This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL VPN and Exchange Connection over Outlook 2k7

Hey there!

Many of us have a really strange problem with Outlook when we want to connect to our office over the SSL-VPN.

We have an Virtual UTM 9 Sophos Appliance with the Firmware-Level: 9.101-12

The SSL-VPN has automatic Firewall rules and the local network is our intranet so from there everything should be fine.

So the SSL-Pool has 10.100.2.X with 255.255.255.252 as a subnet. Our internal DNS-Servers which are also give to the VPN-Adapter have 192.168.10.X

Now to the problem:
When we connect via SSL-VPN to our office we can resolve DNS-Names from our Windows Servers and go to them over Remotedesktop, also file-shares are accessable - but then... there is the Exchange-Server (2010).

Outlook 2007 can't connect to the Exchange while the VPN is running besides all other stuff is working.

I have just now seen only 2 problems:
1. The VPN-Network Adapter doesn't get a default gateway which i should need to access other networks...

2. Windows i trying to identify the network because of the missing default gateway and won't stop from trying

Since i couldn't stop the Network Identification with a registry Key i assume it would be the best if the ssl-vpn client would get the gateway information trough the ssl-vpn...

soo... how can i get the gateway information transferred to the client? In the Sophos Remote Access Section there isn't a way to set a gateway...

Regards

:Edit:
Still the same when using the latest OpenVPN Version...

:Edit: another new thing:

Without the gateway i can't ping the fqdn of our domain or servers. With the attached fqdn altough it will work, when i just enter the server name...

With the gateway i can resolve the fqdn and if i just type in the servername, i also get the answer from servername.fqdn...

and naturally without a gateway in the SSL-VPN Adapter how should my laptop know where to search for domain.local? Google won't find it....

nslookup work fine tough... with and without the fqdn...

This thread was automatically locked due to age.

0 apijnappels over 11 years ago

Usually using SSL-remote access, your client should set up routes as part of the connection. These routes are then deleted again after disconnection.
Perhaps your Internal DNS resolves an IP-address of your Exchange server FQDN to the VPN-clients that they cannot reach?

Managing several Sophos UTMs and Sophos XGs both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Sometimes I post some useful tips on my blog, see blog.pijnappels.eu/category/sophos/ for Sophos related posts.
Cancel
Vote Up 0 Vote Down

Cancel
0 Seelbreaker over 11 years ago

The Routes are created:
(VPN-Adapter has 10.242.2.6)
and the route says:

Network-Target Subnet Gateway Adapter Metrik
192.168.10.0 255.255.255.0 10.242.2.5 10.242.2.6 30

Pings are resolved to the correct adress and the pings are getting trough.
When i add the fqdn i get an instant Error: "can't find the hostname"

and the ip-adress is definitely the same checked that with nslookup...
Cancel
Vote Up 0 Vote Down

Cancel
0 scorpionking over 11 years ago
Did you add your internal DNS servers and domain in Remote Access -> Advanced?
----------
Sophos user, admin and reseller.
Private Setup:

XG: HPE DL20 Gen9 (Core i3-7300, 8GB RAM, 120GB SSD) | XG 18.0 (Home License) with: Web Protection, Site-to-Site-VPN (IPSec, RED-Tunnel), Remote Access (SSL, HTML5)

UTM: 2 vCPUs, 2GB RAM, 50GB vHDD, 2 vNICs on vServer (KVM) | UTM 9.7 (Home License) with: Email Protection, Webserver Protection, RED-Tunnel (server)
Cancel
Vote Up 0 Vote Down

Cancel
0 Seelbreaker over 11 years ago in reply to scorpionking

Did you add your internal DNS servers and domain in Remote Access -> Advanced?

Yes, the internal DNS-Servers and WINS Servers and Domain Name is there.

What wonders me is that 3 people can work.

I've had this problem since a fresh installation of windows to a new Laptop and our CEO now got this problem 3 days after we migrated him from pptp to ssl.... [:(]

Normally i would say it is a problem with my laptop, but then can't answer myself why it works wonderfully when i add the ip-settings manually when the vpn is created and additionally add the gateway... (10.242.2.5 in the case the adapter gets the 10.242.2.6 assigned)
Cancel
Vote Up 0 Vote Down

Cancel
0 scorpionking over 11 years ago
Well, the non-working FQDN DNS resolution might be your problem, as Outlook uses the FQDN to contact Exchange.

When connected via SSL VPN, what does an "ipconfig /all" in cmd say (especially at the SSL VPN interface)? Is there a local DNS suffix listed which is the same as your internal domain?
What does "nslookup " say?
----------
Sophos user, admin and reseller.
Private Setup:

XG: HPE DL20 Gen9 (Core i3-7300, 8GB RAM, 120GB SSD) | XG 18.0 (Home License) with: Web Protection, Site-to-Site-VPN (IPSec, RED-Tunnel), Remote Access (SSL, HTML5)

UTM: 2 vCPUs, 2GB RAM, 50GB vHDD, 2 vNICs on vServer (KVM) | UTM 9.7 (Home License) with: Email Protection, Webserver Protection, RED-Tunnel (server)
Cancel
Vote Up 0 Vote Down

Cancel
0 Seelbreaker over 11 years ago in reply to scorpionking

Well, the non-working FQDN DNS resolution might be your problem, as Outlook uses the FQDN to contact Exchange.

When connected via SSL VPN, what does an "ipconfig /all" in cmd say (especially at the SSL VPN interface)? Is there a local DNS suffix listed which is the same as your internal domain?
What does "nslookup " say?

Now i also fear that this will be the problem... so to your next questions:

the VPN-Adapter gets the right dns-suffix also dns- and wins-server
everything is filled in, only the default gateway for the vpn-adapter is missing...

nslookup exchange.mydomain.local
Cancel
Vote Up 0 Vote Down

Cancel
0 scorpionking over 11 years ago
There will never be a default gateway set, as long as you don't want to route all client's traffic through the VPN. So this is absolutely fine.

You can check the priority of the network adaptors: (Win7/8, translated from german, so might be a little different)
Network and Sharing Center -> Change Adapter settings (on the left menue) -> Press ALT -> Advanced -> Advanced Settings -> Check if your SSL Adapter is at the top.

You can also try to start the SSL Client "As Administrator" for testing...
----------
Sophos user, admin and reseller.
Private Setup:

XG: HPE DL20 Gen9 (Core i3-7300, 8GB RAM, 120GB SSD) | XG 18.0 (Home License) with: Web Protection, Site-to-Site-VPN (IPSec, RED-Tunnel), Remote Access (SSL, HTML5)

UTM: 2 vCPUs, 2GB RAM, 50GB vHDD, 2 vNICs on vServer (KVM) | UTM 9.7 (Home License) with: Email Protection, Webserver Protection, RED-Tunnel (server)
Cancel
Vote Up 0 Vote Down

Cancel
0 Seelbreaker over 11 years ago in reply to scorpionking

There will never be a default gateway set, as long as you don't want to route all client's traffic through the VPN. So this is absolutely fine.

ah damn... i mean the route tells me that i should get via the gateway ip-adress to my internal network but how should windows know this if no adapter has this gateway?...

You can check the priority of the network adaptors: (Win7/8, translated from german, so might be a little different)
Network and Sharing Center -> Change Adapter settings (on the left menue) -> Press ALT -> Advanced -> Advanced Settings -> Check if your SSL Adapter is at the top.

Done. VPN is at the top - if it wouldn't nslookup would go to my router instead of our domaincontroller...

You can also try to start the SSL Client "As Administrator" for testing...

Knew that this is needed so the setup can create the virtual network adapter and then for creating the routes, but i'm running with local admin rights and even starting it as an "administrator" doesn't change anything [:(]

:edit:
ok... found something new...
1 of our DCs has IPv6 enabled.

when i ping this one i get an ipv6 response back with the freakin suffix....
Cancel
Vote Up 0 Vote Down

Cancel
0 apijnappels over 11 years ago

Perhaps the binding order of your network interfaces are not right.
Usually the VPN-adapter should get a higher binding order so that when it is connected it uses this connection's DNS-settings.
If you do an ipconfig the VPN-adapter should be higher in the list than your LAN-adapter.

If you use Win7 (or 8), you can find how to correct this through the following URL:
networking - How can I change the binding order of network adapters in Windows 7? - Super User

Managing several Sophos UTMs and Sophos XGs both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Sometimes I post some useful tips on my blog, see blog.pijnappels.eu/category/sophos/ for Sophos related posts.
Cancel
Vote Up 0 Vote Down

Cancel

SSL VPN and Exchange Connection over Outlook 2k7

Submitted a Tech Support Case lately from the Support Portal?