Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Sophos VPN Client - disable autoconnect when in local network

Hi all,

I'm struggling with setting up Sophos VPN Client on user's Windows computers.

What behaviour I expect is to automatically connect when user connects any network except internal LAN/WIFI.

So if users is turning on the laptop at home and connects to his/her home WIFI, Sophos Client shoud connect VPN immediately. But when user comes to the office and connects to LAN network, Sophos Client should stop connecting. I edited ovpn config file and added auto_connect parameter as LAN VLAN network address (192.168.3.1), but it didn't help - after connecting to office's wifi, Sophos Client is connecting to VPN.

Next thing I tried was to block SSL VPN in firewall administration and it helped, but now Sophos Client is continuously trying to connect, fails, tries again, fails, and so on.

How to set it up so it just stops trying to connect when in LAN, and after network change (going back to home), connects VPN immediately?



Added TAGs
[edited by: Raphael Alganes at 11:11 PM (GMT -7) on 24 Mar 2024]
Parents
  • With Sophos connect you can provision a provisioning file with an auto_connect_host. See this for more explanation.


    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • OK, I did it, created .pro file and imported to client's Sophos Connect. Instantly it discovered that it's in LAN, so no auto-connect is needed, but when I tried to connect to download policy (nevermind if from LAN WIFI or another VLAN WIFI with user portal and VPN portal enabled) it gives an error:

    No SSL VPN policy is defined for this user

    And it's not true - in Sophos Firewall on REMOTE ACCESS VPN section SSL VPN under my policy members I have this user.. And on the user side there's also SSL VPN policy choosen.

  • Are you sure that fqdns/ip-addresses in the .pro file are correct? 

    Do you see anything in the firewall logging about the request failing when using the .pro file?


    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • I've done it along with instruction from your link - I created empty txt file and copied provisioning file template for single connection. For gateway I entered dynamic domain name so it can resolve my WAN IP every time, then entered correct user portal port, opt left as default (false), for auto_connect_host I entered interface IP for users VLAN, check_remote_availability as false and run_logon_script also false. That's it - hard to make a mistake here. As for the firewall - I log traffic on rule VPN to WAN, but there is nothing there. Should I checked somwhere else?

  • Sounds like everything is correct. With logging you can also check VPN log to see if you can find something there.


    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • Hi  , if you want openvpn to connect to only the ddns, you can specify it in the "Override hostname" in the SSLVPN global settings on the firewall:
     

    With this, the .ovpn file will only have the override hostname in its remote directive and you will be able to use the .pro file also.

  • I have a problem with that. Don't know why, but when I open SSL VPN global settings and even try to save without any changes, error message tells me YOU MUST ENTER A NETWORK IP ADDRESS.

    Nevermind if I put something in override hostname or not.

    From top to bottom I have this:

    Unfortunately when I click APPLY, the error comes out. The problem is, after clicking OK on the error, SFOS doesn't point to any specific field (nor by standing in that field, nor by making the field red or marked in any other way).

    Next when I enter in OVERRIDE HOSTNAME my ddns hostname (domain, not IP address) I get the same error. Despite I added Dynamic DNS service in NETWORK settings and it connected succesfully on domain name.

  • This should not happen. This is seen if we have some problem in the interface configuration. If you can share the access id in DM, we can take a look at this problem. Alternatively, you can open a support ticket and share the access id via the ticket.

  • The problem is the IPv4 address you have specified. Make a network out of it because you have the netmask 24 .

    Net: 10.81.234.0

  • OK, so it helped with global settings saving - after changing IP to 10.81.234.0 as well as override hostname with my ddns host, SFOS let me save config.

    Unfortunately, when imported .pro config on user's laptop, after skipping wrong certificate warning, I tried to connect, enter username and password (which is working fine for ovpn config) and the results are:

    1. when in LAN - error "No SSL VPN policy is defined for this user"

    2. When on external hotspot - FAILED TO LOAD CONNECTION (which, I assume, is obvious because Sophos Connect can't import ovpn setup from VPN/user portal. But it was worth trying to be 100% sure)

    What's another weird thing - when I enabled SSL VPN, in global settings there already was this incorrect IP set up. I didn't change anything, so it looks like Sophos has wrong data as default setup.

  • How are your device access settings configured, did you enable SSL VPN for the correct zones?


    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • Although I had SSL VPN checked only for WAN, for the tests I checked this for all my networks. Still the same error about no ssl vpn policy.

Reply Children