Sophos SSLVPN and DUO

Hi Richard,

Thank you for reaching out to Sophos Community.

For adding of  separate input box,kindly try the following KB which might assist you

•  Sophos Firewall: Enable separate (3rd) input box for SSLVPN MFA instead of Password+OTP. 

Hi Erick,

I figured it out, I need to added radius Auth to the user portal as well. Now when a user imports the provisioning file it asks for the duo code and the captcha for the user portal access. This authenticates and downloads the users vpn connection profiles.

Do you know how to get rid of an old IPsec connection profile from a user. The provisioning connection is downloading 2 connection profiles which will only confuse our users.

Thanks 

Hi Erick,

I figured it out, I need to added radius Auth to the user portal as well. Now when a user imports the provisioning file it asks for the duo code and the captcha for the user portal access. This authenticates and downloads the users vpn connection profiles.

Do you know how to get rid of an old IPsec connection profile from a user. The provisioning connection is downloading 2 connection profiles which will only confuse our users.

Thanks 

Hi Richard,

That is great to hear. Thank you for the update.

For the profile, kindly try to check here C:\program files (x86)\Sophos\Connect\Protected folder.

Hi Erick,

If I delete all the connection profiles from the client and also clear out the files in C:\program files (x86)\Sophos\Connect\Protected and then run the provisioning file. I get my new sslvpn login, but I also get an old ipsec vpn connection profile, which is no longer needed. Do I have to reset the IPSec section of the vpn on the firewall?

Thanks for all your help

Richard

Hi Richard,

Is the IPsec VPN still being used? if not, can you try to disable it, then try to redownload if you are still going to get the profile?

Hi Erick,

IPsec is already disabled, after setting up both ipsec and ssl we decided ssl was better for our users and disabled ipsec. But now I still get the ipsec proviosioned connection even though its disabled.

Hi Richard,

Can you check if the user is still included in the IPsec Group? if yes, try to remove it. 

Also, I would recommend creating a case for Support for further checking and kindly share the case ID here. 

Hi Erick,

As we're not using remote IPsec vpn, I've reset the config and that has done the trick. Thanks for all your help in getting this fixed for me.

Hi Richard,

That is great to hear and thank you for the update.