SOPHOS XG Firewall SSLVPN Configuration

Fri, 05 Aug 2022 00:00:00 +0000

Sophos XG Firewall provides SSL VPN for secure remote access. This guide covers the complete configuration from user authentication to client deployment and access policies.

Prerequisites

Sophos XG Firewall (SFOS 18.0+)
Admin access to WebAdmin console
Valid SSL certificate (public CA or self-signed for testing)
User accounts/groups configured (local, AD, RADIUS, LDAP)
WAN interface with static IP or DDNS

Configuration Overview

┌─────────────┐ ┌──────────────┐ ┌─────────────┐
│ Remote │────▶│ Sophos XG │────▶│ Internal │
│ User │ SSL │ Firewall │ │ Resources │
│ (Client) │ VPN │ │ │ (LAN/DMZ) │
└─────────────┘ └──────────────┘ └─────────────┘

Step 1: Certificate Setup

Option A: Public CA Certificate (Recommended)

System > Certificates > Add Certificate
Type: External Certificate
Upload: Certificate + Private Key + Chain
Name: SSLVPN-Public-Cert

Option B: Self-Signed (Lab Only)

System > Certificates > Add Certificate
Type: Self-Signed
Subject: CN=vpn.yourdomain.com
SAN: DNS:vpn.yourdomain.com, IP:203.0.113.10
Usage: SSL VPN

Step 2: User/Group Configuration

Local Users

Authentication > Users > Add User
Name: jdoe
Password: Strong password
Groups: SSLVPN-Users

Active Directory Integration

Authentication > Servers > Add > Active Directory
Server IP: 192.168.1.10
Bind DN: CN=svc_sophos,OU=Service Accounts,DC=corp,DC=local
Base DN: OU=Users,DC=corp,DC=local
Test Connection

SSL VPN User Group

Authentication > Groups > Add Group
Name: SSLVPN-Users
Type: Authentication Group
Members: Add AD group VPN-Users or local users
OTP: Enable if using Sophos Authenticator

Step 3: SSL VPN Portal Configuration

General Settings

VPN > SSL VPN (Remote Access) > General

VPN on Madhusudan Upadhyay — ICT Support Executive | Microsoft 365 & Endpoint Management