hi everyone i'm john hope from sophists and with the help of some of my
colleagues in sales engineering we've put together a short video explaining
your options when it comes to enabling your workforce to work from home if
you're an owner of an XG firewall so the first thing we're gonna talk about is
VPN technology what is VPN and why do I need it well VPN stands for virtual
private network and it's basically a secure private connection between two
points it was originally intended for VPNs to link multiple different sites or
head office to branch offices for example but then it was realized that
with a small piece of software it would be possible to deploy this onto a mobile
device laptop for example and for that device to also be able to connect
securely back to head office and that's the kind of VPN that we're going to be
focusing on during the rest of this session so what are the options if
you're an owner of an xg-- well there's lots of different VPN technologies all
inbuilt with the XG firewall but what we're going to do is focus on the most
popular four and we're going to start out with IPSec connectivity we're going
to bundle that in with the Sophos connect client so what is IPSec VPN well
it's the most efficient method of connecting remotely and it means that
you can add more users and they will typically connect faster using IPSec
than the other methods and however it's not without its downsides
so IPSec uses some fairly obscure port numbers and whilst the users are at home
they've probably got a consumer-grade broadband router and it'll connect up
pretty much just fine in most cases but if you take your corporate device and
you drop it behind a firewall maybe at a hotel or another office for example if
they've taken their security seriously there's a reasonable chance that some of
those ports are going to be blocked and what that means is that IPSec client may
not successfully connect and the other downside as well with IPSec technology
is and that it does require a client so it will require some kind of pre
configuration work and a client installing
in order to create this secure connection so what we're gonna do now is
we're gonna start out by looking at how you set up IPSec and sophis connect in
the XG firewall in order to configure the sophists connect client simply
navigate to the VPN tab in the X G's management console and then find the
sophists connect client you'll then need to choose which interface you want your
VPN users to be presented on and choose your authentication type so that's
normally apreciate password or pre shared key the next thing that we need
to do is decide which users are allowed to use this VPN connection unfortunately
this moment in time the XD file doesn't support groups and then finally we need
to select the IP ranges that the users will appear on and we need to select our
DNS settings and once that's finished we can download the connect client for
further configuration options things like deciding what's going to happen
with the security heartbeat capability and also whether we want to enable
things like two-factor authentication and if we want the client to connect
automatically on the client side there's a very simple installation wizard to go
through and this will install our VPN client
so once our client is installed we need to go and find the profile for our
connection to our office location and we need to import that into the software's
connect client once so settings have been imported
we need to authenticate ourselves as a user using our username and password and
that's all we need to do in order to create a connection so as you can see
there within just a few moments the user is up and running and connected back to
head office ok so let's wrap up on the IP set client by reminding you that we
recommend using the sophists connect client for Windows and Macs other
clients are available for other platforms and this can be deployed by a
group policy and you can choose if you want to send all the clients data down
the tunnel back to head office or just where information is required at head
office there's the always-on capability you can
use this with synchronized security it's a really simple user experience and just
to remind that with the settings this is user based and not Group based now of
course IPSec is just one of the connectivity options so let's look at
the next one down which is SSL now that I see what the SSL VPN client is that it
can be configured to use port 443 which is open pretty much anywhere so you
don't have that issue if you're stuck behind a firewall that you may not be
able to connect the only downside with the SSL VPN client really is that it is
more resource hungry so it will make your device work harder so let's go and
have a look at how you set up the SSL VPN in x.g in order to set up an SSL VPN
just navigate to the SSL VPN tab and then click Add this is going to create
our first policy and if we're going to have lots of remote access policies it's
prudent to make sure you give it a sensible name the next thing we need to
do is identify which users are going to be subject to this policy here you can
select individual users or in this case you can select groups as well you can
then also set up the idle timeout which basically determines when
appear is disconnected and you can define which network resources are going
to be available at head office there's also a slider here to set the default
gateway which means all traffic would come through the tunnel once we've saved
that policy we're pretty much ready to go but if we want to open that policy
and take a look in more depth we can do that so this is the section where you
can see things like the IP address ranges and also the cryptographic
methods so that's how you set up SSL VPN and let's see how it looks on the client
side the SSL VPN client has a nice little trick up its sleeve because users
can go and fetch this for themselves remotely by accessing the X G's user
portal once they've authenticated inside the user portal if they have an SSL VPN
option available to them then they can go and fetch the full client from this
location so they can click the download and pull that client down once they've
got that they can then install their client there's a very simple wizard to
take them through the process
so the VPN client lives down the bottom here on the taskbar and you can hit
connect and then all you need to do is supply your username and your password
and that's it you connect it up and you are good to go it is as easy as that
okay then so let's wrap up on the ssl VPN so as you've seen there's a ready to
go client for Windows users in the user portal and there's loads of third-party
SSL VPN clients available for other platforms these can be set up to use
commonly open ports like 443 to maintain flexibility and it's a really easy user
experience especially because users can go and fetch the client for themselves
on the office side it's also very simple to set up
you've got the options there for split tunnel or volt on in the same way you do
with IPSec and unlike IPSec you can do this for groups rather than having to
select each individual user so so far what we've seen is two remote access
options that require client software to be installed but what if this isn't
possible for some reason maybe the users are bringing their own device to the
party or alternative they might be using a public machine for example and this is
where client lists VPN technology comes into play this needs nothing more than a
web browser and it doesn't need any pre configuration no setting up in advance
from the user side and but the downside is the only limited resources are
actually available through the client list VPN services so let's go and take a
look at how we can set up client list services so again in order to set up
client list VPN then you need to navigate to the VPN tab inside your xg--
and then go to the client list settings and this is where you can create your
client this access policy so we're gonna give that a name and then we're going to
determine which users or which groups are subject to this policy so who can
access these resources and then we can publish up the predefined bookmarks that
I've already created these can be things like file servers and terminal servers
for example and then we simply apply those settings and they are now
published inside the user portal so if we hop over to the user portal now you
can see the clientless resource locations
including the terminal server that we've published down the bottom there if we
click on there then this is opening up an RDP connection back to a device that
might be back at head office so effectively users could use their own
personal computers and drive their office machines remotely
ok so let's summarize then on the client list VPN so on the user side you simply
need a web browser no pre-configuration requirement so it's ideal for personal
devices or public machines and from the office side what you're doing is
creating bookmarks for resources and publishing those to the user portal
however you can only use limited sets of resources so if things like RDP telnet
SSH and FTP and SMB and VNC services but it's a great way for people to be able
to drive their office machines whilst sitting at home or at some remote
location biggest detractor for client as VPN services are that it is very
resource intensive and it does also require the network protection
subscription to be active on your XG but there's a whole bunch of reasons why
you'd want to switch that on in addition to being able to use this service ok so
let's look at our last option which is Sophos red and this one's a bit
different because we're not talking about software here we are instead
talking about a hardware unit and so the sauce red is a small physical unit which
you can ship out to your users and it connects into your regular internet
connection using an Ethernet cable into the back of your broadband router and or
you can configure it with cellular services as well and basically what
happens then is it automatically from the users perspective connects back to
HQ and it acts like a really long network cable to link you back to HQ so
you can plug in your your desktop unit from the office you could plug in your
printer you can plug in your VoIP handset and basically anything you plug
into that device is effectively connected up to headquarters so it
really allows you to use all of those tools as if you were in the office so
let's just wrap up on sauce red then just to remind you it's a hardware unit
there is a version available with a wireless access point in there so you
can replicate the wireless networks that you might be broadcasting in the office
it's a true plug-and-play experience from the users point of view just plug
it into your broadband router or indeed cellular service infinitely redeploy
them all basically giving you the true in office experience for your laptop
your desktop if you bring it home and any other devices you care to look into
it hopefully you found that little overview of the XG firewall and it's
remote access capability is it useful and if you've got any questions having
watched that demonstration then do please reach out to your reseller
partner or contact your account manager ass office and we'll be more than happy
to help you getting the most out of your XG firewall thanks very much indeed for
watching