Openvpn Sophos

1. Sophos Openvpn Client
2. Openvpn Sophos Xg
3. Sophos Openvpn Comp-lzo
4. Openvpn Sophos Client
5. Sophos Ssl Vpn Client
6. Openvpn Sophos Ssl

You can configure IPsec remote access connections. Users can establish the connection using the Sophos Connect client.

Introduction

Sophos Openvpn Client

Automatically imports the IPsec remote access (.scx) and SSL VPN remote access (.ovpn) configuration files into the Sophos Connect client on users' endpoints. You don't need to share the.scx file with users. Users don't need to sign in to the user portal and download the.ovpn file.

• Open the Sophos User Portal in your Browser. Login with your username and password. Note: If your browsers notifies you that this connection isn’t trustworthy, that’s because there’s no SSL certificate for your firewall. Look for the option to still open the page (different depending on the browser).
• Sophos VPN Sophos UTM is one of the first Sophos products to offer advanced next-gen cloud sandboxing technology. Sandstorm provides a whole new level of ransomware and targeted attack protection, visibility, and analysis. It can quickly and accurately.

The Sophos Connect client allows you to enforce advanced security and flexibility settings, such as connecting the tunnel automatically. To configure and establish IPsec remote access connections over the Sophos Connect client, do as follows:

• Configure the IPsec remote access connection.
• Send the configuration file to users.
• Add a firewall rule.
• Send the Sophos Connect client to users. Alternatively, users can download it from the user portal.

Users must do as follows:

• Install the Sophos Connect client on their endpoint devices.
• Import the configuration file into the client and establish the connection.

Configure IPsec (remote access)

1. Go to VPN > IPsec (remote access) and click Enable.
2. Specify the general settings:

   Name

   Setting
   Interface	Select a WAN port.
   Authentication type	Specify a preshared key or the local and remote certificates.
   Local ID Remote ID	Specify the IDs if required.
   Allowed users and groups	Select the users and groups you want to allow.

3. Specify the client information. The following settings are an example:

   Name

   Setting
   Name	TestRemoteAccessVPN
   Assign IP from	192.168.1.11 192.168.1.254
   DNS server 1	192.168.1.5

4. Specify the advanced settings you want and click Apply.

   Name

   Setting
   Permitted network resources (IPv4)	LAN_10.1.1.0 DMZ_192.168.2.0
   Send Security Heartbeat through tunnel	Sends the Security Heartbeat of remote clients through the tunnel.
   Allow users to save username and password	Users can save their credentials.

5. Click Export connection.

   The exported tar.gz file contains a .scx file and a .tgb file.

6. Send the .scx file to users.
7. Optional To assign a static IP address to a user connecting through the Sophos Connect client, do as follows:
   1. Go to Authentication > Users, and select the user.
   2. On the user's settings page, go down to IPsec remote access, click Enable, and enter an IP address.

Openvpn Sophos Xg

Inspiration for this post was taken from: https://rieskaniemi.com/azuremfa-nps-extension-with-sophos-utm-firewall/

Sophos Openvpn Comp-lzo

Some of the things that I’ve seen at work, is that Sophos UTM VPN users are using one token for Sophos SSLVPN and another for ex. Office 365 services. Both tokens can be in Microsoft Authenticator, but only the one that Office 365 is using, can do the “pop-up”, letting the user easy sign-in, like this:

Openvpn Sophos Client

Nonetheless it’s easier for the IT dept. (and the user!) to maintain only one token solution 🙂

Here is the auth flow for Azure MFA with NPS Extension:

Sophos Ssl Vpn Client

Nice isn’t it 😉

So how to fix?

We setup Sophos UTM for RADIUS validation for SSLVPN and UserPortal access, and if you use the built-in OTP solution, disable that 🙂

To get started:

• If you do not have MFA enabled for your Office 365/Azure AD account’s you can enable it through following link: https://aka.ms/mfasetup
• And of course you need to have set Azure AD Connect to get your on-premise talking with Azure, I will not go into the details with this here, as I assume this is already setup and working 🙂

Let’s go:

1. Install the Network Policy Server (NPS) role on your member server or domain controller. Refering to the Network Policy Server Best Practices, then you will find this “To optimize NPS authentication and authorization response times and minimize network traffic, install NPS on a domain controller.” So we will go ahead and place this on the domain controller, but remember it’s also possible to do it on a domain joined member server!
   Press “Next” and the installation begins:
2. After installation has ended, go and join the NPS to the Active Directory, right-click NPS (Local):
3. Download and install the NPS Extension for Azure MFA here:
   https://www.microsoft.com/en-us/download/details.aspx?id=54688Note: As i did try this on a server with already setup NPS, it failed with the other mechanisms, because of this:
   https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension#control-radius-clients-that-require-mfa

   “

   Control RADIUS clients that require MFA

   Once you enable MFA for a RADIUS client using the NPS extension, all authentications for this client are required to perform MFA. If you want to enable MFA for some RADIUS clients but not others, you can configure two NPS servers and install the extension on only one of them.

   Configure RADIUS clients that you want to require MFA to send requests to the NPS server configured with the extension, and other RADIUS clients to the NPS server not configured with the extension.”

   So the “workround” is to run the MFA for the Sophos on a seprate NPS instance ?

4. After it’s installed, go and follow the configure is like it’s stated here (Find TenantID and run Powershell script):
   https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension#azure-active-directory
5. Go and configure your radius Client, here it’s the UTM:

   
   Remember the secret, we need it later on 🙂

6. Create a “Connection request policy”:
   
   See above the NAS Identifier, it’s “ssl”, it’s taken from this scheme:

   
   Found here: https://community.sophos.com/kb/en-us/116144

   Just set like above, and the rest of the settings, just leave them to their defaults 🙂

7. Now create a “Network Policy”
   Add a domain group, that shall have this access, to simplify, here I have choose domainDomain Users
   Now the EAP types, UTM does only support PAP, as far as I have tested:

   
   You will get a warning telling you that you have choosen unencrypted auth (locally – not on the Internet!), just press OK.
   Just left the rest to their default’s and save the policy.

8. Now to create a firewall rule:
9. Now to setup the UTM for this:

   Add new Authentication server:

   Remember to choose RADIUS:

   
   Fill in as your environment matches:

   Type in the secret you wrote down earlier and create a host object for your NPS, also remember to change the timeout from 3 to 15 secs!

   You can now test is the authentication through NPS and Azure MFA is working, change NAS-Identifier to “ssl” type in a users username (e.mail adress) and password, and your phone should pop-up with Microsoft Authenticator 🙂

10. Now to grant the RADIUS users access to SSL-VPN

    Just add the built-in object “Radius Users” to your SSL-VPN profile:

11. Now login to the User Portal and download a VPN client (You cannot use the old ones, if you already had thoose installed)
12. Now connect through VPN, type in your full email in username and your password, then wait for MS Authenticator to pop-up, accept the token and you are logged into VPN 🙂

Openvpn Sophos Ssl

Sources:

Related Posts