Attempts to download Sophos Connect client (IPsec and SSL VPN) from an XG135 User Portal result in a text file

Hello Chris,

Thank you for contacting the Sophos Community.

This issue is being investigated under NC-70289

As a workaround, you can share the Client with users if you download it from the XG it self.

Configure >> VPN >> IPSec (Remote Access) >> Download Client

Regards,

Thanks for getting back to me. I'll be handing out Clients manually for now.

Just to be sure...Does your reference to NC-70289 means that Sophos is aware of the issue (has a bug report or internal support ticket) and that a fix will be out sometime? If so, I'm satisfied.

Sincerely,

Chris

How can I even get the SSLVPN Client and Config files?

Sophos Connect can do this with SC2.0/2.1. https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-connect-2-0-is-now-ga

That’s the issue we don’t use the connect client, we have everyone set up on the SSL VPN Client haha, so we don’t have a workaround, hence the urgency 

Start migrating to Sophos Connect, as it is the better solution in the long time. 

I can't find any Item like 'Sophos Connect' in the vpn menue. SFOS 18.0.4 MR-4

and the link 'Konfiguration für andere Betriebssysteme' in the user Portal will not work. 

I can't see any advantage.

Sophos Connect is a endpoint client solution, which can work with SSLVPN and IPsec VPN.

You can configure IPsec (remote access) and SSLVPN (Remote access) on XG. It will communicate with Sophos Connect. 

Release notes shows how to configure this option: https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-connect-2-0-is-now-ga

You need a configuration file, which points the Sophos Connect to XG. SC will connect to the XG, get the sslvpn config file and the ipsec config file. 

The download results in a file which contains: 'Requested file could not be provided. Make sure Pattern Updates are working correctly.
You can find it under 'Backup & Firmware' -> 'Pattern Updates''

- the Pattern Updates are working

no progress

This is still under investigation for the User Portal. 

Are we close to a solution 20 days after the problem was reported? I'd say this is a critical bug, given I've tested on a number of Firewalls all on latest version, all have same issue, how does a critical bug like this even make it into production. 

Sophos has been paid, we can ship the firewalls to customers with this bug. The customer bought because of the SSL VPN. And we cannot invoice the customer. Of course we won't be offering any more XG's at the moment.

Sophos has been paid, we can ship the firewalls to customers with this bug. The customer bought because of the SSL VPN. And we cannot invoice the customer. Of course we won't be offering any more XG's at the moment.

Still i do not understand the point of using SSLVPN compared to Sophos Connect. 
Why would you publish to a new customer a old version of a product? 

I don't care whether I can use Sophos connect or SSL VPN for the customer, I need something that works and neither of them works.

Are you for real? Neither work! Regardless! ‘Old version’ it might be just that, but it’s still supported by Sophos and for users who just need a basic SSL-VPN client there is no reason not to, if your saying it’s redundant compared to connect then why is it still included with XG? Instead of asking condescending questions, try fixing the product in the first place. All it leaves is a sour taste if Sophos response to a critical bug being ‘well if you used this other version, you’d have a workaround’

Maybe i need to quickly recap the possibilities and the current limitation.

Limitation/Bug: Sophos Connect config + Installer cannot be downloaded by the User (user portal). PS: This option is new. 

How do administrator publish VPN (Sophos connect): 

You can download the software (Sophos connect installer) via Webadmin (Port4444). This File is a MSI Installer for general install purpose. Most administrator publish this software via GPO or software deployment tools to managed Clients. You can also give this MSI File to a user, if you want to install it locally (Admin privileges needed). 

After the Sophos Connect is installed on the Client, the admin will build a config file for the user. For example a SSLVPN Config file: 

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/SConProvisioningFile.html?hl=sophos%2Cconnect%2Cprovisioning%2Cfile

Generally speaking a file, which points the Sophos Connect to the XG WAN IP. 

[
 { 
 "gateway": "<Enter your gateway hostname or IP address>", 
 "user_portal_port": 443, 
 "otp": false, 
 "auto_connect_host": "<Enter internal hostname or IP address>", 
 "can_save_credentials": true, 
 "check_remote_availability": false, 
 "run_logon_script": false 
 } 
]

This file will be imported via GPO/Software Deployment or manually. 
Push it to the client into the folder "import" in Sophos Connect install directory. 

The user will see this config immediately: The user will use his own credentials to login. 
The Connect client will do the rest and import its own, user based, config file.


This process works fine. 




The (old) SSLVPN part also works fine. 
You can simply login to the user portal and download your old SSLVPN Config + SSLVPN Installer. This is a "per user view". 


PS: This is not a critical bug, as this process is new and not many people are using this approach. 

I would like to mention two points here about SSLVPN client

a. if you are using Old SSLVPN client, its working as it is there is no issue with it. User can continue downloading client and config from user portal.

b.if you are using Sophos connect client for SSLVPN its broken in v18MR4 release and getting tracked as part of NC-70289.

Still there are two alternative ways to provide client to end user which are captured in following article.

https://support.sophos.com/support/s/article/KB-000041377?language=en_US

I see: 

This is affecting SSL-VPN old for me and I've replicated this on multiple XGs running latest Firmware, you press download Client and Configuration and get no response, dev tools shows Javascript errors.

Ok - Lets slow down. 

Dirk Burg - Do you get a cred auth page, which asks for your creds and a captcha portal. Or does it not start in general? If you go to the user portal (manually), can you download the config for sslvpn for different OS (not Sophos connect)? 

Sam Cunliffe That is correct, but that is not what should matter in any kind of scenario. If you download the SSLVPN for other OS, it still should work. And this ovpn should be importable in the Sophos Connect. 

Alok posted the Link to the KB, which indicates the issue and the limitation is only the New MR4 version, presented to the end user. 

If Sophos Connect/SSLVPN would be broken, there would be more feedback in the community than this. This feature is perfectly working for every Sophos customer today. Only the new option to give the user a own download link is broken, which basically is not in use by many customer. (Most likely because a user do not has admin privileges on their windows client). 

No, the old ssl-vpn client cannot be downloaded under 18MR4, if that would work I would have no problem.