Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Sophos Firewall: Sophos Connect Migration script from UTM SSL VPN

Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.


This Recommended Read is in the Beta stage scripting and includes the following. 

  • Backup the old ".ovpn" configuration from SG UTM SSL VPN
  • Removes old SG UTM client
  • Installs Sophos Connect
  • Imports the old configuration into Sophos Connect so users can still connect to UTM.
  • Installs a provisioning file for the coming Sophos Firewall so that migration will be easier

The script has been tested and is working. Implementation in Test Environment is highly recommended before proceeding to the Production side,

@echo off

IF NOT EXIST "c:\Program Files (x86)\Sophos\Sophos SSL VPN Client\uninstall.exe" goto :eof
	REM Remove the old client
	REM Kill running programs, preventing uninstall
	taskkill /im openvpn* /F
	timeout 2
	REM Backup the OVPN config file
	rem rmdir "c:\!vpn" /s /q
	mkdir c:\!vpn
	copy "c:\Program Files (x86)\Sophos\Sophos SSL VPN Client\config\*.ovpn" c:\!vpn\
	REM Use uninstaller to remove the client
	cd\Program Files (x86)\Sophos\Sophos SSL VPN Client
	Uninstall.exe /S
	timeout 10
	REM Do folder cleanup - if not, Sophos Connect refuse to install
	rmdir "c:\Program Files (x86)\Sophos\Sophos SSL VPN Client" /s /q

	SET Sophos_Connect=Sophos\Connect\scvpn
	IF NOT EXIST "%ProgramFiles(x86)%\%Sophos_Connect%" GOTO INSTALL
	exit /b 0
	IF NOT EXIST "%ProgramFiles%\%Sophos_Connect%" GOTO INSTALL
	exit /b 0
	msiexec.exe /i "\\server\share\SophosConnect.msi" /QN
	timeout 5
	REM Deploying SSLVPN provisioning file - user must connect once with the client to fetch their profile when SF is in place.
	REM Userportal on SF must be accessible and with a valid certificate!
	copy /Y "\\server\share\" "C:\Program Files (x86)\Sophos\Connect\Import\"
	REM Deploying old SSLVPN for UTM 
	copy /Y "c:\!vpn\*.ovpn" "C:\Program Files (x86)\Sophos\Connect\Import\"
	REM Start Gui - tray icon.
	start "" "C:\Program Files (x86)\Sophos\Connect\GUI\scgui.exe"



        "gateway": "", 
        "user_portal_port": 4445, 
        "otp": false, 
        "auto_connect_host": "", 
        "can_save_credentials": true, 
        "check_remote_availability": false, 
        "run_logon_script": false 

Attached are the bat file and the provisioning file

Let me hear your thoughts :-)

Revamped RR Corrected Grammar Added Horizontal Line at the End
[edited by: Erick Jan at 11:22 AM (GMT -7) on 22 Sep 2023]