Sophos UTM Console

Open Management, System Settings. There is a tab labeled Shell Access. There you have the option to add allowed networks for the shell access, you may add "internal (Network" and probably VPN Pools, if you need it. Additionally, chose password authentication or public key, or both.

I mean Web Console. When I type the real IP in a browser, it still goes to login screen.

Oh, I found it. It is at "WebAdmin Settings".

Oh, got you. Have a look at Management, WebAdmin Settings. On the General Tab, you may define admins and networks that may access the WebAdmin/Web Console.