I'm currently investigating the fact of using Sophos UTM in our company and I don't understand something about SSL VPN.
Let me introduce the situation:
We have 2 WAN connections:
- WAN1 which is the default gateway.
- WAN2 which is a ADSL line which must be used for VPN SSL purpose only.
The 2 WAN connections are not configured to function in Uplink Interfaces.
Also, we have a Internal network with all our network users.
I would like to set up a SSL VPN but I want this VPN to be configured on WAN2... What do I have to do? So far, I did the following:
- Configuration of User Portal listening on WAN2 interface on port 443. I don't want every interface to be used for User Portal. Allowed users is the group "VPN Users" (which is an AD group). Allowed network is "Any". I guess the hostname is only useful to add it in our internal DNS right, for Internal users access?
- Configuration of SSL VPN with some allowed users ("VPN Users" group) with access to all networks (no split tunneling, I want all the remote user traffic to come in the UTM). It's listening on port 443 on WAN2 interface also. Hostname has been configured with a correct external DNS. I also checked the auto-firewall rules option.
Second image: VPN SSL 2
- On masquerading I have the following:
Internal --> WAN1
VPN Users (User Group Network) --> WAN1 ==> to enable our remote users to access the Internet for example
Masquerading rules
- On firewall rules:
Internal | "Any" Protocol | "Any" destination HERE
VPN Users (User Group Network) | "Any" Protocol | "Any" destination HERE
Unfortunately, when trying to reach WAN2 interface with a remote user, I have nothing. No user portal :/
If I replaced WAN2 interface by WAN1 interface in User Portal and SSL VPN listening interface, it works. How can I use my WAN2 interface (which is not the default GW) for SSL VPN?
I also tried to put WAN2 as default gateway and changing all rules and then put WAN1 for SSL VPN purpose but it still doesn't work.
The aim, at the end, is to have 3 WANs:
- WAN1 & WAN2 configured as Gateway by using Uplink Interfaces.
- WAN3 which will be used for VPN SSL.
Is it possible? Can you help me by telling me what I did wrong?
Don't hesitate to ask me further information if needed, even screenshots if necessary.
Thanks a lot Sophos guys.
Regards,
DeltaSM
This thread was automatically locked due to age.
