Guest User!

You are not Sophos Staff.

Thread Info
  • Replies 28 replies
  • Subscribers 30 subscribers
  • Views 22018 views
  • Users 0 members are here
Options
Suggested

SSL VPN "IPv4 lease range" changes OR global settings update gives error "You must enter a network IP address." in SFOS v19.

Alok

Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.

Hello Community,

This Recommended Read goes over recent changes made in SFOS v19 related to SSL VPN IPv4

What is the change in SFOS v19 related to SSLVPN IPv4 lease? 

SFOS v19 improves supported SSLVPN concurrent tunnels by 4-5x. 

As a result, there is a change in the configuration of SSLVPN IPv4 lease range. SFOS v19 uses IP subnet value, however, earlier versions used IP range and subnet. 

 Migration will convert the IP range and subnet config from old versions to subnet value in v19. 

 SSLVPN Global config: 

 

Admin has to update IP lease range from IP address to subnet once after migration to avoid error like "You must enter a network IP address." on global settings update.

Am I impacted due to the change? What issue I may face? 

On upgrading to SFOS v19, some users may notice that SSL VPN is connecting but resources are not accessible over SSLVPN for the following conditions: 

  • If you are using SSLVPN prior to v19 version, and 
  • If you have allowed access of SSLVPN users using IP host object of limited range (same as SSLVPN global settings) in firewall rule. 

As v19 changes the limited IPv4 lease range to the larger subnet, users who have got the IP addresses outside the limited range will be restricted by Firewall rule to access the resources. 

How to resolve this issue? 

Update the IP host object of limited range to a;sp include the new IP range (subnet). 

Alternatively, you can start using system host available for SSLVPN IPv4 lease ##ALL_SSLVPN_RW. 

More details on How to configure remote access SSL VPN with Sophos Connect client.



Updated Disclaimer
[edited by: Erick Jan at 1:39 PM (GMT -7) on 17 Apr 2023]
Parents Reply
  • in reply to Lonnie Thibodeaux

    Hi Lonnie,

    In case of SSLVPN there is no separate DHCP server, openVPN manages the IP lease (dhcp) functionality. When we say "first iP of the subnet will be assign to SSLVPN server" it is used to bind on "tun" interface. 

    From v19 we have introduced multiple instance and hence each instance will create separate "tun" interface and sliced subnet from global config. 

    e.g. For two SSLVPN instance setup, subnet will be splitting into 2 and each one will be used for individual server.

    You can look for more details in the conf file. 

    Hence in this case First IP of both subnet will be used on "tun" interface respectively.

    Hope this clarifies your query.

Children
  • in reply to Alok

    Hi Alok,

    I appreciate and understand (somewhat) your explanation.  My apologies for thinking 'First IP of the subnet' meant DHCP server.  So I understand that now.  I have change the VPN FW rules on my all XGs to use ##ALL_SSLVPN_RW instead of my original IP range which mimiced the v18 SSLVPN assignment range.  That way when I upgrade the other XGs, there should be no issue. All good at this point. I am assuming that the ##ALL_SSLVPN_RW range will not let it assign the DHCP address as an endpoint IP.

    On last question. Are we going to see this same change in L2TP settings in the future, as it was set up similar to SSLVPN with explicit from & to IP range. In v19 it remains as it did in v18. 

    Very much appreciated.

    Lonnie

  • in reply to Lonnie Thibodeaux

    This change in SSLVPN had to introduce as we were not able to scale beyond the certain limit with single server architecture and hence we moved to a multi-instance approach to scale up SSLVPN capacity in terms of concurrent tunnel support as well throughput. 

    We are not planning to make any enhancement to L2TP/PPTP services at the moment so that will stay as is.

  • in reply to Alok

    Hi Alok, so what's the Solution here for DNS?

    When I set DNS to default gateway of SSL VPN, it doesn't resolve hostname as it was prior to upgrade?

    We just have one Instance, so setting default gateway of SSL VPN shouldn't be a problem, but it doesn't work.

  • in reply to Gurtej Sangha

    Hi Gurtej,

    when you say default gateway are you setting "tun0" interface IP as DNS server?

    e.g. 192.168.5.1 if its (192.168.5.x/24 subnet)

    -Alok

  • in reply to Alok

    Hi Alok,

    Yes, you are right. We are setting "tun0" interface IP as DNS Server. e.g. 192.168.5.1 if its (192.168.5.x/24 subnet)

  • in reply to Gurtej Sangha

    Hi Gurtej,

    We tried this internally and its working fine. We tried in multi-instance setup following is working, despite user landing on any instance. 

    a. DNS IP used was tun0 interface IP 

    b. DNS IP used was tun1 interface IP 

    c. DNS IP used was LAN interface IP 

    Please check "drop pkt", local ACL, permitted network settings. 

    In case still it's failing please raise support case.

    -Alok

Unfiltered HTML