OpenVpn issue with hosted SLG

[sluggster66]

Hi

 

Hoping someone has come across this issue before.

 

We have a hosted SLG solution with Capita.

 

A few weeks ago we moved from a TMG to a Fortigate firewall, Since this move the OpenVpn client cannot connect to SLG, I get a TLS handshake timeout error. Capita have said this is firewall related, i am struggling to resolve the issue, as even when I allow all services out rule it still fails.

 

Any ideas would be great.

 

Thanks

[sluggster66]

Hi

 

Hoping someone has come across this issue before.

 

We have a hosted SLG solution with Capita.

 

A few weeks ago we moved from a TMG to a Fortigate firewall, Since this move the OpenVpn client cannot connect to SLG, I get a TLS handshake timeout error. Capita have said this is firewall related, i am struggling to resolve the issue, as even when I allow all services out rule it still fails.

 

Any ideas would be great.

 

Thanks

 

Any Ideas?

[azureusnation]

We had this and I'm glad to say I told capita the fix so I'm surprised they haven't told you.

 

Firstly make sure that port 1194 is open outbound.

Next is to look at your VPN config. Here's mine:

 

# Client Connections
client
dev tun
dev-node HostedSIMS
proto udp

# Concentrator Farm Details
remote-random
remote simsgateway.cloudapp.net 1194
resolv-retry infinite
nobind
route-method exe 

# TLS-auth preshared.key 1

# Keys
ca HostedSIMS\\ca.crt
cert HostedSIMS\\9265406.crt
key HostedSIMS\\9265406.key

# Set log file verbosity.
verb 3

# MTU Size
mssfix 1200

# Enable compression on the VPN link.
comp-lzo

 

What you need too play with is the mssfix value. I find 1200 to be a good number, really stable. Restart your OpenVPN service after changing it and then it should work but if need be lower the mssfix value till it works.

 

Thanks

 

Ashley

[sluggster66]

I'll give that a go.

 

Thanks

[sluggster66]

Unfortunately changing the MTU size didn't work.

 

Do any of you guys use fortigate?

 

I am seeing logs saying the traffic is being blocked by our deny all policy, but even when setting an all out rule on the server the traffic is still blocked.

[azureusnation]

Yeah we have fortigate.

 

We have ours going out on the same rule as our internet. Don't see why it would be getting blocked though. Have you opened 1194 as tcp or udp. It needs to be udp.

[sluggster66]

Yeah we have fortigate.

 

We have ours going out on the same rule as our internet. Don't see why it would be getting blocked though. Have you opened 1194 as tcp or udp. It needs to be udp.

 

 

 

It's really weird, I have UDP and TCP on port 1194 open. What's now interesting is that I can see traffic leaving but still no connection. Have you setup and inbound rule?

 

Thanks for the help

[azureusnation]

Hmm that is odd... no inbound rule for us. Is your rule natting? if its not I think it should. Let me check my firewalls.

[azureusnation]

Yep, my natting is on so you need that rule to be natted.

 

Also attach some of the OpenVPN logs so I can take a peek.

[sluggster66]

Might have sorted it, thanks to azureusnation.

 

I have dropped you a PM