Always On VPN help please

[Squelch]

Can't see any typo's in my xml however looking at the MS example xml, the route information is within

I'm going to start the xml from scratch using MS's xml instead. Will post the results.

[Squelch]

I've made *slight* progress. After recreating the xml profile (and checking with notepad++ for erroneous characters)..

 

I still can't ping the DC but I can now ping another server on the network. All I get is a single reply then the other three time out. Like I said, not a lot of progress but it's definitely something.

 

[silvestre]

paste your xml again

[Squelch]

I added the two main IP's I need to get to in the traffic filter section.

 

[silvestre]

Hi remove the trafic filters first and redeploy if you can access everything. Once you get it working with it being fully open to the subnet you can then make further changes.

[3s-gtech]

Here's a variant of mine. I have two server ranges (1.0 and 2.0 below), so two static routes. This works for me, but I have two NICs and this configuration is not necessarily good practice - you need to tailor that to your needs and requirements. Also note that I install this directly within the Powershell, not as a separate XML file (shouldn't make a difference though).

 

my.vpn.server.com
IKEv2

Certificate


  SHA256128
  AES128
  AES128
  SHA256
  Group14
  PFS2048
 
SplitTunnel

true



172.19.1.0
24


172.19.2.0
24




172.19.1.0/24, 172.19.2.0/24


true

true

true

internal.domain.com

[Squelch]

Tried a tracert to 10.42.92.21

 

[silvestre]

needs further diagnosing, without access im afraid will be very difficult.

[Squelch]

I really appreciate your help today, if nothing else I've learned a lot about routing. Also, 3s-gtech thanks.

[silvestre]

np , i hope you find the solution

[JackCPickup]

Is this Windows Server 2016? If so is it fully up to date? There was an update last year that broke VPN routing.

[Squelch]

Thanks for the suggestion but it's on Server 2019, fully patched.

[scottm92]

Hey did you get anywhere with this? I may be able to assist - I spent a lot of time with Richard Hicks fixing the same problem, with the same setup. We too are using a Sophos Xg :

[Squelch]

I trashed the entire thing and started from scratch but got the same result again. I'm currently putting up with Sophos Connect as even though it isn't exactly what I want it works well enough for the school.

 

I would be interested to know what the problem with your setup was in case I do try again.

[scottm92]

I did the same - got so far, trashed it, recreated, we are also using Sophos Connect, however I understand better now what we need to solve the problem. Do you want to Teams or Zoom something to share some ideas?

[Squelch]

PM sent.

[CHiLL]

My Always-On VPN has been working for a couple of years now and we're currently using Sophos XG. Here is my config:

 

XML:

  domain.local
  true
  
external.fqdn.sch.uk
IKEv2

  Eap
  
   
    2500025trueCA.domain.local25 1a 81 b5 d6 7f c7 1b 94 cd 80 a1 52 c1 be 9f 7e ed e5 8c truefalse13truetrueCA.domain.local25 1a 81 b5 d6 7f c7 1b 94 cd 80 a1 52 c1 be 9f 7e ed e5 8c falsetruetruefalsefalsetruetrue
   
  

SplitTunnel
  
true
true
domain.local
  
.domain.local
10.22.11.11,10.22.11.12

 

Powershell script to deploy VPN and XML:

$ProfileName = Always-On VPN'
  $ProfileNameEscaped = $ProfileName -replace ' ', '%20'

  $ProfileXML = '

  domain.local
  true
  
external.fqdn.sch.uk
IKEv2

  Eap
  
   
    2500025trueCA.domain.local25 1a 81 b5 d6 7f c7 1b 94 cd 80 a1 52 c1 be 9f 7e ed e5 8c truefalse13truetrueCA.domain.local25 1a 81 b5 d6 7f c7 1b 94 cd 80 a1 52 c1 be 9f 7e ed e5 8c falsetruetruefalsefalsetruetrue
   
  

SplitTunnel
  
true
true
domain.local
  
.domain.local
10.22.11.11,10.22.11.12


'

  $ProfileXML = $ProfileXML -replace '<', '<'
  $ProfileXML = $ProfileXML -replace '>', '>'
  $ProfileXML = $ProfileXML -replace '"', '"'

  $nodeCSPURI = "./Vendor/MSFT/VPNv2"
  $namespaceName = "root\cimv2\mdm\dmmap"
  $className = "MDM_VPNv2_01"

  try
  {
  $username = Gwmi -Class Win32_ComputerSystem | select username
  $objuser = New-Object System.Security.Principal.NTAccount($username.username)
  $sid = $objuser.Translate([system.Security.Principal.SecurityIdentifier])
  $SidValue = $sid.Value
  $Message = "User SID is $SidValue."
  Write-Host "$Message"
  }
  catch [Exception]
  {
  $Message = "Unable to get user SID. User may be logged on over Remote Desktop: $_"
  Write-Host "$Message"
  exit
  }

  $session = New-CimSession
  $options = New-Object Microsoft.Management.Infrastructure.Options.CimOperationOptions
  $options.SetCustomOption("PolicyPlatformContext_PrincipalContext_Type", "PolicyPlatform_UserContext", $false)
  $options.SetCustomOption("PolicyPlatformContext_PrincipalContext_Id", "$SidValue", $false)

  try
  {
  $deleteInstances = $session.EnumerateInstances($namespaceName, $className, $options)
  foreach ($deleteInstance in $deleteInstances)
  {
  	$InstanceId = $deleteInstance.InstanceID
  	if ("$InstanceId" -eq "$ProfileNameEscaped")
  	{
  		$session.DeleteInstance($namespaceName, $deleteInstance, $options)
  		$Message = "Removed $ProfileName profile $InstanceId"
  		Write-Host "$Message"
  	} else {
  		$Message = "Ignoring existing VPN profile $InstanceId"
  		Write-Host "$Message"
  	}
  }
  }
  catch [Exception]
  {
  $Message = "Unable to remove existing outdated instance(s) of $ProfileName profile: $_"
  Write-Host "$Message"
  exit
  }

  try
  {
  $newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName
  $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", "$nodeCSPURI", "String", "Key")
  $newInstance.CimInstanceProperties.Add($property)
  $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", "$ProfileNameEscaped", "String",      "Key")
  $newInstance.CimInstanceProperties.Add($property)
  $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ProfileXML", "$ProfileXML", "String", "Property")
  $newInstance.CimInstanceProperties.Add($property)
  $session.CreateInstance($namespaceName, $newInstance, $options)
  $Message = "Created $ProfileName profile."

  Write-Host "$Message"
  }
  catch [Exception]
  {
  $Message = "Unable to create $ProfileName profile: $_"
  Write-Host "$Message"
  exit
  }

  $Message = "Script Complete"
  Write-Host "$Message"

 

This is deployed via SCCM to a machine collection not user collection. I don't know why it works this way, but I couldn't get it working deployed to the user. The only caveat is that the first user to sign into a device with this deployment assigned (including your domain admin account used to prep the device) will get it installed automatically. The next time a user logs on, it doesn't re-apply. So when I issue out laptops, I get the user to log on before they take it, then manually press the install button in Software Center to force install the VPN. (May require the "Allow end users to attempt to repair this application" in the deployment settings). Another bug that I've found is that the VPN will randomly remove itself from the user's account, for reasons I've never figured out. To fix this, you need the user to bring the device in, log on as that user and repair the VPN installation from Software Center.

 

Another thing we had to configure on our side was making sure that all paths, be it shortcuts, GPO policies, SIMS, etc referenced the FQDN path instead of the NetBIOS name for network devices. Due to it being split tunnel, it was trying to find NetBIOS paths on the user's home network instead of tunnelling it to the domain.

Edited March 28, 2022 by CHiLL

[Squelch]

Thank you for the information, my current situation is I do not have AOVPN infrastructure setup (other than the XG config) and I will be rebuilding it after the Easter break due to other work commitments.

I appreciate your time taken to reply.

[scottm92]

What rules do you have in your XG Chill? Mine works for so long, then disconnects and won't reconnect. Seems like the session is being killed and not re-established. I have tried using both NAT and DNAT.

[CHiLL]

What rules do you have in your XG Chill? Mine works for so long, then disconnects and won't reconnect. Seems like the session is being killed and not re-established. I have tried using both NAT and DNAT.

DM sent!

[alexromp]

We're also running into the frequent disconnects on the AoVPN when using DNAT with the Sophos XG. Did you have that problem and were able to solve it, or did you not have it happen? We had the RAS server at one site and it never happened, but when we moved it to the datacenter behind an (what we thought was) identical Sophos, we started having the disconnect issues. I appreciate your help. I was going to DM you, but I'm too new to this site (just registered when I found this thread). Thanks!

[scottm92]

So actually the problem turned out to be with our internal routing, I ended up hosting it on a server in Azure (with the majority of my infra on-prem), however I did work with Richard Hicks himself to troubleshoot and identify potential issues, we found that the Sophos was a red herring and actually had very little to do with it, happy to help if you're able to share some config in DMs

[alexromp]

So actually the problem turned out to be with our internal routing, I ended up hosting it on a server in Azure (with the majority of my infra on-prem), however I did work with Richard Hicks himself to troubleshoot and identify potential issues, we found that the Sophos was a red herring and actually had very little to do with it, happy to help if you're able to share some config in DMs

 

Hmm, well the internal routing seems to work well with everything else. The tunnel itself just stops working but "appears" to be connected. All routes are still in place. Also if I leave a ping going, it usually doesn't drop.

 

Was it a route to your VPN client range that needed to be fixed?

 

For your ultimate fix, it doesn't sound like you're routing *through* the XG anymore. So are you just running something like a VpnGw1 VNG in Azure for the P2S IKEv2 tunnels, with an S2S route back to your XG to connect to the corporate resources? Seems like a bit of a workaround.

[scottm92]

Ah interesting, so does it show connected on the client side but drops from the server side? That is what i was experiencing

[alexromp]

So after running pcaps from four spots along the connection chain between and including the remote client and the RRAS server, I think I managed to figure this out. We noticed that the UDP NAT entry for the tunnel keepalives would randomly just stop working based on the packet captures. It was on the Sophos XG that was protecting the RRAS server (it's in a perimeter network).

 

I started combing the logs looking for other things that correlated with the timing of the tunnel drops. It could be anywhere from 30 seconds to 30 minutes when it would happen, so it took a few tries. But I found that one of the S2S IPsec tunnels to a vendor was resetting at the same time.

 

Sophos has a somewhat undocumented "feature" where it resets all UDP connections when an IPsec tunnel comes up. No idea why. But anyway, the command to disable it is:

 

set vpn conn-remove-tunnel-up disable

 

You can't even tab-complete that command. It seems to be hidden in the CLI. Once we ran that, the disconnects stopped happening.

 

Just putting this here in case some future person runs into a similar issue, or I can't remember how I fixed it and I find this myself.