Skip to content
The XG Series hardware appliances will reach end-of-life (EOL) on March 31, 2025. Click here to see the XG to XGS migration documentation.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=user-portal-VPN

VPN portal

You can download the Sophos Connect client to your endpoint devices to establish remote access IPsec and SSL VPN connections.

You can also use the clientless access connection if it's configured for you.

Use the Sophos Connect client to connect your endpoint devices to the permitted resources within your organization's network. All traffic or only network-destined traffic from your device flows through the tunnel. It's based on the setting your network administrator specifies.

Note

VPN portal is available from SFOS 20.0. If you're migrating from a previous version, see New VPN portal in SFOS 20.0 and later.

Access the VPN portal

You can access the VPN portal only if you're part of a remote access IPsec or SSL VPN, clientless SSL VPN, L2TP, or PPTP policy.

To access the VPN portal, do as follows:

  1. Browse to https://<Sophos Device IP Address>:443.

    Port 443 is the default port for the VPN portal. If your administrator's configured a different port, they'll share the details with you.

VPN portal language

To change the VPN portal language, do as follows:

  1. On the VPN portal sign-in page, click the language drop-down.

    VPN portal language drop-down.

  2. Select the language you want.

  3. Sign in to the VPN portal.

    The VPN portal uses the selected language.

Sophos Connect client

Do as follows to connect your endpoint devices to the network using the Sophos Connect client:

  1. Click Download for Windows or Download for macOS.
  2. Install the client on your endpoint device.
  3. To use the tunnel, sign in to the client using your VPN portal credentials.
  4. Enter the verification code if you're prompted for multi-factor authentication.

  5. On the Sophos Connect client, click the three dots button in the upper right corner and click Import connection to import the files. Do as follows:

    • IPsec: Double-click the .pro file your administrator shares with you to automatically import the .scx file. Alternatively, import the .scx file your administrator shares with you.

      For iOS devices, you must download and install the IPsec configuration file directly from the VPN portal.

    • SSL VPN: Double-click the .pro file your administrator shares with you to automatically import the .ovpn configuration file to the Sophos Connect client.

      If the administrator doesn't share the provisioning file, click the configuration file you want under VPN configuration. Download the .ovpn file and import it into the Sophos Connect client.

      The configuration files only appear if your administrator has configured the corresponding remote access IPsec or SSL VPN remote access policy for you.

    Note

    Currently, the Sophos Connect client doesn't support macOS for SSL VPN. For macOS, we recommend that you use the OpenVPN Connect client.

    The Sophos Connect client doesn't support mobile platforms for IPsec and SSL VPN.

    Import connection to Sophos Connect client.

VPN configuration

The SSL VPN configuration files for download show up only when the administrator assigns a remote access SSL VPN policy to you. The configuration files are .ovpn files.

Download and install the file from the following options:

  • Download for Windows, macOS, Linux
  • Download for Android and iOS

Note

You can use this .ovpn configuration file for Sophos Connect and other SSL VPN clients.

Tip

If you're using the .ovpn file, and SSL VPN tunnels that had connected earlier fail to connect now, download and import the file again and try to connect. You must do this if your administrator's made changes to the configuration.

If you're using the provisioning (.pro) file instead, you don't need to update either of the files. The .pro file automatically pulls the changes.

More resources