This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG SSL VPN Group IP white list

Is there a method to white list IPs per SSL VPN group, to only allow those users to be able to VPN in if they are coming from the list static IPs?

This thread was automatically locked due to age.

Top Replies

Quallensaft over 1 year ago +3 suggested

Because SSL VPN is device access setting based, maybe try with 2 ACL exception rules: - first allow your list > SSL VPN - that drop ANY (0.0.0.0/0) > SSL VPN But never tested if working. docs.sophos…

0 Quallensaft over 1 year ago

Because SSL VPN is device access setting based, maybe try with 2 ACL exception rules:

- first allow your list > SSL VPN

- that drop ANY (0.0.0.0/0) > SSL VPN

But never tested if working.

docs.sophos.com/.../LocalServiceACLEdit.html
Cancel
Vote Up +3 Vote Down

Cancel
0 dirkkotte over 1 year ago in reply to Quallensaft

That's the correct way.
But it may be a little more simple:
remove checkbox for SSL-VPN from device access / Local service ACL->WAN
Create one ACL exception rule allowing SSL-VPN from specific IP.

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up +1 Vote Down

Cancel
0 Rich Skaretka over 1 year ago

How would you specify this rule to only 1 Authentication Group vs all SSL VPN users? I want to lock down this one group to their office static IPs to only be able to access our SSL VPN .
Cancel
Vote Up 0 Vote Down

Cancel
0 dirkkotte over 1 year ago in reply to Rich Skaretka

You can't specify specific IP's for specific SSL-VPN definitions.
I use only one profile for all allowed VPN-users and create user/group specific firewall-rules that control access.

Dirk

Systema Gesellschaft für angewandte Datentechnik mbH // Sophos Platinum Partner
Sophos Solution Partner since 2003
If a post solves your question, click the 'Verify Answer' link at this post.
Cancel
Vote Up +1 Vote Down

Cancel