Hey all, this is Jay from Sophos Support and today I’ll be talking about Sophos Connect
Client version 2.1.
Sophos Connect is a secure VPN client, that you can install on Windows and Mac computers.
It allows to connect off-site employees to internal resources on your network from a
remote location. It can also connect to the XG Firewall using SSL or IPsec connections.
First off, we’ll cover the main difference between IPsec and SSL VPN.
If you haven’t set this up, check out our resources linked in the video description.
IPsec uses port 500 to create the tunnel to connect to the XG Firewall, which provides
a more robust security. However, port 500 is typically closed on home networks.
Now, before we install the Connect Client, we’ll need to download an SCX file from
the firewall.
You’ll need to have IPsec or SSL VPN configured to download this file.
To import an IPsec connection onto the Endpoint, a connection file must be provided.
The file that has the advanced settings has the extension .scx.
You get this file by navigating to VPN > SSL VPN (remote access) and select the Export
connection option at the bottom.
Now that the connection file is generated, it can be distributed to users through email
or GPO.
In the event that certain users require a different configuration, the Sophos Connect
Admin client can be used to create as many .scx files as needed.
To import the connection file, the user will have to install the connect client on their
machine.
Before starting an installation, make sure that no previous versions of the connect client
are installed, and if there are, uninstall them before proceeding.
We’ll download the client by logging into the user portal, and then navigating to VPN
> IPsec (remote access) and click Download client.
For the Windows installation, run the MSI file with an account that has permission to
install applications.
Accept the EULA
Click Install
Then click finish
For Mac clients the process is the same. Open the PKG file and click continue
Select the disc for installation
Click install, and enter your credentials
If you see a prompt for access to System Events, click OK
You can then close the installer
After the user has installed the Sophos Connect Client and has the .scx, the user will need
to click Import Connection.
Once that's done, it's as simple as clicking import and signing in.
In the event that you’re using an SSL VPN connection, the user will need to go into
the User Portal and select 'VPN > SSL VPN Client > Download configuration for other
OSs'.
An .ovpn file will be downloaded that's imported the same way as the .scx file.
Now, we'll go over the Sophos Connect Provisioning File (.pro) which will eliminate a lot of
the overhead of configuration files.
The Provisioning File is compatible with both IPsec and SSL VPN connections on the Sophos
Firewall, but only works if you are using Sophos Connect version 2.1 and above.
If you've configured the IPsec remote access settings, the provisioning file automatically
imports the .scx configuration file into the Sophos Connect client for all users.
As for the .ovpn configuration file, It only imports it to users you've assigned to
an SSL VPN remote access policy.
The reason that we recommend the provisioning file is because of these benefits:
The .scx and .ovpn configuration files are automatically imported to the user’s
Endpoint.
And if needed, you can specify more than one gateway as well as the priority of those gateways.
Again, these features are only available if you are using Sophos Connect version 2.1 and
Sophos Firewall 18.0 MR4 and above.
To create and send the provisioning file:
Go to the following URL, which we’ve also linked in the video description, and copy
the settings you require from the Provisioning File section and paste them in a text editor,
such as Notepad++.
The only mandatory field is the Gateway Address.
Once you’ve put together the fields you want to use save the file with a ‘.pro’
extension.
Email the provisioning file to users or use GPO.
The provisioning file automatically imports the configuration files as follows:
IPsec remote access settings,
SSL VPN remote access Policies (only for users specified in the Remote Access policies).
Keep in mind, to prevent users from seeing a certificate error when the file is imported,
you must create a new appliance certificate.
Use the new certificate for the web admin console of Sophos Firewall. To do this, go
to: Certificates > Certificate authorities and download the default certificate. You
must then push the default CA to users. The easiest way to do this is with Active Directory
GPO which we’ve linked the steps for in the video description.
Once the user has the provisioning file (.pro), they would just double click it, and enter
their credentials. Rhis will connect the Client, and pull the IPSec and/or SSL VPN configuration.
Note, if a SSL VPN profile is configured, the user will only see the Public IP for that
connection. This is going to be fix in a future update of the Sophos Connect Client.
To increase the security of the Sophos Connect, we recommend you enable One-Time Password,
also known as Multi-Factor Authentication. This will ask for an additional piece of authentication
for the users.
To enable this, go to Configure >> Authentication >> Multi-factor Authentication
In this example we will only enable OTP for one user, so we turn off OTP for All users
and select our user.
Then, we enable OTP for the User Portal, SSL VPN remote and IPsec remote access and click
Apply.
For the user to start using the OTP they need to download the Sophos Authentication App
and access their User Portal to activate it.
Once they want to connect to the IPsec or SSL VPN profile, they will be asked to enter
one of the OTP.
To do so, you will type in your user name and password, then append the 6-digit OTP
to the password in the password box. In this case it would be, ‘password 672166’.
And at this point, you’ll have the Sophos Connect client setup.
All the links mentioned can be found within the video description.
If you found this video useful, be sure to click the thumbs up button on Techvids or
YouTube and check out the rest of our video library at techvids.sophos.com.
If you have any questions, feel free to reach out to us on the community forums at community.sophos.com.
Thanks for watching! This is Jay, signing off.