SSL VPN 2FA options - or how to prompt for the OTP token?

Have a look at the Provisioning file template for the Sophos Connect: https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/RemoteAccessVPN/IPsecSSL/SophosConnect/RAVPNSConProvisioningFile/index.html#templates

[
    {
        "otp": true,
        "can_save_credentials": true,
    }
]

These Options should do what you want.

Then you could deploy the file for your Users and the connect client will get the VPN config from the firewall.

Have a look at the Provisioning file template for the Sophos Connect: https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/RemoteAccessVPN/IPsecSSL/SophosConnect/RAVPNSConProvisioningFile/index.html#templates

[
    {
        "otp": true,
        "can_save_credentials": true,
    }
]

These Options should do what you want.

Then you could deploy the file for your Users and the connect client will get the VPN config from the firewall.

Oh hey - that looks promising - there's a note there that says I can set it to show a third box for totp.  If I can get that to go it's the perfect fix.
I'll update the thread after I test.
Thank you!