Hey guys, this is Jelan from Sophos Support and today we're setting up SSL VPN remote user access
with a Sophos XG Firewall. So in our situation we want our users to be able to work remotely
but give them a secure, encrypted connection to our internal resources. Our internal resources
are going to be on our local 192 subnet. We'll be creating a split tunnel VPN to give users
access via a remote subnet using a 10 Network. Now, these are just example networks for demonstration,
so adjust accordingly. We'll need to have the following configured: users and groups, a local
and remote subnet, a VPN, a firewall rule to allow VPN traffic, and lastly we'll need to install the
VPN client on our Endpoints. Now if you already have some of these steps configured, check out
the timestamps in the video description and skip ahead if need be. Let's jump in. So we'll
be manually creating a group and a user today but if you need to set this up with Active Directory
check out the link in the video description for that documentation. So from the dashboard
we'll go into the authentication subsection under Configure and in the top we'll click Groups. Let's
hit add. Let's give our group the name Remote SSL VPN group. This group is going to contain the users
that are allowed to access the VPN but it's not mandatory that you need to create a group. We'll
set the surfing quota to 'unlimited and the access time to 'allowed at all times' so they have no time
restrictions on the network but you can adjust as needed. Let's hit 'save' and move on to adding
our users. We'll jump over to the users tab and hit 'add'. Let's give this user the username 'john.smith'.
We'll give John a password, keep him as user ,put in his email and throw them into the remote SSL VPN
group that we created. Keep in mind the user will need to use the password you've given them every
time connecting to the VPN and will also need to know it later when we download and install the VPN
client. Let's hit 'save' on Mr. Smith and move on to defining our subnets. Now, the first subnet we
configure will be our internal subnet. On the left under 'System', let's click 'Hosts and Services'. Under
IP host, let's click 'Add'. Let's call this IP host at Local Subnet. We'll leave IPv4 checked but change
the type to 'Network'. We'll enter the IP address and the subnet to specify the IP range assigned to the
subnet. Let's hit 'save' and do that step again for the remote subnet. Now this subnet is going to be
the network which Endpoints connecting to the VPN will get their IP address from. We'll click 'Add'
and call this IP host remote SSL VPN subnet. We'll leave IPv4 checked and change the Type to 'Network'.
For the purposes of this video, we'll be using the default 10.81.234.0 network but you can
edit this accordingly. We'll enter the IP address and the subnet to specify the IP or range assigned
to the subnet. Hit save and let's create our VPN. On the left under 'Configure', we'll click 'VPN'. In
the VPN section, let's go into SSL remote VPN access and click 'Add'. We'll give our VPN a name.
Under 'Identity', add our group. Under 'Tunnel', we'll leave default gateway off and add local subnet
to the Permitted Network Resources section. This will allow the VPN users to be able to connect to
the internal 192 Network via the remote 10 network. Now if we enable default gateway, all of the users
traffic will be routed to the VPN. It'll act like a full tunnel. With default gateway off, only the
traffic destined to the internal resources will be directed to the VPN — a split tunnel. Keep in
mind that if you do enable default gateway, you'll need to create a firewall rule for VPN to WAN
traffic. Next, let's configure the authentication for the VPN. We'll navigate back to 'Authentication'
and go into 'Services'. We'll scroll down to SSL VPN authentication methods and make sure 'Local
Authentication Server' is selected. Now, let's move over to the 'Administration' section under 'System'.
We'll go into the 'Device Access' tab and in the 'Local Service ACL' section, let's check the SSL
VPN boxes for WAN and the User Portal boxes for LAN and WAN as well. If you enable WAN access
for user portal or any other services, we strongly recommend enabling multi-factor authentication. You
can enable One-Time Password so the user will need to scan a token with the Sophos Authenticator to
access the user portal. We recommend having this enabled for all users. Check out the documentation
link in the video description for a full guide. Let's hit 'Apply' and 'OK' to confirm. Now let's move
on to our firewall rule. On the left under 'Protect', let's go over to 'Rules and Policies'.
Click 'Add Firewall Rule' and select 'New firewall rule'. In the 'Rule Group' we'll select 'none' and we'll
call the rule 'remote SSL VPN access'. You can also choose to enable firewall logging here as well.
Let's select 'VPN' as the source zone and select 'remote SSL VPN subnet' under 'Source Networks and
Devices'. For 'Destination Zone', let's select the LAN and for 'Destination Networks', let's select
the local subnet. Now let's check 'Match Known Users' and under 'Users and Groups', select 'remote
SSL VPN group'. Hit 'apply' and 'save'. Now, if you need to do advanced configurations for the VPN you can
navigate back to VPN and click show 'VPN settings', Here you can configure advanced settings like
DNS servers and the domain name, so your users can access resources using host names. Also important
to note, that we can see the IPv4 range we created here. Now this range is actually the default range
with the XG, which is why we chose to create it with that, but feel free to change the ranges to
suit your needs. Our final step is to download and install the VPN client from the user portal. We'll
be going through this on a Windows device, but documentation on other operating systems will
be available in the video description. We'll open up a browser on our Endpoint and navigate to the
XG using our local address import. Let's put in our username and password and login. On the left,
select 'SSL VPN' if it's not already selected and hit 'Download client and configuration for Windows'.
We'll save and run the .exe. Let's click 'Next', 'agree' and 'install'. Once it's done, let's click 'Next' and
'finish'. Now we should see this little traffic light symbol in the taskbar. Let's right-click
that and click 'Connect'. We'll put in John's credentials again and hit 'OK'. Now, we should
see we're successfully connected. So thanks for watching everyone. If you had any further
questions, feel free to check out the XG and VPN documentation links in the video description
or view and post questions at community.sophos.com. That's it for me today. Stay safe out there.