hi everyone i'm john hope from sophists and with the help of some of my

colleagues in sales engineering we've put together a short video explaining

your options when it comes to enabling your workforce to work from home if

you're an owner of an XG firewall so the first thing we're gonna talk about is

VPN technology what is VPN and why do I need it well VPN stands for virtual

private network and it's basically a secure private connection between two

points it was originally intended for VPNs to link multiple different sites or

head office to branch offices for example but then it was realized that

with a small piece of software it would be possible to deploy this onto a mobile

device laptop for example and for that device to also be able to connect

securely back to head office and that's the kind of VPN that we're going to be

focusing on during the rest of this session so what are the options if

you're an owner of an xg-- well there's lots of different VPN technologies all

inbuilt with the XG firewall but what we're going to do is focus on the most

popular four and we're going to start out with IPSec connectivity we're going

to bundle that in with the Sophos connect client so what is IPSec VPN well

it's the most efficient method of connecting remotely and it means that

you can add more users and they will typically connect faster using IPSec

than the other methods and however it's not without its downsides

so IPSec uses some fairly obscure port numbers and whilst the users are at home

they've probably got a consumer-grade broadband router and it'll connect up

pretty much just fine in most cases but if you take your corporate device and

you drop it behind a firewall maybe at a hotel or another office for example if

they've taken their security seriously there's a reasonable chance that some of

those ports are going to be blocked and what that means is that IPSec client may

not successfully connect and the other downside as well with IPSec technology

is and that it does require a client so it will require some kind of pre

configuration work and a client installing

in order to create this secure connection so what we're gonna do now is

we're gonna start out by looking at how you set up IPSec and sophis connect in

the XG firewall in order to configure the sophists connect client simply

navigate to the VPN tab in the X G's management console and then find the

sophists connect client you'll then need to choose which interface you want your

VPN users to be presented on and choose your authentication type so that's

normally apreciate password or pre shared key the next thing that we need

to do is decide which users are allowed to use this VPN connection unfortunately

this moment in time the XD file doesn't support groups and then finally we need

to select the IP ranges that the users will appear on and we need to select our

DNS settings and once that's finished we can download the connect client for

further configuration options things like deciding what's going to happen

with the security heartbeat capability and also whether we want to enable

things like two-factor authentication and if we want the client to connect

automatically on the client side there's a very simple installation wizard to go

through and this will install our VPN client

so once our client is installed we need to go and find the profile for our

connection to our office location and we need to import that into the software's

connect client once so settings have been imported

we need to authenticate ourselves as a user using our username and password and

that's all we need to do in order to create a connection so as you can see

there within just a few moments the user is up and running and connected back to

head office ok so let's wrap up on the IP set client by reminding you that we

recommend using the sophists connect client for Windows and Macs other

clients are available for other platforms and this can be deployed by a

group policy and you can choose if you want to send all the clients data down

the tunnel back to head office or just where information is required at head

office there's the always-on capability you can

use this with synchronized security it's a really simple user experience and just

to remind that with the settings this is user based and not Group based now of

course IPSec is just one of the connectivity options so let's look at

the next one down which is SSL now that I see what the SSL VPN client is that it

can be configured to use port 443 which is open pretty much anywhere so you

don't have that issue if you're stuck behind a firewall that you may not be

able to connect the only downside with the SSL VPN client really is that it is

more resource hungry so it will make your device work harder so let's go and

have a look at how you set up the SSL VPN in x.g in order to set up an SSL VPN

just navigate to the SSL VPN tab and then click Add this is going to create

our first policy and if we're going to have lots of remote access policies it's

prudent to make sure you give it a sensible name the next thing we need to

do is identify which users are going to be subject to this policy here you can

select individual users or in this case you can select groups as well you can

then also set up the idle timeout which basically determines when

appear is disconnected and you can define which network resources are going

to be available at head office there's also a slider here to set the default

gateway which means all traffic would come through the tunnel once we've saved

that policy we're pretty much ready to go but if we want to open that policy

and take a look in more depth we can do that so this is the section where you

can see things like the IP address ranges and also the cryptographic

methods so that's how you set up SSL VPN and let's see how it looks on the client

side the SSL VPN client has a nice little trick up its sleeve because users

can go and fetch this for themselves remotely by accessing the X G's user

portal once they've authenticated inside the user portal if they have an SSL VPN

option available to them then they can go and fetch the full client from this

location so they can click the download and pull that client down once they've

got that they can then install their client there's a very simple wizard to

take them through the process

so the VPN client lives down the bottom here on the taskbar and you can hit

connect and then all you need to do is supply your username and your password

and that's it you connect it up and you are good to go it is as easy as that

okay then so let's wrap up on the ssl VPN so as you've seen there's a ready to

go client for Windows users in the user portal and there's loads of third-party

SSL VPN clients available for other platforms these can be set up to use

commonly open ports like 443 to maintain flexibility and it's a really easy user

experience especially because users can go and fetch the client for themselves

on the office side it's also very simple to set up

you've got the options there for split tunnel or volt on in the same way you do

with IPSec and unlike IPSec you can do this for groups rather than having to

select each individual user so so far what we've seen is two remote access

options that require client software to be installed but what if this isn't

possible for some reason maybe the users are bringing their own device to the

party or alternative they might be using a public machine for example and this is

where client lists VPN technology comes into play this needs nothing more than a

web browser and it doesn't need any pre configuration no setting up in advance

from the user side and but the downside is the only limited resources are

actually available through the client list VPN services so let's go and take a

look at how we can set up client list services so again in order to set up

client list VPN then you need to navigate to the VPN tab inside your xg--

and then go to the client list settings and this is where you can create your

client this access policy so we're gonna give that a name and then we're going to

determine which users or which groups are subject to this policy so who can

access these resources and then we can publish up the predefined bookmarks that

I've already created these can be things like file servers and terminal servers

for example and then we simply apply those settings and they are now

published inside the user portal so if we hop over to the user portal now you

can see the clientless resource locations

including the terminal server that we've published down the bottom there if we

click on there then this is opening up an RDP connection back to a device that

might be back at head office so effectively users could use their own

personal computers and drive their office machines remotely

ok so let's summarize then on the client list VPN so on the user side you simply

need a web browser no pre-configuration requirement so it's ideal for personal

devices or public machines and from the office side what you're doing is

creating bookmarks for resources and publishing those to the user portal

however you can only use limited sets of resources so if things like RDP telnet

SSH and FTP and SMB and VNC services but it's a great way for people to be able

to drive their office machines whilst sitting at home or at some remote

location biggest detractor for client as VPN services are that it is very

resource intensive and it does also require the network protection

subscription to be active on your XG but there's a whole bunch of reasons why

you'd want to switch that on in addition to being able to use this service ok so

let's look at our last option which is Sophos red and this one's a bit

different because we're not talking about software here we are instead

talking about a hardware unit and so the sauce red is a small physical unit which

you can ship out to your users and it connects into your regular internet

connection using an Ethernet cable into the back of your broadband router and or

you can configure it with cellular services as well and basically what

happens then is it automatically from the users perspective connects back to

HQ and it acts like a really long network cable to link you back to HQ so

you can plug in your your desktop unit from the office you could plug in your

printer you can plug in your VoIP handset and basically anything you plug

into that device is effectively connected up to headquarters so it

really allows you to use all of those tools as if you were in the office so

let's just wrap up on sauce red then just to remind you it's a hardware unit

there is a version available with a wireless access point in there so you

can replicate the wireless networks that you might be broadcasting in the office

it's a true plug-and-play experience from the users point of view just plug

it into your broadband router or indeed cellular service infinitely redeploy

them all basically giving you the true in office experience for your laptop

your desktop if you bring it home and any other devices you care to look into

it hopefully you found that little overview of the XG firewall and it's

remote access capability is it useful and if you've got any questions having

watched that demonstration then do please reach out to your reseller

partner or contact your account manager ass office and we'll be more than happy

to help you getting the most out of your XG firewall thanks very much indeed for

watching