SSL VPN on Sophos XG

Demystifying SSL VPN on Sophos XG

If you have tried to use SSL VPN on Sophos XG you might have found it to be a bit intimidating and also irritating as it is a multi-step process. Though it seems straight forward at first to do the basic setup, it is just not very obvious on how to get it to actually work. In all my searching, I did not find a start to finish guide on how to setup it up from scratch. I found several guides from Sophos on each section but it relies on you to put it all together. I spent some time with it before I got it to work and decided to put this guide together in hopes of helping others. There may be other ways but this is what worked for me. After you do it once you will find that it is actually very easy and it does actually make sense even though they should have done a better job simplifying the process and more importantly in documenting it.

Setup

Before you can even attempt to use VPN, you need to setup several areas such as SSL settings, Remote Access Settings, Users, and a Firewall rule.  It sounds more complicated than it really is so here are the instructions to each section.  You should do these in this specific order to avoid confusion and issues along the way.

• SSL VPN Setting: Lets first start with the SSL Settings. This is actually one of the easier sections and you will only make minor changes to the defaults.

1. • All you have to do hear is select UDP and setup the DNS servers you want to use.  If you do not choose any DNS servers it will use the default that you have setup in your router so just leave them blank.

• Users: It may not make sense now but you will need to create one or more users before going on to the next section. Users will be used in the remote access section as well as your VPN rule that you create later.  Once you see the settings in the remote section it will make sense as to why you want users created now. You can optionally create groups as well if you have many users and want to simplify setting up permissions later.

• SSL VPN (Remote Access): This section is fairly easy but is critical if you want to be able to access everything you need from your VPN connection. This is also the area where you can restrict certain users to only what you want them to see.

• Create the VPN rule: This is one of the most important steps in making the VPN work correctly and ties all the other sections together.  If you do not get this right your VPN will not work or give you access to everything you need on your network.

• User Portal for client installation: This is another area that is not hard to do if you know that you have to do it. Other services like OpenVPN allow you to download the client right form the server screen. XG makes you do it from the user portal which allows you to get pre-configured for the user.  Remember that Sophos is tailored toward mutilple users so doing it this way makes for multiple users.  For one user, it is a bit of an overkill.  There are also the options of downloading IOS and Android clients so you can use the VPN on your mobile or tablet.

Summary

After all is setup I found it to work extremely well and after going through it the first time I can see that their approach does work well though be it tailored for multiple users.  It does make it easy to make future changes even if it is a bit confusing to get it set up the first time.  Like anything else, it is always easier when you know what to do and it seems so obvious now but I still wish they would consolidate some of steps.  I am still testing it and will be putting it through its paces and I hope that you found this useful.