Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 8613 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Route push with macOS built-in vpn client and split tunnel?

Hakan Marklund

Hi,

I've read many threads about this on this forum, but most of them are too specific and don't really help me forward in this.

 

Background:

I work mainly with Mac clients, and have since I discovered the Sophos/Astaro UTM some years ago always sold their products to our clients because of the easy of use and powerful capabilities. The only thing not working in our installations has always been using the Sophos built-in vpn. That has been solved by using macOS Server's vpn server by just passing the correct udp ports (1701, 500 and 4500 for L2TP). Since the update of macOS to 10.12.x (Sierra) I've encountered problems with this setup and thought I'd pick up the thread where I left it 4 years ago, in this thread:

https://community.sophos.com/products/unified-threat-management/f/vpn-site-to-site-and-remote-access/54956/l2tp-ipsec-pushing-routing-table-down-to-a-vpn-client

and according to Sophos, who declined my suggestion, it is impossible to push routes down to L2TP clients in split tunnel mode, which it appears not to be, since that is the only reason I've been using a separate macOS Server (which has done so well until 10.12.x) and not the Sophos built-in L2TP server:

http://ideas.sophos.com/forums/17359-utm-feature-requests/suggestions/4038747-configure-route-pushes-to-l2tp-ipsec-pptp

 

Question:

Has anybody managed to configure *any* of the available vpn services in Sophos UTM/SG which supports route pushing (i e having the box where you can configure "Local Networks") for use with *any* of the available built-in vpn client protocols in macOS, using split tunnel mode?

I've always had this problem, and I discussed it with the teacher during my certification back in 2013, running whatever version was available then of both UTM and OS X, up until current versions of both. I just want to know if anybody out there has found a way to use Sophos UTM with native macOS vpn client(s), use split tunneling and have routes for local subnets pushed to vpn clients, and share their information.

 

I found this thread:

https://community.sophos.com/products/unified-threat-management/f/vpn-site-to-site-and-remote-access/80755/cisco-vpn-not-working

where BAlfson mentions that he doesn't do Mac, but expects it to work with the iOS vpn config. I got iOS to connect to Sophos Cisco VPN service even with a certificate, and got my hopes up reading/trying that. But I haven't been able to get that setup to work for macOS.

 

Before people start replying about tunneling all traffic to the UTM and using 3rd party software like Tunnelblick and Sophos SSL VPN, I can confirm that I'm aware of those solutions and it's working flawlessly, but that is not a satisfactory solution for me/us and I'm not interested in answers suggestioning/insisting reconsidering, thank you. Sorry about mentioning this, but I've read too many threads of people ignoring the specific needs of mentioned in questions, thus not giving helpful answers.

 

Thank you all in advance,

Kind regards, Håkan



This thread was automatically locked due to age.
Parents
  • 0

    Håkan, I don't think there's a way to push a route to an L2TP/IPsec client.  What specific routing problem are you having - what traffic goes to the wrong place?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Thanks for replying Bob! As I said, I've never had problems pushing routes to (native Mac) L2TP clients from (macOS Server) L2TP server. In macOS Server there's a textbox (similar to those in Sophos UTM, in all but L2TP and PPTP) which allows entering networks, netmasks and selection if those are private or public. The route problems only occurs when the customer has multiple lans behind their firewall, for example a dmz or a red tunnel to branch offices etc. But it has always been possible to workaround by passing L2TP ports to the macOS server. And it still is possible. I think that my subject line was poorly chosen, I missed putting in "any" vpn client. What I'm looking for is any way to use a native macOS vpn type (L2TP, Cisco IPSEC or IKEv2) with Sophos UTM, AND being able to push routes. Preferably with a certificate, but that's not a must. Maybe I will write another post, where it doesn't look like my primary need is routing pushing, which it kind of is, but I'm not limited to use L2TP.
Reply
  • 0 in reply to BAlfson
    Thanks for replying Bob! As I said, I've never had problems pushing routes to (native Mac) L2TP clients from (macOS Server) L2TP server. In macOS Server there's a textbox (similar to those in Sophos UTM, in all but L2TP and PPTP) which allows entering networks, netmasks and selection if those are private or public. The route problems only occurs when the customer has multiple lans behind their firewall, for example a dmz or a red tunnel to branch offices etc. But it has always been possible to workaround by passing L2TP ports to the macOS server. And it still is possible. I think that my subject line was poorly chosen, I missed putting in "any" vpn client. What I'm looking for is any way to use a native macOS vpn type (L2TP, Cisco IPSEC or IKEv2) with Sophos UTM, AND being able to push routes. Preferably with a certificate, but that's not a must. Maybe I will write another post, where it doesn't look like my primary need is routing pushing, which it kind of is, but I'm not limited to use L2TP.
Children
No Data
Unfiltered HTML