ran into the same issue. Switching to TCP resolves issue.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 MattColford over 8 years ago

Ran into the same issue. Switching to TCP resolves issue.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 ShawnGilronan over 8 years ago in reply to MattColford

I switched to TCP, re-downloaded the configuration and its still not working.

Here is the error I receive:

TCP: connect to [AF_INET]76.189.XXX.XXX:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive
Cancel
Vote Up 0 Vote Down

Cancel
0 MattLinzbach over 8 years ago in reply to ShawnGilronan

Get down to the shell via SSH and try starting the service via this command:

service sslvpn:start -d -s nosync

I've been working a tech support case on SSL VPN and the service technician did that to get things going after updating to 16.05.1MR-1.

HTH
Cancel
Vote Up 0 Vote Down

Cancel
0 ShawnGilronan over 8 years ago in reply to MattLinzbach

I'm at a loss, tried to stop/start services and the issue remains.
Cancel
Vote Up 0 Vote Down

Cancel
0 MattLinzbach over 8 years ago in reply to ShawnGilronan

GUI and console didn't work for me. Only the above line from the device management, advanced shell worked for me.
Cancel
Vote Up 0 Vote Down

Cancel
0 ShawnGilronan over 8 years ago in reply to MattLinzbach

Thats what I did. Device Management > Advanced Shell > then ran the command
Cancel
Vote Up 0 Vote Down

Cancel
0 ShawnGilronan over 8 years ago in reply to ShawnGilronan

I believe it may have something to do with the firewall rules. I tried to login with a different, incorrect password, it it appears the packets are even getting through to authenticate the user.
Cancel
Vote Up 0 Vote Down

Cancel
0 ShawnGilronan over 8 years ago in reply to ShawnGilronan

Does anyone have any additional suggestions? I am going out of town for work next week, and would like to be able to use my VPN.

I feel it has something to do with the firewall policy settings, due to UDP simply timing out, and TCP not even getting to the point of user auth.

I setup my firewall policy settings as per the instructions, and everything worked properly until I upgraded to SFOS 16.

Thank you for any assistance.

-SG
Cancel
Vote Up 0 Vote Down

Cancel
0 MattColford over 8 years ago in reply to ShawnGilronan

What rules do you have? For mine to work, I have the following;

Rule #1

Source: VPN

Any Service

Dest: LAN

Enable MASQ

Rule #2

Source: LAN

Any Service

Dest: VPN

Also, in the remote access config, for permitted resources I had to manually make a definition for the LAN, rather than just use "port1"
Cancel
Vote Up 0 Vote Down

Cancel
0 ShawnGilronan over 8 years ago in reply to MattColford

My rules appear to match yours exactly.

Rule #1:

Rule #2
Cancel
Vote Up 0 Vote Down

Cancel
0 MattColford over 8 years ago in reply to ShawnGilronan

Try disabling "match known users". Also does your SSL VPN profile have the network as a definition or just the port/bridge?
Cancel
Vote Up 0 Vote Down

Cancel