• Sophos (XG) Firewall v18: SSL/TLS Inspection Rules. An introduction to the Xstream SSL Inspection engine in XG Firewall v18 including the principles of operation and how to change settings and define your own decryption profiles and TLS inspection rules. Skip ahead to these sections: 0:00 Overview 0:12 Understanding the new SSL.
• Configuring SSL VPN Client on Sophos Firewall 2 Create SSL VPN Client connection. Go to VPN SSL VPNSite-to-Site and click Add under Client heading. Connection Name: The logical name for the tunnel, this will be the name of the tunnel created. (Example: WashingtonDallasClient). Description: A detailed description about the server.
• The Sophos Client Firewall does not need any ports to be opened. Sophos Update Manager (SUM). Use a secure LDAP connection, encrypted via SSL, and leave the Use LDAP over an SSL connection (recommended) checkbox selected. If, however, your LDAP environment doesn’t support SSL.

If you experience a dropout, slow performance, consistent reconnects or other issues with Remote Desktop Connection (Terminal Services or RDP) when running across a Sophos XG SSL VPN please try the below steps to see if they resolve the issue.

With SSL/TLS inspection rules, you can intercept and decrypt SSL and TLS connections over TCP, enabling XG Firewall to enforce secure connections between clients and web servers. SSL/TLS inspection enables the prevention of malware transmitted through encrypted connections.

• Disable the option 'Compress SSL VPN Traffic' within the SSL VPN Global Policy. This is accessed via VPN, Show VPN Settings (top right of the window, it is not in the menu)

• Check the MTU over an active SSL VPN session. In most cases, the MTU needs to be dropped to account for the overhead that is applied to the traffic over the VPN. In Australia with a PPPoE NBN connection and running an SSL VPN this can drop the MTU on the WAN interface to 1370 and the MSS value to 1322. This is accessed via Network, Interfaces then select the edit interface option for the WAN Interface, scroll down to Advanced and exit the MTU and MSS values.

Test the VPN connection again by closing the session and restarting it to force a re-establishment of the TCP session.

You can allow remote access to your network through the Sophos Connect client using an SSL connection.

Sophos Ssl Vpn Client 2.1

Sophos Ssl Inspection

You can download the Sophos Connect client by clicking Download on the Sophos Connect client page. You can check if the pattern for the Sophos Connect client has been downloaded from Backup & Firmware > Pattern updates.

You need to provide the Sophos Connect client installation file to your users.

Sophos Ssl Client

For instructions on how to set up the SSL connection, see Creating a remote access SSL VPN.

Sophos Ssl Vpn Client

Users can easily import the connection into the Sophos Connect client by double clicking the provisioning (pro) file that you provide to them. This means that users do not need to log into the user portal, download the ovpn file and import it. For instructions on how to create the file and distribute it to users, see Sophos Connect provisioning file.