Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Replies 26 replies
  • Answers 3 answers
  • Subscribers 40 subscribers
  • Views 18790 views
  • Users 0 members are here
Options
Suggested

Sophos VPN Client - disable autoconnect when in local network

Kam

Hi all,

I'm struggling with setting up Sophos VPN Client on user's Windows computers.

What behaviour I expect is to automatically connect when user connects any network except internal LAN/WIFI.

So if users is turning on the laptop at home and connects to his/her home WIFI, Sophos Client shoud connect VPN immediately. But when user comes to the office and connects to LAN network, Sophos Client should stop connecting. I edited ovpn config file and added auto_connect parameter as LAN VLAN network address (192.168.3.1), but it didn't help - after connecting to office's wifi, Sophos Client is connecting to VPN.

Next thing I tried was to block SSL VPN in firewall administration and it helped, but now Sophos Client is continuously trying to connect, fails, tries again, fails, and so on.

How to set it up so it just stops trying to connect when in LAN, and after network change (going back to home), connects VPN immediately?



Added TAGs
[edited by: Raphael Alganes at 11:11 PM (GMT -7) on 24 Mar 2024]
Parents
  • 0

    With Sophos connect you can provision a provisioning file with an auto_connect_host. See this for more explanation.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels

    OK, I did it, created .pro file and imported to client's Sophos Connect. Instantly it discovered that it's in LAN, so no auto-connect is needed, but when I tried to connect to download policy (nevermind if from LAN WIFI or another VLAN WIFI with user portal and VPN portal enabled) it gives an error:

    No SSL VPN policy is defined for this user

    And it's not true - in Sophos Firewall on REMOTE ACCESS VPN section SSL VPN under my policy members I have this user.. And on the user side there's also SSL VPN policy choosen.

  • 0 in reply to Kam

    Try to have the user login to the VPN-portal and download the config (it is an .ovpn file). Double click this file to import it to Sophos connect and see if that makes a difference.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels

    You mean I should delete the .pro configuration from Sophos Client and import standard config from user VPN Portal? If so - I've done it. As I wrote at the beginning, I started from that. So now when I deleted .pro config file and imported new ovpn config from VPN Portal, user can log in without problems. But of course there is no option to auto-connect.

    One other thing - I have dynamic DNS set up, but when I download the ovpn file, there are three remote addresses at this order - WAN address, my server VLAN network address (which I created and set access for VPN network), and lastly domain address from my dynamic dns server. When I imported the file "as it is", Sophos Connect pointed my WAN address and I didn't have a chance to anyhow change it. So I edited ovpn file, deleted first two lines, left only ddns domain and imported the file to Sophos Connect. Works like a charm, but as I mentioned - there is no auto-connect then...

  • 0 in reply to Kam

    Are you sure that fqdns/ip-addresses in the .pro file are correct? 

    Do you see anything in the firewall logging about the request failing when using the .pro file?

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Reply
  • 0 in reply to Kam

    Are you sure that fqdns/ip-addresses in the .pro file are correct? 

    Do you see anything in the firewall logging about the request failing when using the .pro file?

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Children
  • 0 in reply to apijnappels

    I've done it along with instruction from your link - I created empty txt file and copied provisioning file template for single connection. For gateway I entered dynamic domain name so it can resolve my WAN IP every time, then entered correct user portal port, opt left as default (false), for auto_connect_host I entered interface IP for users VLAN, check_remote_availability as false and run_logon_script also false. That's it - hard to make a mistake here. As for the firewall - I log traffic on rule VPN to WAN, but there is nothing there. Should I checked somwhere else?

  • 0 in reply to Kam

    Sounds like everything is correct. With logging you can also check VPN log to see if you can find something there.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Unfiltered HTML