Hey all, it’s Jay from Sophos Support and today I’ll be showing you how to get started
with configuring IPsec and SSL VPN remote access.
In this video we’ll be going over the prerequisites and configuration for IPsec or SSL VPN. After
completing the steps here, you’ll then be able to setup the Sophos Connect Client which
is covered in a separate video which you’ll find a link for in the video description.
Given that, we’ll cover some of the differences between IPsec and SSL VPN.
For IPsec, it uses port 500 which does provide a more robust security, however port 500 is
commonly closed on home networks and will need to be open to ensure functionality.
IPsec also has the ability to use port 4500 which can be used with NAT Traversal.
SSL VPN on the other can be configured to use any open port, such as 443 which can make
the initial setup more simplified.
SSL VPN is also typically faster than IPsec
Now that you have an idea of whether you’ll want to use IPsec or SSL VPN, we’ll go over
the prerequisites.
We’ll start by allowing access to services within the Sophos Firewall.
To do this navigate to Administration > Device Access.
Here we’ll allow the following services:
Under WAN allow User Portal. This allows users to access the Sophos Firewall User Portal
when setting up the Connect Client.
Under VPN we’ll allow Ping, DNS, and User Portal.
Ping and DNS are optional but can help when troubleshooting connectivity during the initial
setup. User Portal is enabled so that users can access the Sophos Firewall User Portal
over the VPN.
You can click on ‘Apply’ to save the changes.
Moving on, we’ll start configuring the Firewall rule.
The policy we create will allow traffic from the VPN, to the LAN and DMZ, since we’ll
want remote users to access these zones. Keep in mind that his rule can differ depending
on your environment and you may need to make changes from the example that we create.
First off, we’ll create an IP host to specify the range of this rule.
This should cover the IP’s that will be used for IPsec or SSL VPN.
To do this we’ll navigate to ‘Hosts and services’ and make sure that we’re on
the IP host tab.
Click ‘Add’.
Enter a name for the local subnet.
Here we have the option to set a single IP, subnet, range, or list of IPs.
We’ll be using a range; however, you will want to use what is most compatible with your
network.
Once that’s done, we’ll save the policy.
To do this, we’ll navigate to ‘Rules and policies’ and make sure that we’re on
the Firewall rules tab.
We’ll click on ‘Add firewall rule’ and select ‘New firewall rule’.
Enter a name for your rule and add a description if needed.
For ‘Rule Position’, we’ll change this to Top.
The ‘Rule Group’ can be set to None.
Under the ‘Source’ section we’ll add a new item to the ‘Source zone’ and select
VPN.
For the ‘Source Network’, we’ll specify the SSL VPN range.
Under ‘Destinations and services’, we’ll add a new item for the ‘Destination zone’
and select LAN and DMZ.
Now, we can go ahead and save this rule.
With the prerequisites covered, we’ll get started with configuring IPsec. If you plan
on using SSL VPN instead, you can skip ahead to that section by clicking the top bar or
using the timestamp in the video description.
To configure IPsec we’ll go to VPN >> IPsec (remote access), select ‘Enable’, then
select the interface where the XG will be expecting the connections to come from.
Please note, if the XG is not the border router, and doesn’t have a Public IP, you will need
to port forward Port UDP 500, UDP 4500 and the ESP protocol, with IP protocol number
50, from the upstream router.
For Authentication Type, select ‘Preshared Key’ and enter the Phrase.
For Local ID and Remote ID, you can leave this empty.
For Allowed users and groups, enter the Users and/or Groups that will be able to connect
to the Firewall.
One of the feature updates is the addition of active directory group support for IPsec.
This gives you the option to add active directory groups that have been synced on your firewall.
For the Client information, enter a Name. This name will be name of the connection.
Assign IP from: enter a range of IPs that the XG will provide to the users of the Sophos
Connect. Make sure this range doesn’t overlap with any network you have in the interfaces
of the XG and SSL VPN or L2TP, for example.
We also recommend that you avoid setting this range to common home and office networks such
as 192.168.1.0 and 10.0.0.0.
This is to avoid routing issues with the local network of the end user.
If you want to set static IPs for Sophos Connect users, select the Allow leasing IP address
from RADIUS.
For DNS server, enter the IP of the DNS server that will resolve Names when using Sophos
Connect.
Also make sure to add this IP into the Permitted Network Resources which will cover in the
Advanced settings
If you want to disconnect idle users, simply select Enable for the Disconnect when tunnel
is idle. And enter a time in seconds.
Now let's talk about some of the Advanced Settings.
The first option listed is “Use as Default Gateway”.
Enabling this will have all traffic, including regular internet traffic, passed down the
tunnel and to the Firewall.
Keep in mind that this will increase performance usage as the Firewall will have to process
more traffic, but in turn allows for more reporting information of user traffic.
Another thing to note is that if you do enable this option, you will have to go back to your
Firewall rule and add the WAN as a destination zone.
Just below that is Permitted Network Resources.
This is where you enter the Network's and IPs that you want users to have access to
behind the Firewall.
When adding your DNS server under the Client information it is important that we also add
the IP of the DNS servers under the Permitted Networks resources as we mentioned.
For Endpoints that are protected by Intercept X, you can take advantage of Synchronized
Security and have the Endpoints Heartbeat packets go through the VPN tunnel by selecting
‘Send Security Heartbeat through Tunnel’.
The ‘Allow users to save username and password’ option will let users save their credentials
for future logins.
The 'Prompt users for 2FA token' is used when configuring the Sophos Firewall with OTP.
Configuring this adds an extra layer of security which is why we'll go over this later in the
video.
The Run AD logon script is useful when you want automatic scripts provided by the Domain
Controller to run as if the user was inside the office.
One of the most common situations that we see this used for is when mapping Network
Shares.
For the Connect tunnel automatically to work, you have to enter the FQDN of a server inside
your organization so that Sophos Connect knows if the user is off-site and it needs to connect.
For example, if we set dc1.domain.com, the client will try to resolve this FQDN.
If it can’t resolve the FQDN, it will start the auto-connect.
But, if it is able to resolve it assumes the user is inside the network and Sophos connect
will not try to auto-connect.
The last option is to Assign a DNS suffix to the client. Adding a DNS suffix allows
the Endpoints to resolve the FQDN properly.
For example, without a DNS suffix, if a user pinged dc1, no reply would be returned.
But if it is added in, dc1 will have the domain appended so that dc1 becomes resolvable
With IPsec now configured, you can apply these changes and export the connection file which
will be needed for configuring endpoints with the Connect Client.
We’ve linked a video in the description which goes over how to do this.
Now let’s get started with configuring SSL VPN. We’ll be covering the different components
of the setup which includes:
Disabling Traffic Compression
Configuring users and groups, or alternatively using AD sync
Checking the authentication methods
Let’s start with disabling Tunnel Compression.
We’ll navigate to VPN and select Show VPN Settings.
Make sure that you’re on the SSL VPN tab and scroll to the bottom.
Under Advanced Settings, make sure that traffic compression is unchecked.
Then go ahead and apply the changes.
Now we’ll configure our users and groups.
If you plan on using, or already have AD sync implemented you can skip this part.
You’ll also find documentation linked in the video description for how to setup AD
sync.
Given that, we’ll go to Authentication > Groups and select Add.
We’ll name our policy then set the Surfing quota to Unlimited internet access and the
access time to Allowed all the time.
These parameters can optionally be configured if you would like to set stricter access hours
and surfing quotas.
We’ll go ahead and save the policy.
Now we’ll stay on the Authentication page and navigate to Users.
Here we’ll select our user and add them to the VPN group that we just created, then
click on save.
With that complete, we’ll now go over setting the Firewall as the authentication server.
If you plan on using Active Directory for authentication, we’ve linked documentation
in the video description that covers it in detail.
Otherwise, let’s start by navigating to Authentication > Services.
Under Firewall authentication methods select Local for Selected Authentication Server
Now, under SSL VPN authentication methods we’ll do the same thing and set Selected
Authentication Server to Local.
Lastly, let’s click Apply to save our changes.
Now that we’ve finished configuring the authentication server, we’ll get started
with creating the SSL VPN policy.
We’ll want to head to VPN > SSL VPN (remote access) and then select Add.
Name the policy and set a description if you would like.
For Policy Members we’ll be adding in the group that we created earlier.
For Tunnel Access there’s the setting to use as Default Gateway which is optional.
Enabling this will have all traffic, including regular internet traffic passed through the
tunnel to the Firewall.
Keep in mind that this will increase performance usage as the Firewall will have to process
more traffic, but in turn allows for more reporting information of user traffic.
Another thing to note is that if you do enable this option, you will have to go back to your
Firewall rule and add the WAN as a destination zone.
Moving on to the Permitted Network Resources, we’ll add in the subnet that we created.
Lastly there is Idle time-out.
Enabling disconnect idle clients as it states, will disconnect users when they have been
idle for a set amount of time. This can be specified between the range of 15 minutes
to an hour.
Now we can apply this policy.
And with that done, that completes the setup for SSL VPN.
You’ll find a link in the description for the video that covers configuration of the
Connect Client for Windows and Mac users if you’re setting that up next.
I hope you found this video useful! Let us know by giving us a thumbs up on Techvids,
and let us know if we resolved your issue.
Check out the documentation for this video in the video description.
For further assistance, view and post questions on community.sophos.com.
And go to techvids.sophos.com for more great videos like this one!
This is Jay, signing off.