Thread Info
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Connect Client Provisioning Files with MFA enabled

DavidSain

I setup a connect client with a provisioning file.  Had Authentication to an AD server setup.  When the user connects for their first time while using a provisioning file, it works beautifully.

Now, enter MFA.  Because most places want some extra security.

With a new user and new Provisioning file to enable MFA.  User cannot login to VPN and have everything setup from there. Since they have to put a token in to be able to authenticate and they don't have a token yet, this fails. They still have to go to the user portal to set that up.  

As the Sophos Connect Client acts like a browser with the initial setup, it would be nice if when MFA is enabled, it would work the same way.

If anyone has worked through this before, how does this work for you?  Do you push out a .pro file to the users but still have them go to the portal to setup MFA first?

Thanks,

D



This thread was automatically locked due to age.
  • 0

    Hello there,

    Good day and thanks for reaching out to Sophos Community, hope you are well. 

    Can you confirm if this is the encountered behavior (Kindly see screenshot) as it might be related to a known issue on Sophos Connect (NCL-1391) https://doc.sophos.com/support/kil/index.html

    Further, could you also try steps from this Recommeded Read to work on this issue?  Sophos Firewall: Enable separate (3rd) input box for SSLVPN MFA instead of Password+OTP. 

    Kindly let us know how it goes. Many thanks for your time and patience and thank you for choosing Sophos

    Cheers,

    Raphael Alganes
    Global Community Engineer, Support & Services
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the 'Verify Answer' button.

    The award-winning home for Sophos Support videos! - Visit Sophos Techvids

    • 0 in reply to Raphael Alganes

      Thank you Raphael.

      We are not prompted with any steps in the client to setup MFA, so the token rotation doesn't affect end users.

      Additionally, I've enabled the 3rd inbox for IPsec VPN + MFA.  As the user that has the *.pro file deployed doesn't have a token, they cannot login.

    • 0 in reply to Raphael Alganes

      Hi Raphael,

      This issue us unrelated to that issue.

      I'm well aware of how to enable the 3rd box for the token entry and we implemented that some time ago. 

      I want to use provisioning files. We are moving customers off of SonicWall going to SF and using provisioning files will go a long way to making the transitions easier.

      I was looking at a way of using a .pro file to enable all the desired settings so when a user connects for the first time, they are fully setup without having to connect to the user portal when MFA is enabled.  This is possible when MFA is not enabled - when MFA is not enabled, a user connects to the VPN client and the VPN client connects to the user portal and the user is automatically provisioned by pulling from the Active Directory group..

      When MFA is enabled, the user still has to login to the user portal to obtain the QR code.


      Additionally, if we update the configuration in the SF related to IPsec remote access VPN to enable the field while using a provisioning file, this update is NOT pushed out to the end user devices. When MFA is enabled, a new provisioning file must first be distributed to replace the original.  All other settings made here will update the client via the existing provisioning file.

    • 0

      "it would be nice if when MFA is enabled, it would work the same way"

      Also my problem with the connection client, right now the provisioning with OTP is useless when users need to login manual in the user-portal first. Why is the client not just showing the QR to the user on the first login like you said...

      BUT:
      Even if the user already has a MFA code the connect client is too "stupid" for provisioning without error-message, because the client is doing 2 logins (provisioning + connect to the provisionised connection right after) -> failed because OTP code is not valid after 1 login:

      https://community.sophos.com/sophos-xg-firewall/f/discussions/140915/unsatisfactory-implementation-of-provisioning-otp-in-sophos-connect-client

      I just hope Sophos is adding some more (usefull and testet!) OTP/MFA support to the client regarding first time login when MFA is activated + provisioning without any errors because the client is trying more than 1 login with an OTP code.