How to make IPsec Remote Access VPN can dial in when the user account didn't exist/sync in XG?

Hi Shunze Lee,

Thank you for reaching out to Sophos Community.

You can use the provisioning file (.pro) and can import it to Sopho connect client. This will provision IPsec and SSL VPN connections with Sophos Firewall. If the user/group has access to IPsec (remote access), then the provisioning file automatically imports the .scx configuration file into the Sophos Connect client.

Click here to know more information on the Sophos Connect provisioning file.

Hi Shunze Lee,

Thank you for reaching out to Sophos Community.

You can use the provisioning file (.pro) and can import it to Sopho connect client. This will provision IPsec and SSL VPN connections with Sophos Firewall. If the user/group has access to IPsec (remote access), then the provisioning file automatically imports the .scx configuration file into the Sophos Connect client.

Click here to know more information on the Sophos Connect provisioning file.

Hi, the issue was described as following document.

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/VPNSophosConnectAuth.html

IPsec remote access VPN uses the Sophos Connect client. If a remote user, for example, an AD user, wants to sign in to the Sophos Connect client for the first time, they must first sign in to another authentication client, such as the user portal.

Client need their users can sing in Sophos Connect directly without sing in another authentication first.

Any suggestion?

As mentioned if the user has an access to IPsec (remote access), then the provisioning file will automatically import the .scx configuration file into the Sophos Connect client. The AD user will be authenticated and his profile will also be created automatically without sign in to any other authentication method.

Try to follow the steps below and let me know if you've any queries.

==> Create a provision file with .pro extension

[
{
"gateway": "<Enter your gateway hostname or IP address>",
"user_portal_port": <User_Portal Port>,
"otp": false,
"auto_connect_host": "<Enter internal hostname or IP address>",
"can_save_credentials": true,
"check_remote_availability": false,
"run_logon_script": false
}
]

==> You can find user portal port from Administration > Admin & user settings > Admin console and end-user interaction

==> Import .pro file into Sophos Connect client and connect it. It’ll automatically import the IPsec remote access (.scx) configuration file into the Sophos Connect client on users' end machine.

Refer to the below link to get more information on "Sophos Connect provisioning file".

Sophos Connect provisioning file

HIi, 

Can you tell me the different between gateway and auto_connect_host in pro config?

What IP should i input?

Shunze

Gateway: Public IP or hostname of the Sophos Firewall

auto_connect_host: Enter a hostname or IP address within the local network. It helps Sophos Connect client to monitor automatic connections.

So the "auto_connect_host" can be the LAN IP address of XG firewall?

You can either keep the firewall LAN IP address or any internal server(always-on) IP address.

Hi,

It works.

But client didn't allow User Portal access from WAN.

So cllient still use L2TP first, then use IPsec VPN.

Anyway thanks for help.