Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 19 replies
  • Subscribers 31 subscribers
  • Views 37037 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN Stopped Working - SFOS 16.05.1 MR-1

ShawnGilronan

I recently updated my Sophos XG Firewall to the latest firmware SFOS 16.05.1 MR-1 from v15.  After updating, I noticed my SSL VPN stopped working.  After trying everything I could read to get it to work, I started from scratch, and recreated the SSL VPN, following the guide published here:  https://community.sophos.com/products/xg-firewall/f/vpn/86979/i-need-instructions-step-by-step-setting-up-xg-105-ssl-vpn-remote-access

 

After having everything setup as per the guide, each time I try and connect, I get the same error: 

tls error: tls key negotiation failed to occur within 60 seconds.

 

I have tried both the Sophos SSL client, as well as SecurePoint SSL, and receive the same issue when trying to connect over UDP.

I'm not sure what to try next.

Thanks,

Shawn



This thread was automatically locked due to age.
  • 0

    Ran into the same issue. Switching to TCP resolves issue. 

  • 0 in reply to MattColford

    I switched to TCP, re-downloaded the configuration and its still not working.

    Here is the error I receive:

    TCP: connect to [AF_INET]76.189.XXX.XXX:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive

  • 0

    I had the same problem on 3 different appliances, in each scenario all I had to do was go into the SSL VPN settings, turn on debugging mode and apply changes.  Almost instantly the SSL VPN clients would connect and then when turning debug back off the clients would disconnect and reconnect but would continue to work afterwards.  I initially found this as I was going to use debugging to troubleshoot the issue.  I would be interested to know if it worked for you as well because when I opened support cases they stated they had no other instances of this.

  • 0 in reply to hjherron6

    I tried to enable debugging in the VPN settings, and it produced not difference, I'm still receiving the same problem/error.

    Fri Mar 03 11:28:40 2017 OpenVPN 2.3.8 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [IPv6] built on Dec 9 2016
    Fri Mar 03 11:28:40 2017 library versions: OpenSSL 1.0.1u 22 Sep 2016, LZO 2.09
    Fri Mar 03 11:28:40 2017 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
    Fri Mar 03 11:28:40 2017 Need hold release from management interface, waiting...
    Fri Mar 03 11:28:40 2017 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
    Fri Mar 03 11:28:40 2017 MANAGEMENT: CMD 'state on'
    Fri Mar 03 11:28:40 2017 MANAGEMENT: CMD 'log all on'
    Fri Mar 03 11:28:40 2017 MANAGEMENT: CMD 'hold off'
    Fri Mar 03 11:28:40 2017 MANAGEMENT: CMD 'hold release'
    Fri Mar 03 11:28:47 2017 MANAGEMENT: CMD 'username "Auth" "aiden07"'
    Fri Mar 03 11:28:47 2017 MANAGEMENT: CMD 'password [...]'
    Fri Mar 03 11:28:47 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]
    Fri Mar 03 11:28:47 2017 Attempting to establish TCP connection with [AF_INET]76.189.XXX.XXX:8443 [nonblock]
    Fri Mar 03 11:28:47 2017 MANAGEMENT: >STATE:1488558527,TCP_CONNECT,,,,,,
    Fri Mar 03 11:28:57 2017 TCP: connect to [AF_INET]76.189.XXX.XXX:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive.
    Fri Mar 03 11:29:02 2017 MANAGEMENT: >STATE:1488558542,TCP_CONNECT,,,,,,
    Fri Mar 03 11:29:12 2017 TCP: connect to [AF_INET]76.189.XXX.XXX:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive.
    Fri Mar 03 11:29:17 2017 MANAGEMENT: >STATE:1488558557,TCP_CONNECT,,,,,,
    Fri Mar 03 11:29:27 2017 TCP: connect to [AF_INET]76.189.XXX.XXX:8443 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive.
    Fri Mar 03 11:29:32 2017 MANAGEMENT: >STATE:1488558572,TCP_CONNECT,,,,,,

  • 0 in reply to ShawnGilronan

    Get down to the shell via SSH and try starting the service via this command:

    service sslvpn:start -d -s nosync

    I've been working a tech support case on SSL VPN and the service technician did that to get things going after updating to 16.05.1MR-1.

    HTH

  • 0 in reply to MattLinzbach

    I'm at a loss, tried to stop/start services and the issue remains.

  • 0 in reply to ShawnGilronan

    GUI and console didn't work for me.  Only the above line from the device management, advanced shell worked for me.

  • 0 in reply to MattLinzbach

    Thats what I did. Device Management > Advanced Shell > then ran the command 

  • 0 in reply to ShawnGilronan

    I believe it may have something to do with the firewall rules.  I tried to login with a different, incorrect password, it it appears the packets are even getting through to authenticate the user.

  • 0 in reply to ShawnGilronan

    Does anyone have any additional suggestions?  I am going out of town for work next week, and would like to be able to use my VPN.

    I feel it has something to do with the firewall policy settings, due to UDP simply timing out, and TCP not even getting to the point of user auth.  

    I setup my firewall policy settings as per the instructions, and everything worked properly until I upgraded to SFOS 16.

    Thank you for any assistance.

    -SG