Elk M1XEP and Sophos UTM

[cyberk]

Hello,
 
Is anyone here using a Sophos UTM (Router/Firewall) and an Elk M1XEP. I'm having major issues with port forwarding and the M1XEP, was hoping someone else could reproduce.

 

[johngalt]

Hello,
 
Is anyone here using a Sophos UTM (Router/Firewall) and an Elk M1XEP. I'm having major issues with port forwarding and the M1XEP, was hoping someone else could reproduce.

I am using Sophos UTM and a M1XEP.

I currently do not use port forwarding and use OpenVPN on my phone to connect and then connect using eKeypad on my phone.

However if I can help test something let me know.

 

[cyberk]

So very glad you're around! Looks like we have very similar set ups, I too am using eKeypad.

Would you be willing to set up a DNAT port forward to the secure port on your M1XEP and see if you can get consistent connections? Mine work about 10% of the time.

Also, for the VPN, I had mine configured that way for a while but I got tired of having to dial the VPN manually.

On a somewhat related note, have you tried getting VPN on Demand to work? I can get it to dial the connection on demand but it prompts for password every time, instead of using cert based auth.


Sent from my iPhone using Tapatalk

 

[cyberk]

Some additional news, I can't even access the m1xep through VPN. Other servers/services on the same subnet as the M1XEP work great. The issue seems to be between the XEP and the Sophos...I'm stumped.


Sent from my iPhone using Tapatalk

 

[cyberk]

Although the XEP works great when I'm physically connected to the network (Ethernet/wifi). I decided to go ahead and power cycle it completely, I'll test for a bit and will let you know if that resolves.


Sent from my iPhone using Tapatalk

 

[wuench]

The secure port Elk connection is telnet over an SSL tunnel.  
 
It looks like the Sophos is a combination network and web access firewall.   You should make sure you have all web access firewall features for your rule turned off since this is not an HTTP connection (web filter, malware detection, IPS, security heartbeat, traffic shaping, etc).
 
If that doesn't help then I would probably investigate TCP timeouts on the device.  Most firewalls I have used have a 30min timeout by default but I don't know Sophos.