Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.
Hi Community,
In certain user situations, the SSL VPN Client download may incorrectly be presented as a 0 byte download from the User Portal.
This Community post outlines several troubleshooting suggestions.
Ensure the default / custom CA details are properly configured
- Is a custom CA being used?
- If so, does the issue occur if the default self-signed certificate is used instead?
If using the default self-signed certificate resolves the issue, please verify the custom CA is properly assembled (proper signing CA, etc.)
User Certificate Generation is failing
To regenerate an individual user's SSL VPN certificate, you will have to navigate on the XG GUI and delete their user certificate (Certificates > Certificates)
- Their user certificate will then be regenerated the next time the user signs into the XG User Portal and downloads their SSL VPN Configuration.
If you are still experiencing issues, you can regenerate the Default CA by navigating to Certificates > Certificate Authorities
This will force the regeneration of all SSL VPN user certificates and will also restart the SSL VPN service.
- See KBA 123047
- https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Certificates/CertificateAuthorities/CertificateAuthorityRegenerate/index.html
Note: that if any of these actions are performed, affected users will have to re-download their SSL VPN installation file to utilize the new certificate.
Check the /tmp partition on device
- Reference this KBA to access the device’s advanced shell:
Navigate to the /tmp partition and investigate if the following SSL VPN files are present
# cd tmp# cd /content/sslvpn# ls- Confirm if the following SSL VPN files are present in /content/sslvpn:
rw-rr- 1 1000 100 413 Apr 24 2015 client-config-template.ovpnrw-rr- 1 1000 100 111.1K Jun 17 19:35 ssl-vpn-config-installer.exerw-rr- 1 1000 100 1.4M Jun 17 19:35 ssl-vpn-client-installer.exerw-rr- 1 1000 100 72 Jun 17 19:49 U2DVERSION
If files are not present, try to manually update patterns for SSL VPN Module
- If patterns fail to update, please contact Sophos Support
Check if the /tmp partition is full
- #
df –h 
- If full, please content Sophos Support for further assistance
Update the device’s patterns
- Try performing a manual pattern update
- Backup & firmware > Pattern Updates > “Update Pattern”
- If patterns fail to update, please contact Sophos Support
Regards,
Edited TAGs for test
[edited by: emmosophos at 9:50 PM (GMT -7) on 13 Sep 2024]
