VPN. Sophos v16.5
Hirdetés
Hirdetés
Sophos XG Firewall | Configure | 209
Related information
How to implement Single Sign-On using STAS
Add New Collector
This page describes how to add a collector.
The STAS Collector collects user authentication requests from multiple agents, processes the requests and sends them to Sophos XG Firewall for authorization.
1. Go to Configure > Authentication > STAS.
2. Click Add New Collector.
3. Specify the collector details.
Collector IP
Enter a collector IP address.
Collector Port
Select collector port.
Default: 6677
Collector Group
Select a collector group. If you select New Group the collector will automatically be tagged with a group number. If you select Existing Group you can add the collector to an existing group.
Figure 165: Add New Collector
4. Click Save.
Disable STAS
This page describes how to disable STAS.
If you disable STAS, the current STAS configuration will be removed.
1. Click the toggle switch of the Sophos Transparent Authentication Suite.
2. Confirm deactivation by clicking on the Confirm removal of STAS configuration button.
VPN
The VPN menu allows you to configure required IPsec, L2TP, PPTP and SSL VPN connections and connections with a CISCO
™
VPN Client. Also, the section allows certificate and bookmark management required in the configured
VPN connections.
A virtual private network (VPN) is a tunnel that carries private network traffic from one endpoint system to another over a public network such as the Internet without the traffic, being aware that there are intermediate hops between the endpoints or the intermediate hops being aware they are carrying the network packets that are traversing the tunnel. The tunnel may optionally compress and/or encrypt the data, providing enhanced performance and some measure of security. VPN allows you to pretend you are using a leased line or a direct telephone call to communicate between the endpoints. VPNs allow users and telecommuters to connect to their corporate intranets or extranets.
VPNs are cost-effective because users can connect to the Internet locally and tunnel back to connect to corporate
Sophos XG Firewall | Configure | 210 resources. This not only reduces overhead costs associated with traditional remote access methods, but also improves flexibility and scalability. For all business people traveling or working from home, connecting securely to the corporate network is essential. With the device, setting up a VPN is almost effortless.
The two endpoints in deevice VPN are referred to as:
• Local - First endpoint is the local machine itself.
• Remote - Second endpoint is the remote peer - the machine you are trying to establish a VPN connection to, or the machine which is trying to establish a VPN connection with you.
Device VPN automatically encrypts the data and sends it to the remote site over the Internet, where it is automatically decrypted and forwarded to the intended destination. By encrypting, the integrity and confidentiality of data is protected even when transmitted over the un-trusted public network. Device uses IPsec standard i.e. IPsec protocol to protect traffic. In IPsec, the identity of communicating users is checked with the user authentication based on digital certificates, public keys or preshared keys.
Device ensures that all the VPN traffic passing through the VPN tunnels is threat free. All the firewall rules and policies are applicable to the traffic going into the VPN tunnels and coming out of the VPN tunnels. Device inspects all the traffic passing through the VPN tunnels and makes sure that there are no viruses, worms, spam, and inappropriate content or intrusion attempts in the VPN traffic. As VPN traffic is by default subjected to the DoS inspection, the device provides a facility by which one can bypass scanning of traffic coming from certain hosts from a VPN zone. The above functionality is achieved by adding one additional zone called VPN zone. VPN traffic passes through the VPN zone and a firewall rule can be applied to the VPN zone.
Device can be used to establish VPN connection between sites, LAN-to-LAN and client-to-LAN connection. VPN is the bridge between local & remote networks/subnets.
Device supports following protocols to authenticate and encrypt traffic:
• Internet Protocol Security (IPsec)
• Layer Two Tunneling Protocol (L2TP)
• Point-to-Point Tunneling Protocol (PPTP)
• Secure Socket Layer (SSL)
IPsec Connections
The IPsec menu allows you to create and manage IPsec connections and failover groups.
IP Security (IPsec) is a suite of protocols designed for cryptographically secure communication at the IP layer (layer
3).
IPsec protocols:
• Authentication Header (AH) – Used for the authentication of packet senders and for ensuring the integrity of packet data. The authentication header protocol (AH) checks the authenticity and integrity of packet data. In addition, it ensures that sender and receiver IP addresses have not been changed during transmission. Packets are authenticated using a checksum created by using a hash-based message authentication code (HMAC) in connection with a key.
• Encapsulating Security Payload (ESP) – Used for encrypting the entire packet and for authenticating its contents. In addition to encryption, ESP provides the ability to authenticate senders and verify packet contents.
This page contains two (2) sections:
1.
2.
IPsec Connections
The IPsec Connections section displays a list of all the IPsec connections. You can filter the list based on name, group name, policy name, connection type, and status of the connection. The page also provides the option to add a new connection, update the parameters of the existing policy, or delete a policy. In addition, you can create a
Sophos XG Firewall | Configure | 211 connection manually or through the connection wizard. In case of a remote access connection export the connection configuration by clicking the Export icon under the Manage column.
Note: You can also view and manage active IPsec connections on the System > Current Activity > IPsec
Connections page.
The status of each connection is indicated as follows:
Connection Status
Active Connection
Description
Connection is active but not connected. Click to initiate the connection.
Connection is active and connected. Click to disconnect the connection.
When you disconnect, the connection will be deactivated. To re-establish the connection, activate the connection.
Connection is active but only partially connected. Click to disconnect the connection. When multiple subnets are configured for LAN and/or remote network, the device creates a sub-connection for each subnet. This status indicates that one of the sub-connections is not active.
Connection is inactive. Click to activate the connection.
Failover Group
Connection Failover
Connection Failover is a feature that enables you to provide an automatic backup connection for VPN traffic and provide “Always ON” VPN connectivity for IPsec connection. If the primary connection fails, the subsequent connection in the group will take over without manual intervention and keep traffic moving. The entire process is transparent to users.
Connection Failback
During a connection failure, the device checks the health of a primary connection every 60 seconds. When the primary connection is restored without the administrator’s intervention, the secondary connection fails back to the primary connection.
Connection Failover Group
A VPN group is a grouping of IPsec connections. The phase 1 and phase 2 security parameters for each connection in a group can be different or identical except for the IP address of the remote gateway. The order of connections in the group defines the failover priority of the connection. Failover to the next connection will not occur if the group is manually deactivated.
The failover group containing the connection must be activated for the first time before participating in the failover.
Failover to the next connection will not occur if the group is manually disconnected.
When the primary connection fails, the subsequent active connection in the group takes over without manual intervention and keeps traffic moving. For example, if the connection established using the 4th connection in the group is lost then the 5th connection will take over. Once the 4th connection is re-stored, the 5th connection will automatically fail back on the 4th connection.
The device considers a Site to Site and Host to Host connection as failed connection if the remote peer does not reply.
Connections that are not a part of the connection group do not participate in failover/failback process and such connections will not be re-established automatically if lost.
To configure connection failover, you have to:
• Create connections.
Sophos XG Firewall | Configure | 212
• Create a failover group. A failover group is created by grouping all the connections that are to be used for failover.
The order of connections in the group defines the failover priority of the connection.
• Define a failover condition.
Prerequisites
• Packets of the protocol specified in the failover condition must be allowed from local server to remote server and its reply on both local and remote server
• One connection can only be member of single group
• Connection must be ACTIVE to participate in failover
Procedure
1. Once the connection is added as a member of the group, DPD is configured as “Disable”, Key Negotiation Tries as
3, and Action on VPN Restart as “Disable”.
2. Once the connection is removed from the group, the original policy and connection configuration will be considered.
3. If the connection is already established at the time of adding it in the failover group, it will get disconnected.
4. On factory reset, failover configuration will not be retained.
The Failover Group section displays the list of created failover groups. You can filter or sort the groups based on group name. You can add a new group, update, or delete the group. In addition, the list displays the status of the group as: indicating an activate group while indicates an inactive group.
Related concepts
on page 212
IPsec connection is the encrypted VPN connection established between two systems using the Internet protocol security (IPsec). It can link two hosts, two sites or remote user and a LAN.
Related tasks
on page 230
This page describes how to set up a failover group.
Types of IPsec Connections
IPsec connection is the encrypted VPN connection established between two systems using the Internet protocol security (IPsec). It can link two hosts, two sites or remote user and a LAN.
The device supports following types of IPsec connections:
•
– This type of VPN is a user-to-internal network connection via a public or shared network. Many
large companies have employees that need to connect to the internal network from the field. These field agents access the internal network by using remote computers and laptops without a static IP address.
•
– A Site to Site VPN connects an entire network (such as a LAN or WAN) to a remote network via a
network-to-network connection. A network-to-network connection requires routers on each side of the connecting networks to transparently process and route information from one node on a local LAN to another node on a remote LAN.
•
– Host to Host VPN connects one desktop or workstation to another station by way of a host-to-host connection. This type of connection uses the network to which each host is connected to create a secure tunnel between the two.
Select to
•
Add IPsec Remote Access Connection
•
Add IPsec Site to Site Connection
•
Add IPsec Host to Host Connection
on page 221
Pocket Guides
•
Establish Site-to-Site VPN Connection using Digital Certificates
•
Establish Site-to-Site VPN Connection using Preshared Key
Sophos XG Firewall | Configure | 213
•
Establish Site-to-Site VPN Connection using RSA Keys
Add IPsec Remote Access Connection
1. Go to Configure > VPN > IPsec Connections and click Add in the section IPsec Connections.
2. Specify the GeneralSettings details.
Name
Enter a unique name to identify the IPsec connection.
Description
Enter a description for the IPsec VPN connection.
Connection Type
Select Remote Access.
Policy
Select the policy to be used for connection.
A new policy can be added by clicking Create newor through the Configure > VPN > IPsec
Profiles page.
Action on VPN Restart
Select the action to be taken on the connection when VPN services or the device restarts.
Available options:
• Respond Only – Keeps connection ready to respond to any incoming request.
• Disable – Keeps connection disabled until the user activates it.
Figure 166: General Settings
3. Specify the Authentication Details.
Authentication Type
Select the authentication type. Authentication of the user depends on the type of connection.
Available Options:Preshared Key
Preshared Key authentication is a mechanism whereby a single key is used for encryption and decryption. Both peers should possess the preshared key. Remote peer uses the preshared key for decryption. On selecting this option the user needs to provide the following details:
• Preshared Key – Specify the preshared key to be used. Preshared key should be of minimum 5 characters.
• Confirm Preshared Key – Enter the same preshared key to confirm it.
Sophos XG Firewall | Configure | 214
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client has to specify this key for authentication. If there is a mismatch in the key, user will not be able to establish the connection.
Digital Certificate
Digital certificate authentication is a mechanism whereby sender and receiver both use a digital certificate issued by the certificate authority. Both sender and receiver must have each other’s certificate authority.
• Local Certificate – Select the local certificate that should be used for authentication by the device.
• Remote Certificate – Select the remote certificate that should be used for authentication by the remote peer.
Figure 167: Authentication Details
4. Specify the Endpoint Details.
Local
Select local WAN port from the list.
IP aliases created for WAN interfaces will be listed along with the default WAN interfaces.
Remote
Specify an IP address or domain name of the remote peer.
Figure 168: Endpoints Details
5. Specify the Network Details.
IP Family
IP family will be enabled automatically according to the IP selected in local WAN port.
Local Subnet
Select local LAN address.
Add and remove LAN address using Add button and Remove button.
Local ID (only available if Authentication Type selected is Preshared Key)
Select any type of ID from the available options and specify its value.
Available options:
• DNS
• IP Address
• Email Address
• DER ASN1 DN(X.509)
Note: In case of Local Certificate, the ID and its value are displayed automatically as specified in the certificate.
Sophos XG Firewall | Configure | 215
Allow NAT Traversal
Enable NAT traversal if a NAT device is located between your VPN endpoints i.e. when the remote peer has private/non-routable IP address.
At a time only one connection can be established behind one NAT box.
Remote LAN Network
Select IP hosts from the list of available IP hosts.
A new IP host can be created by clicking on Add New Item or through the System > Hosts and
Services > IP Host page.
Remote ID (only available if Authentication Type selected is Preshared Key)
For preshared key, select any type of ID from the available options and specify its value.
Available options:
• DNS
• IP Address
• Email Address
• DER ASN1 DN(X.509)
Note: In case of Local Certificate, the ID and its value are displayed automatically as specified in the certificate.
Figure 169: Network Details
6. Specify the User Authentication details.
User Authentication Mode
Select whether user authentication is required at the time of connection or not from the available options.
Available options:
• Disabled – Click if user authentication is not required.
• Enable as Client – If enabled as client, specify username and password.
• Enable as Server – If enabled as server, add all the users which are to be allowed to connect.
Sophos XG Firewall | Configure | 216
Figure 170: User Authentication
7. Specify the Quick Mode Selectors details.
Protocol
Select all the protocols that are to be allowed for negotiations.
Tunnel will pass only that data which uses the specified protocol.
Available options:
• All
• ICMP
• UDP
• 'TCP
Local Port (only available if Protocol selected is UDP or TCP)
Specify local port number that the local VPN peer uses to transport the traffic related to TCP or
UDP protocol.
Acceptable range: 1 – 65535
To specify any local port, enter *.
Remote Port (only available if Protocol selected is UDP or TCP)
Specify remote port number that the remote VPN peer uses to transport the traffic related to TCP or
UDP protocol.
Acceptable range: 1 – 65535
To specify any local port, enter *.
Figure 171: Quick Mode Selectors
8. Specify Advanced Settings details.
Disconnect when tunnel is idle
Click this option to allow the device to delete an idle VPN session if it exceeds the specified idle session time interval.
The default setting is disabled.
Idle session time interval (only available if Disconnect when tunnel is idle is enabled)
Specify the time limit after which an idle VPN session will be deleted by the device.
Acceptable range: 120 to 999
Sophos XG Firewall | Configure | 217
Figure 172: Advanced Settings
9. Click Save.
Add IPsec Site to Site Connection
1. Go to Configure > VPN > IPsec Connections and click Add in the section IPsec Connections.
2. Specify the General Settings details.
Name
Enter a unique name to identify the IPsec connection.
Description
Enter a description for the IPsec VPN connection.
Connection Type
Select Site to Site.
Policy
Select the policy to be used for connection.
A new policy can be added by clicking Create newor through the Configure > VPN > IPsec
Profiles page.
Action on VPN Restart
Select the action to be taken on the connection when VPN services or the device restarts.
Available options:
• Respond Only – Keeps connection ready to respond to any incoming request.
• Disable – Keeps connection disabled until the user activates it.
• Initiate – Activates connection on system/service start so that the connection can be established whenever required.
Figure 173: General Settings
3. Specify the Authentication details.
Authentication Type
Sophos XG Firewall | Configure | 218
Select the authentication type. Authentication of the user depends on the type of connection.
Available options:Preshared Key
Preshared Key authentication is a mechanism whereby a single key is used for encryption and decryption. Both peers should possess the preshared key. Remote peer uses the preshared key for decryption. On selecting this option the user needs to provide the following details:
• Preshared Key – Specify the preshared key to be used. Preshared key should be of minimum 5 characters.
• Confirm Preshared Key – Enter the same preshared key to confirm it.
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication. If there is a mismatch in the key, user will not be able to establish the connection.
Digital Certificate
Digital certificate authentication is a mechanism whereby sender and receiver both use a digital certificate issued by the certificate authority. Both sender and receiver must have each other’s certificate authority.
• Local Certificate – Select the local certificate that should be used for authentication by the device.
• Remote Certificate – Select the remote certificate that should be used for authentication by the remote peer.
RSA Key
RSA Key authentication is a mechanism whereby two keys – local and remote RSA - are used for encryption and decryption.
• Local RSA Key – It is known only to the owner and never transmitted over network. Displays automatically generated key which cannot be modified.
• Remote RSA Key – It can be regenerated from CLI console. Refer to the console guide for more details.
Figure 174: Authentication Details
4. Specify the Endpoint Details.
Local
Select local WAN port from the list.
IP aliases created for WAN interfaces will be listed along with the default WAN interfaces.
Remote
Specify an IP address or domain name of the remote peer.
Click Add icon next to the option field to add new endpoint pairs or click Remove icon to remove the endpoint pairs.
For any new endpoint pair, specify a failover group name and define the failover condition.
Sophos XG Firewall | Configure | 219
Figure 175: Endpoints Details
5. Specify the Network Details
IP Family
Select IP family to configure IPsec VPN tunnels with mixed IP families.
Available options:
• IPv4
• IPv6
By default, IPv4 will be selected.
Four types of IPsec VPN tunnels can be created:4 in 4 (IPv4 subnets with IPv4 gateway)6 in 6 (IPv6 subnets with IPv6 gateway)4 in 6 (IPv4 subnets with IPv6 gateway)6 in 4 (IPv6 subnets with IPv4 gateway)
Local Subnet
Select local LAN address.
Add and remove LAN address using Add button and Remove button.
Local ID (only available if Authentication Type selected is Preshared Key or RSA Key)
Select any type of ID from the available options and specify its value.
Available options:
• DNS
• IP Address
• Email Address
• DER ASN1 DN(X.509)
Note: In case of Local Certificate, the ID and its value are displayed automatically as specified in the certificate.
Allow NAT Traversal
Enable NAT traversal if a NAT device is located between your VPN endpoints i.e. when the remote peer has private/non-routable IP address.
At a time only one connection can be established behind one NAT box.
Remote LAN Network
Select IP hosts from the list of available IP hosts.
A new IP host can be created by clicking on Add New Item or through the System > Hosts and
Services > IP Host page.
Remote ID (only available if Authentication Type selected is Preshared Key or RSA Key)
Select any type of ID from the available options and specify its value.
Available options:
• DNS
• IP Address
• Email Address
• DER ASN1 DN(X.509)
Note: In case of Local Certificate, the ID and its value are displayed automatically as specified in the certificate.
Sophos XG Firewall | Configure | 220
Figure 176: Network Details
6. Specify the User Authentication details.
User Authentication Mode
Select whether user authentication is required at the time of connection or not from the available options.
Available options:
• Disabled – Click if user authentication is not required.
• Enable as Client – If enabled as client, specify username and password.
• Enable as Server – If enabled as server, add all the users which are to be allowed to connect.
Figure 177: User Authentication
7. Specify Quick Mode Selectors details.
Protocol
Select all the protocols that are to be allowed for negotiations.
Tunnel will pass only that data which uses the specified protocol.
Available options:
• All
• ICMP
• UDP
• TCP
Local Port (only available if Protocol selected is UDP or TCP)
Specify local port number that the local VPN peer uses to transport the traffic related to TCP or
UDP protocol.
Acceptable range: 1 to 65535
To specify any local port, enter *.
Sophos XG Firewall | Configure | 221
Remote Port (only available if Protocol selected is UDP or TCP)
Specify remote port number that the remote VPN peer uses to transport the traffic related to TCP or
UDP protocol.
Acceptable range: 1 to 65535
To specify any local port, enter *.
Figure 178: Quick Mode Selectors
8. Specify Advanced Settings details.
Disconnect when tunnel is idle
Click this option to allow the device to delete an idle VPN session if it exceeds the specified idle session time interval.
Default: disabled.
Idle session time interval (only available if Disconnect when tunnel is idle is enabled)
Specify the time limit after which an idle VPN session will be deleted by the device.
Acceptable range: 120 to 999
Figure 179: Advanced Settings
9. Click Save.
Add IPsec Host to Host Connection
This page describes how to create an IPsec Host to Host connection.
1. Go to Configure > VPN > IPsec Connections and click Add in the IPsec Connections section.
2. Specify the General Settings details.
Name
Enter a unique name for the IPsec connection.
Description
Enter a description for the IPsec VPN connection.
Connection Type
Select Host to Host.
Policy
Select the policy to be used for the connection.
A new policy can be added by clicking Create new or on the Configure > VPN > IPsec Profiles page.
Action on VPN Restart
Select the action to be taken on the connection when VPN services or the device restarts.
Sophos XG Firewall | Configure | 222
Available Options:
• Respond Only – Keeps the connection ready to respond to any incoming request.
• Disable – Keeps the connection disabled until the user activates it.
• Initiate – Activates the connection on system/service start so that the connection can be established whenever required.
Figure 180: General Settings
3. Specify the Authentication Details.
Authentication Type
Select the authentication type. Authentication of the user depend on the type of connection.
Available Options:
• Preshared Key – Preshared Key authentication is a mechanism whereby a single key is used for encryption and decryption. Both peers should possess the preshared key. Remote peer uses the preshared key for decryption. On selecting this option the user needs to provide the following details:
• Preshared Key – Specify the preshared key to be used. Preshared key should be of minimum 5 characters.
• Confirm Preshared Key – Provide the same preshared key to confirm it.
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication. If there is a mismatch in the key, user will not be able to establish the connection.
• Digital Certificate – Digital certificate authentication is a mechanism whereby sender and receiver both use a digital certificate issued by the certificate authority. Both sender and receiver must have each other’s certificate authority.
• Local Certificate – Select the local certificate that should be used for authentication by the device.
• Remote Certificate – Select the remote certificate that should be used for authentication by the remote peer.
• RSA Key – RSA Key authentication is a mechanism whereby two keys – local and remote RSA
- are used for encryption and decryption.
• Local RSA Key – It is known only to the owner and never transmitted over network.
Displays automatically generated key which cannot be modified.
• Remote RSA Key – It can be regenerated from CLI console. Refer to the console guide for more details.
Sophos XG Firewall | Configure | 223
Figure 181: Authentication Details
4. Specify the Endpoint Details.
Local
Select local WAN port from the list.
IP aliases created for WAN interfaces will be listed along with the default WAN interfaces.
Remote
Specify an IP address or domain name of the remote peer.
Click the add icon next to the option field to add new endpoint pairs or click the remove icon
to remove the endpoint pairs.
For any new endpoint pair, specify a failover group name and define the failover condition.
Figure 182: Endpoints Details
5. Specify the Network Details.
Local ID (available only if selected Authentication Type is Preshared Key or RSA Key)
Select any type of ID from the available options and specify its value.
Available Options:
• DNS
• IP Address
• DER ASN1 DN (X.509)
Note: In case of Local Certificate, the ID and its value are displayed automatically as specified in the certificate.
Allow NAT Traversal
Enable NAT traversal if a NAT device is located between your VPN endpoints i.e. when the remote peer has private/non-routable IP address.
At a time only one connection can be established behind one NAT box.
Remote LAN Network (available only if Allow NAT Traversal is enabled)
Select IP hosts from the list of available IP hosts.
A new IP host can be created by clicking on Add New Item or on the System > Hosts and
Services > IP Host page.
Remote ID (available only if selected Authentication Type is Preshared Key or RSA Key)
Select any type of ID from the available options and specify its value.
Available Options:
• DNS
Sophos XG Firewall | Configure | 224
• IP Address
• DER ASN1 DN (X.509)
Note: In case of Local Certificate, the ID and its value are displayed automatically as specified in the certificate.
Figure 183: Network Details
6. Specify User Authentication details.
User Authentication Mode
Select whether user authentication is required at the time of connection or not from the available options.
Available Options:
• Disabled – Click if user authentication is not required.
• Enable as Client – If enabled as client, specify username and password.
• Enable as Server – If enabled as server, add all the users which are to be allowed to connect.
Figure 184: User Authentication
7. Specify Quick Mode Selectors details.
Protocol
Select all the protocols that are to be allowed for negotiations.
Tunnel will pass only that data which uses the specified protocol.
Available Options:
• All
• ICMP
• UDP
• TCP
Sophos XG Firewall | Configure | 225
Local Port (available only if Protocol selected is UDP or TCP)
Specify local port number that the local VPN peer uses to transport the traffic related to TCP or
UDP protocol.
Acceptable range: 1 to 65535
To specify any local port, enter *.
Remote Port (available only if Protocol selected is UDP or TCP)
Specify remote port number that the remote VPN peer uses to transport the traffic related to TCP or
UDP protocol.
Acceptable range: 1 to 65535
To specify any local port, enter *.
Figure 185: Quick Mode Selectors
8. Specify Advanced Settings details.
Disconnect when tunnel is idle
Enable to allow the device to delete an idle VPN session if it exceeds the specified idle session time interval.
Idle session time interval (available only if Disconnect when tunnel is idle is enabled)
Specify the time limit after which an idle VPN session will be deleted by the device.
Acceptable range: 120 to 999
Figure 186: Advanced Settings
9. Click Save.
IPsec Connection Wizard
The IPsec Connection Wizard allows you to configure a VPN connection manually.
The wizard is not available if you are managing the device through Sophos Firewall Manager.
The VPN Connection Wizard takes you step-by-step through the configuration of a VPN connection on the device.
After the configuration is completed, the wizard creates a new VPN connection.
Wizard is divided into two panels – Configuration panel and Help panel. Configuration parameters are to be entered in the Configuration panel while the Help panel on left-most side provides the help on the configuration parameters.
First screen of the wizard provides an overview of the configuration steps. You can create three types of connections through wizard:
•
•
•
Sophos XG Firewall | Configure | 226
Creating Remote Access Connection Using VPN Wizard
Go to Configure > VPN > IPsec Connections. Click Wizard and follow the steps given below.
Specify name and description (if required) for a VPN connection and click Start. The Help panel on left-most side provides an overview of each configuration step.
On the Select a Connection Type page
1. Select the connection type Remote Access.
2. Select VPN policy to be applied to the connection traffic. Default policies as well as custom policies applicable to connection will be displayed.
3. Select action to be taken on the connection when VPN services or the device restart.
Available options:
• Disable – Connection will be disabled till the user activates it.
• Respond Only – Connection in ready state to respond to any incoming request.
4. Click > icon to continue.
On the Authentication Details page
1. Select authentication type.
Available options:
Preshared Key
Digital Certificate
Specify the preshared key of minimum 5 characters.
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication. Refer to the VPN client guide, Phase 1
Configuration.
If there is a mismatch in the key, the user will not be able to establish the connection.
Select local certificate that should be used for authentication by the device.
Select remote certificate that should be used for authentication by the remote peer.
2. Click > to continue.
On the Local Network Details page
1. Select Local WAN Port. Selected port acts as an end-point of the tunnel.
2. Select Local Subnet. Select the local network(s) you wish to give access to remote users via this connection.
3. Select Local ID.
For Preshared Key and Digital Certificate, select any type of ID and enter its value. DER ASN1 DN (X.509) is not applicable.
For Local Certificate, the ID and its value configured in the local certificate are displayed automatically.
4. Click > to continue.
On the Remote Network Details page
1. In the Remote VPN Server field specify the IP address or host name of the remote endpoint.
To specify any IP address, enter *.
2. Enable NAT traversal if a NAT device exists between your VPN endpoints i.e. when remote peer has private/nonroutable IP address.
3. Select Remote Subnet. Select the remote network(s) that you wish to access via this connection. This option will be available only if NAT traversal is enabled.
4. Select Remote ID.
Sophos XG Firewall | Configure | 227
For Preshared Key, select any type of ID and enter its value. DER ASN1 DN (X.509) is not applicable.
In case of Local Certificate, the ID and its value configured in the local certificate are displayed automatically.
5. Click > to continue.
On the User Authentication page
1. Select User Authentication Mode.
Available options:
• Disabled – Choose if authentication is not required.
• Enable as Client – Enter username and password for authentication by the remote gateway.
• Enable as Server – Select all the users that are to be allowed to connect.
2. Click > to continue.
On the IPsec Connection Summary page
The page displays the settings with which the IPsec connection will be created.
Click Finish to create the IPsec connection or click < to go back to the previous page and change the settings.
Creating Site to Site Connection using VPN Wizard
Go to Configure > VPN > IPsec Connections. Click Wizard and follow the steps given below:
Specify name and description (if required) for a VPN connection and click Start. The Help panel on left-most side provides an overview of each configuration step.
On the Select a Connection Type page
1. Select the connection type Site to Site.
2. Select VPN policy to be applied to the connection traffic. Default policies as well as custom policies applicable to connection will be displayed.
3. Select action to be taken on the connection when VPN services or the device restart.
Available options:
• Disable – Connection will be disabled until the user activates it.
• Respond Only – Connection is in ready state to respond to any incoming request.
• Initiate – Initiate to establish the connection every time VPN services or the device restart.
4. Click > icon to continue.
On the Authentication Details page
1. Select authentication type.
Available options:
Preshared Key
Digital Certificate
Specify the preshared key of minimum 5 characters.
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication. Refer to the VPN client guide, Phase 1
Configuration.
If there is a mismatch in the key, the user will not be able to establish the connection.
Select local certificate that should be used for authentication by the device.
Select remote certificate that should be used for authentication by the remote peer.
Sophos XG Firewall | Configure | 228
RSA
Local RSA key is displayed which can be re-generated from the CLI console. Refer to the console guide for more details. Specify remote RSA key.
2. Click > to continue.
On the Local Network Details page
1. Select Local WAN Port. Selected port acts as an end-point of the tunnel.
2. Select Local Subnet. Select the local network(s) you wish to give access to remote users via this connection.
3. Select Local ID.
For Preshared Key and RSA Key, select any type of ID and enter its value. DER ASN1 DN (X.509) is not applicable.
For Local Certificate, the ID and its value configured in the local certificate are displayed automatically.
4. Click > to continue.
On the Remote Network Details page
1. In the Remote VPN Server field specify the IP address or host name of the remote endpoint.
To specify any IP address, enter *.
2. Enable NAT traversal if a NAT device exists between your VPN endpoints i.e. when remote peer has private/nonroutable IP address.
3. Select Remote Subnet. Select the remote network(s) that you wish to access via this connection. This option will be available only if NAT traversal is enabled.
4. Select Remote ID.
For Preshared Key and RSA Key, select any type of ID and enter its value. DER ASN1 DN (X.509) is not applicable.
In case of Local Certificate, the ID and its value configured in the local certificate are displayed automatically.
5. Click > to continue.
On the User Authentication page
1. Select User Authentication Mode.
Available options:
• Disabled – Choose if authentication is not required.
• Enable as Client – Enter username and password for authentication by the remote gateway.
• Enable as Server – Select all the users that are to be allowed to connect.
2. Click > to continue.
On the IPsec Connection Summary page
The page displays the settings with which the IPsec connection will be created.
Click Finish to create the IPsec connection or click < to go back to the previous page and change the settings.
Creating Host to Host Connection using VPN Wizard
Go to Configure > VPN > IPsec Connections. Click Wizard and follow the steps given below:
Specify name and description (if required) for a VPN connection and click Start. The Help panel on left-most side provides an overview of each configuration step.
On the Select a Connection Type page
1. Select the connection type Host to Host.
2. Select VPN policy to be applied to the connection traffic. Default policies as well as custom policies applicable to connection will be displayed.
3. Select action to be taken on the connection when VPN services or the device restart.
Sophos XG Firewall | Configure | 229
Available options:
• Disable – Connection will be disabled until the user activates it.
• Respond Only – Connection is in ready state to respond to any incoming request.
• Initiate – Initiate to establish the connection every time VPN services or the device restart.
4. Click > icon to continue.
On the Authentication Details page
1. Select authentication type.
Available options:
Preshared Key
Specify the preshared key of minimum 5 characters.
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication. Refer to the VPN client guide, Phase 1
Configuration.
If there is a mismatch in the key, the user will not be able to establish the connection.
Digital Certificate
RSA
Select local certificate that should be used for authentication by the device.
Select remote certificate that should be used for authentication by the remote peer.
Local RSA key is displayed which can be re-generated from the CLI console. Refer to the console guide for more details. Specify remote RSA key.
2. Click > to continue.
On the Local Network Details page
1. Select Local WAN Port. Selected port acts as an end-point of the tunnel.
2. Select Local ID.
For Preshared Key and RSA Key, select any type of ID and enter its value. DER ASN1 DN (X.509) is not applicable.
For Local Certificate, the ID and its value configured in the local certificate are displayed automatically.
3. Click > to continue.
On the Remote Network Details page
1. In the Remote VPN Server field specify the IP address or host name of the remote endpoint.
To specify any IP address, enter *.
2. Enable NAT traversal if a NAT device exists between your VPN endpoints i.e. when remote peer has private/nonroutable IP address.
3. Select Remote Subnet. Select the remote network(s) that you wish to access via this connection. This option will be available only if NAT traversal is enabled.
4. Select Remote ID.
For Preshared Key and RSA Key, select any type of ID and enter its value. DER ASN1 DN (X.509) is not applicable.
In case of Local Certificate, the ID and its value configured in the local certificate are displayed automatically.
5. Click > to continue.
On the User Authentication page
Sophos XG Firewall | Configure | 230
1. Select User Authentication Mode.
Available options:
• Disabled – Choose if authentication is not required.
• Enable as Client – Enter username and password for authentication by the remote gateway.
• Enable as Server – Select all the users that are to be allowed to connect.
2. Click > to continue.
On the IPsec Connection Summary page
The page displays the settings with which the IPsec connection will be created.
Click Finish to create the IPsec connection or click < to go back to the previous page and change the settings.
Add VPN Failover Group
This page describes how to set up a failover group.
AVPN failover group enables you to have an always-on VPN connection. If the primary connection fails, the subsequent connection in the group will take over without manual intervention and keep traffic moving. The entire process is transparent to users.
1. Go to Configure > VPN > IPsec Connections and click Add in the section Failover Group.
2. Enter details of the group.
Name
Enter a unique name for the connection group.
Select Connections(s)
The Available Connections list displays the list of connections that can be added to the failover group. Click on the connections to be added to the Member Connections list. The device will select the subsequent active connection from the member connections list if the primary connection fails.
Connections having endpoints of different families can also be added to the failover group.
Top down order of connections in the Member Connections list specifies the failover preference i.e. if the primary connection fails the very next connection in the list will be used by the device to keep the VPN traffic moving.
Once the connection is included in any group, it will not be displayed in the Available Connection list.
Remote access connections will not be listed in the Available Connections list.
You need to add at least two member connections in a group.
Mail Notification
Sophos XG Firewall | Configure | 231
Enable to receive connection failure notification in case the connection fails. Notification is mailed on the email address configured in the email settings from the Network Configuration Wizard.
Figure 187: Connection Group
Details
Failover Condition
Specify the failover condition. The device checks for the connection failure after every 60 seconds and if failure is detected, VPN traffic is transferred through the subsequent connection specified in the connection group. The device considers a connection as failed connection if failover conditions are not met.
Specify communication protocol as TCP or PING. Select the protocol depending on the service to be tested on the remote server or local gateway depending on type of connection.
A request on the specified port is sent and if it is not responding, the device considers the connection as failed and shifts the traffic to the subsequent connection.
Configure gateway failover timeout from Configure > Network > WAN Link Manager.
Failover Condition is not applicable if:
• Connection is manually disconnected from either of the ends.
• Connection is not included in any group.
Figure 188: Failover
Condition
3. Click Save.
Sophos XG Firewall | Configure | 232
SSL VPN (Remote Access)
The SSL VPN (Remote Access) tab allows control of remote devices connected to your system.
The remote access SSL feature of Sophos XG Firewall is realized by OpenVPN, a full-featured SSL VPN solution.
You can create point-to-point encrypted tunnels between remote employees and your company, requiring both SSL certificates and a username/password combination for authentication. This enables access to internal resources. In addition, a secure User Portal is offered, which can be accessed by each authorized user to download a customized
SSL VPN client software bundle. This bundle includes a free SSL VPN client, SSL certificates and a configuration that can be handled by a simple one-click installation procedure. The SSL VPN client supports most business applications such as native Outlook, native Windows file sharing, and many more.
This page displays a list of all available remote policies. For each policy, the list shows:
Name
Displays the name of the SSL VPN remote access policy.
Use as Default Gateway
Displays if and which default gateway is used for the policy.
Description
Displays the description which was entered for the policy.
Figure 189: About SSL
Add SSL VPN Remote Access Policy
This page allows adding SSL VPN remote access policies.
1. Go to Configure > VPN > SSL VPN (Remote Access) and click Add.
2. Specifiy the General Settings details:
Name
Enter a unique name for the policy.
Description
Enter a description or other information.
Figure 190: General Settings
3. Specify the Identity details:
Policy Members
Click Add New Item to select available users/groups from a list or search for users/groups. When selected, click Apply Selected Items.
Note: You can also view and manage active SSL VPN users on the Monitor &
Analyze > Current Activities > Remote Users page.
Selected items are displayed in the list. To remove an item from the list, click the Minus icon on the right of the item.
Sophos XG Firewall | Configure | 233
Figure 191: Identity
4. Specify the Tunnel Access details:
Use as Default Gateway
Activate the toggle switch if you want to use this as default gateway. If activated, all traffic is forwarded to a default gateway including external Internet requests. If deactivated, the traffic uses a split mode to separate traffic for internal network segments and external Internet requests through different gateways.
Permitted Network Resources (IPv4)
Click Add New Item to select available network resources from a list or search for network resources. When selected, click Apply Selected Items.
Selected items are displayed in the list. To remove an item from the list, click the Minus icon on the right of the item.
Permitted Network Resources (IPv6)
Click Add New Item to select available users/groups from a list or search for users/groups. When selected, click Apply Selected Items.
Selected items are displayed in the list. To remove an item from the list, click the Minus icon on the right of the item.
Figure 192: SSL VPN (Remote Access) Tunnel Access
5. Specify the Idle Timeout settings:
Disconnect Idle Clients
Activate/deactivate by clicking the toggle switch. If activated, clients which are idle will be disconnected from the session after a specified time.
Override Global Timeout (Default 15 Minutes) (only available if Disconnect Idle Clients is selected)
Enter a value for the idle timeout in minutes.
Acceptable range: 15 to 60 minutes
Default: 15 minutes
Sophos XG Firewall | Configure | 234
Figure 193: SSL VPN (Remote Access) Idle Timeout
6. Click Apply.
New remote access policies immediately appear on the SSL VPN (Remote Access) list.
Note: For remote access connections to work check that LAN and WAN zones are activated for the User
Portal on the System > Administration > Device Access page.
SSL VPN (Site to Site)
The SSL VPN (Site to Site) tab allows you to establish secure Site-to-site VPN tunnels via an SSL connection.
SSL VPN connections have distinct roles attached. The tunnel endpoints act as either client or server. The client always initiates the connection, the server responds to client requests. Keep in mind that this contrasts with IPsec where both endpoints normally can initiate a connection.
Server Connections
This section displays a list of all existing SSL VPN site-to-site server connections along with their status, connection name, connection. local and remote networks, received and sent bytes, and the date of connection. You can sort the list by the connection name, the local or remote networks. The list displays the status of each connection as follows:
Status
Indicates if the connection is active or not. You can activate/deactivate the connection by clicking the toggle switch.
Connection Name
Displays the name of the connection.
Connection
Indicates the status of the connection: online (green) or offline (red).
Local Networks
Displays the local networks that are allowed to be accessed remotely.
Remote Networks
Displays the remote networks that are allowed to connect to the local network(s).
Bytes
Indicates the number of bytes sent and received through this connection.
Connected Since
Displays the date the connection was established.
Figure 194: Server
Client Connections
This section displays a list of all existing SSL VPN site-to-site client connections along with their status, connection name, connection. usage of HTTP proxy server, received and sent bytes. You can sort the list by the connection name and the usage of the HTTP proxy server. The page also provides options to add, edit, download or delete a connection.
The list displays the status of each connection as follows:
Sophos XG Firewall | Configure | 235
Status
Indicates if the connection is activated or not. You can activate/deactivate the connection by clicking the toggle switch.
Connection Name
Displays the name of the connection.
Connection
Indicates the status of the connection: online (green) or offline (red).
Use HTTP Proxy Server
Displays the HTTP proxy server which is used for the connection.
Bytes
Indicates the number of bytes sent and received through this connection.
Figure 195: Client
Related information
Establish Site-to-Site VPN Connection using Digital Certificates
Establish Site-to-Site VPN Connection using Preshared Key
Establish Site-to-Site VPN Connection using RSA Keys
Add SSL VPN Site-to-Site Server Connection
This page describes how to add a SSL VPN site-to-site server connection.
1. Go to Configure > VPN > SSL VPN (Site to Site) and click Add in the Server section.
2. Specify the server details:
Connection Name
Enter a descriptive name for the connection.
Description
Enter the description or other information.
Use Static Virtual IP Address
Only select this option if the IP address pool is not compatible with the client's network environment: By default, clients are assigned an IP address from a virtual IP pool. Rarely, it may happen that such an IP address is already in use on the client's host. In that case, enter a suitable IP address in the Static Peer IP field which will then be assigned to the client during tunnel setup.
Local Networks
Select or add one or more local networks to which remote network(s) are allowed toconnect. If you create a new network, you can either add a single IP host or an IP host group.
Remote Networks
Select or add one or more remote networks that are allowed to connect to the local network(s). If you create a new network, you can either add a single IP host or an IP host group.
Sophos XG Firewall | Configure | 236
Figure 196: Add SSL Server Connection
3. Click Save.
The new SSL VPN site-to-site server connection appears on the Server list.
The next step is the client configuration which has to take place on client side and not on server side. Download the client configuration file with help of the provided button in the Server list.
Note: If you want to send the file via mail it is recommended to use the encryption option which is provided in the download dialog.
How to configure the client is described in the Client section.
Add SSL VPN Site-to-Site Client Connection
This page describes how to add a SSL VPN site-to-site client connection.
1. Go to Configure > VPN > SSL VPN (Site to Site) and click Add in the Client section.
2. Specify the client details:
Connection Name
Enter a descriptive name for the connection.
Description
Enter the description or other information.
Configuration File
Browse for the client configuration file and click Open.
Note:
• The file has to be in .apc or .epc format.
• The file can be downloaded via the download icon in the Manage column of the server list on the System > VPN > SSL VPN (Site to Site) page.
Password (optional)
If the file has been encrypted, enter the password.
Use HTTP Proxy Server (optional)
Activate if the client is located behind a proxy server and enter the proxy settings:
• Proxy Server: Select or add a proxy server.
• Proxy Port: Enter a proxy port.
Sophos XG Firewall | Configure | 237
• Proxy Requires Authentication: Select the checkbox if the client needs to authenticate against the proxy and enter Username and Password.
Override Peer Hostname
Select the checkbox and add or select a Hostname if the server system's regular hostname cannot be resolved from the client host.
Figure 197: Add SSL Client Connection
3. Click Save.
The new SSL VPN site-to-site client connection appears on the Client list.
CISCO
TM
VPN Client
This page describes how to configure an Cisco VPN client.
CISCO
TM
VPN Client is a software developed by CISCO that runs on Windows systems. It establishes encrypted
VPN tunnels with highly secured remote connectivity for the remote workers.
1. Go to Configure > VPN > Cisco VPN Client.
2. Specify the General Settings.
CISCO
™
VPN Client
Select to enable CISCO
™
VPN Client.
All the fields will be available for configuration, once CISCO
™
VPN Client is enabled.
Default: disabled.
Interface
Select an WAN port to act as endpoint.
IP Aliases created for WAN interfaces will be listed along with the default WAN interfaces.
Authentication Type
Select the authentication type.
Authentication of users depend on the connection type.
Available Options:
• Preshared Key - Preshared key authentication is a mechanism whereby a single key is used for encryption and decryption. Both peers should possess the preshared key. The remote peer uses the preshared key for decryption. On selecting this option the user has to provide:
• Preshared Key – Specify the preshared key to be used. The preshared key should be of minimum 5 characters.
• Confirm Preshared Key – Provide the same preshared key to confirm it.
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication. If there is a mismatch in the key, the user will not be able to establish the connection.
Sophos XG Firewall | Configure | 238
• Digital Certificate: Digital certificate authentication is a mechanism whereby sender and receiver both use a digital certificate issued by the certificate authority. Both sender and receiver must have each other’s certificate authority.
• Local Certificate – Select the local certificate that should be used for authentication by the device
• Remote Certificate – Select the remote certificate that should be used for authentication by the remote peer.
Local ID (available only if Authentication Type selected is Preshared Key)
Specify a value for the local ID selected.
Available Options:
• DNS
• IP Address
• DER ASN1 DN (X.509)
Note: DER ASN1 DN(X.509) can not be used for Preshared Key authentication.
If Digital Certificate is selected, the ID and its value is displayed automatically as specified in the
Local Certificate.
Remote ID
Select a value for the remote ID selected.
Available Options:
• DNS
• IP Address
• DER ASN1 DN (X.509)
Note: DER ASN1 DN(X.509) can not be used for Preshared Key authentication.
Allowed User
Select all the users who are to be allowed to connect to the configured CISCO
™
VPN client.
Sophos XG Firewall | Configure | 239
Figure 198: General Settings
3. Specify the Client Information.
Name
Enter a unique name for the connection.
Assign IP from
Specify the IP address range.
The device will lease the IP address to the Cisco
™
IPsec client from the specified IP address range.
Note: Do not configure the above IP address range in L2TP or PPTP configuration.
Allow leasing IP address from Radius server for L2TP, PPTP and CISCO VPN Client
Click to lease the IP address to the L2TP, PPTP and CISCO VPN client users through the Radius server.
Radius is a protocol that allows network devices to authenticate users against a central database. It can also store technical information used by network devices.
If enabled, the configured IP address is overridden with the IP address provided by the Radius server.
DNS Server 1
Provide a DNS server IP address to be pushed to CISCO VPN clients.
DNS Server 2
Provide a DNS server IP address to be pushed to CISCO VPN clients.
Figure 199: Client Information
Sophos XG Firewall | Configure | 240
4. Specify the Advanced Settings.
Disconnect when tunnel is idle
Click to allow the device to delete an idle VPN session if it exceeds the specified idle session time interval.
Idle session time interval (available only if Disconnect when tunnel is idle option is enabled)
Specify the time limit after which an idle VPN session will be deleted by the device.
Acceptable Range: 120 to 999
Apply
Click to accept and save the Cisco VPN client configuration.
Export Connection (available only if a Cisco VPN connection is configured)
Click to export Cisco VPN client configuration.
Once the .tgb file has been exported, it has to be passed to the client.
On the client side, the client needs the Sophos IPsec client to import the .tbg file and establish a connection to Sophos XG Firewall.
The Sophos IPsec VPN client may be downloaded from
https://www.sophos.com/en-us/support/utmdownloads.aspx
.
Note: You cannot export the connection when an external certificate is selected as
Remote Certificate.
Reset
Click to delete the entire Cisco VPN client configuration.
Figure 200: Advanced Settings
L2TP (Remote Access)
The L2TP Connections page displays a list of all the L2TP connections and you can sort the list based on the connection name. The page also provides the option to add a new connection, update existing connections, or delete a connection. The page displays the status of each connection as follows:
Connection Status
Active Connection
Description
Connection is active but not connected.
Click to initiate the connection.
Connection is active and connected.
Click to disconnect the connection. When you disconnect, the connection will be deactivated and to re-establish the connection, click again to activate the connection.
Connection is inactive. Click to activate the connection.
Sophos XG Firewall | Configure | 241
Related tasks
This page describes how to create an L2TP connection.
Add L2TP Connection
This page describes how to create an L2TP connection.
1. Go to Configure > VPN > L2TP (Remote Access) and click Add.
2. Specify the General Settings.
Name
Enter a unique name for the L2TP connection.
Description
Enter a description for the L2TP connection.
Policy
Select a policy to be used for the connection.
A new policy can be added by clicking Create New.
Action on VPN Restart
Select the action to be taken on the connection when VPN services or the device restart.
Available Options:
• Respond Only – Keeps the connection ready to respond to any incoming request.
• Disable – Keeps the connection disabled until the user activates it.
Figure 201: General Settings
3. Specify the Authentication Details.
Authentication Type
Select the authentication type. Authentication of the user depends on the type of connection.
Available Options:
• Preshared Key – Preshared key authentication is a mechanism whereby a single key is used for encryption and decryption. Both peers should possess the preshared key. The remote peer uses the preshared key for decryption. On selecting this option the user shall has to provide the following details:
• Preshared Key – Specify the preshared key to be used. The preshared key should be of minimum 5 characters.
• Confirm Preshared Key – Provide the same preshared key to confirm it.
Sophos XG Firewall | Configure | 242
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication. If there is a mismatch in the key, the user will not be able to establish the connection.
• Digital Certificate – Digital certificate authentication is a mechanism whereby sender and receiver both use a digital certificate issued by the certificate authority. Both sender and receiver must have each other’s certificate authority.
• Local Certificate – Select the local certificate that should be used for authentication by the device.
• Remote Certificate – Select the remote certificate that should be used for authentication by the remote peer.
Figure 202: Authentication Details
4. Specify the Local Network Details.
Local WAN Port
Specify the local port number that the local VPN peer uses to transport traffic related to TCP or
UDP protocol.
Acceptable range: 1 to 65535
To specify any local port, enter *.
Local ID (available only if Authentication Type selected is Preshared Key)
Select any type of ID from the available options and specify its value.
Available Options:
• DNS
• IP Address
• DER ASN1 DN (X.509)
Note: DER ASN1 DN (X.509) can not be used for Preshared Key authentication.
If Digital Certificate is selected, the ID and its value is displayed automatically as specified in the
Local Certificate.
Figure 203: Local Network Details
5. Specify the Remote Network Details.
Remote Host
Specify the IP address or hostname of the remote end-point. Specify * for any IP address.
Allow NAT Traversal
Enable NAT traversal if a NAT device is located between your VPN endpoints i.e. when the remote peer has a private/non-routable IP address.
At a time only one connection can be established behind one NAT-box.
Sophos XG Firewall | Configure | 243
Remote LAN Network
Select an IP addresses and netmask of the remote network which is allowed to connect to the device server through a VPN tunnel. Multiple subnets can be specified. Select IP hosts from the list of IP hosts available on the Admin console.
You can also add a new IP host by clicking Create New or on System > Hosts and Services > IP
Host.
Remote ID
Select any type of ID from the available options and specify its value.
Available Options:
• DNS
• IP Address
• DER ASN1 DN (X.509)
Note: DER ASN1 DN (X.509) can not be used for Preshared Key authentication.
Figure 204: Remote Network Details
6. Specify the Quick Mode Selectors.
Local Port
Specify local port number that the local VPN peer uses to transport the traffic related to TCP or
UDP protocol.
Default: 1701
Acceptable range: 1 to 65535
To specify any local port, enter *.
Remote Port
Specify remote port number that the remote VPN peer uses to transport the traffic related to TCP or
UDP protocol.
Default: *
Acceptable range: 1 to 65535
To specify any local port, enter *.
Figure 205: Quick Mode Selectors
7. Specify the Advanced Settings.
Sophos XG Firewall | Configure | 244
Disconnect when tunnel is idle
Click this option to allow the device to delete an idle VPN session if it exceeds the specified idle session time interval.
Idle session time interval (available only if Disconnect when tunnel is idle is enabled)
Specify the time limit after which an idle VPN session will be deleted by the device.
Acceptable range: 120 to 999 seconds.
Figure 206: Advanced Settings
8. Click Save.
Clientless Access
Using clientless access, you can allow users to access services and areas on your network such as remote desktops and file shares using only a browser, and without the need for additional plug-ins. Clientless access policies specify users (members) and bookmarks. Users obtain access to your network through bookmarks on the VPN page in the user portal.
You can use this feature to provide multiple users access to resources that do not support multi-user access themselves
(for example, network hardware) or constrain access to a specific service rather than providing access to entire systems or networks.
Allowing Access to the User Portal From Outside Your Network
If you want to allow users outside your network to access the user portal, go to System > Administration > Device
Access and specify WAN access.
Clientless Access for Safari on Mac OSX or iOS
Follow the instructions in
How to access clientless bookmarks in iOS
to use clientless access on Safari on Mac OSX or iOS.
Related tasks
Device Access allows you to limit administrative access to certain services from custom and default zones (LAN,
WAN, DMZ, VPN, Wi-Fi).
Add a Clientless Access Policy
To be able to configure a policy, you need to create at least one bookmark.
1. Go to Configure > VPN > Clientless Access and click Add.
2. Type a name.
3. For Policy Members, click Add New Item and select the users or groups who should have access to the bookmarks.
4. For Published Bookmarks, click Add New Item and select bookmarks or bookmark groups.
5. Specify other settings as required.
Option Description
Restrict Web Applications
When enabled, hide the Secure Web Browsing section in the user portal. This prevents users from being able to enter a URL and restricts them to the URLs specified in the bookmarks.
Sophos XG Firewall | Configure | 245
Bookmarks
Bookmarks are connections that specify a URL, a connection type, and any required security settings. You can use bookmarks with clientless access policies to give users access to your internal networks or services. For example, you may want to provide access to file shares or allow remote desktop access. Users can access bookmarks through the
VPN page in the user portal.
Bookmarks support several secure and non-secure connection types, or protocols.
Add a Bookmark
1. Go to Configure > VPN > Bookmarks and click Add.
2. Type a name.
3. Select a type (protocol).
Note: If you select a secure type, you must specify security settings.
Option
HTTPS
Description
Secure browser-based access to web applications using the Hypertext Transfer Protocol.
Bookmarks of this type support referred domains.
These are domains or URLs that contain formatting information or scripts (for example, CSS or JavaScript) that are required to render the bookmarked URL appropriately.
HTTP
RDP
TELNET
SSH
FTP
FTPS
SFTP
SMB
VNC
Non-secure browser-based access to web applications using the Hypertext Transfer Protocol.
Access to remote desktops using the Remote Desktop
Protocol.
TLS, NLA, and RDP protocol security is supported.
Your security settings must comply with the server settings.
Terminal access using the Telnet protocol.
Secure terminal access using Secure Socket Shell.
Non-secure access to servers using the File Transfer
Protocol.
Secure access to servers using the File Transfer
Protocol. Security is provided by TLS and SSL.
Secure access to servers using the Secure File Transfer
Protocol. Security is provided by SSH.
Access to servers using the Server Message Block file sharing protocol.
Remote access to Linux/UNIX hosts using Virtual
Network Computing.
Classic VNC authentication (password only) is supported.
4. Type the URL of the website or the IP address of the server to which you want to provide access.
Note: Changing the default port number is advisable for advanced users only.
5. Specify security settings as required.
Sophos XG Firewall | Configure | 246
• For SSH: Specify a user name and paste the public host key.
• For FTPS: Paste the public host key.
• For SFTP: Type a user name and select an authentication method. Specify a password and paste keys as required.
6. Specify other settings as required.
Option Description
Automatic Login
When enabled, users do not need to provide login credentials. The session will be established using the specified user name and password.
Share Session
Domain
Init Remote Folder
When enabled, users can use the same connection simultaneously, allowing them to see the same screen.
Domain that the user is allowed to access.
Remote directory. After successful authentication, the user is redirected to the specified folder on the remote server.
Bookmark Groups
Bookmark groups allow you to combine bookmarks for easy reference. For example, you can create a group containing all of the bookmarks for remote desktops so that you do not need to specify access on an individual basis.
Related tasks
Add a Clientless Access Policy
on page 244
Add a Bookmark Group
1. Go to Configure > VPN > Bookmark Groups and click Add.
2. Enter a name.
3. Click Add New Item and select bookmarks.
Figure 207: Add Bookmark Group
PPTP (Remote Access)
This page describes how to configure PPTP remote access.
The Point-to-Point Tunneling Protocol allows organizations to extend their own private network through private tunnels over the public Internet.
The device supports several authentication options including Password Authentication Protocol (PAP), Challenge
Handshake Authentication Protocol (CHAP), and Microsoft Challenge Handshake Authentication Protocol (MS-
CHAPv2).
Sophos XG Firewall | Configure | 247
The PPTP (Remote Access) page provides options to configure the device as PPTP server and enable/disable remote access through PPTP to various users.
1. Go to Configure > VPN > PPTP (Remote Access).
2. Click to enable PPTP.
3. Specify the General Settings.
Assign IP from
Specify IP address range. PPTP server will lease IP address to the PPTP client from the specified IP address range. The PPTP client uses the assigned IP address as its source address for the duration of the connection.
Do not specify the same IP address range in L2TP configuration and PPTP configuration.
Allow leasing IP Address from Radius server for L2TP, PPTP and CISCO VPN Client
Click to lease the IP address to the PPTP users through the Radius server.
Radius server is a protocol that allows network devices to authenticate users against a central database. It can also store technical information used by network devices.
If enabled, the configured IP address is overridden with the IP address provided by the Radius server.
Figure 208: General Settings
4. Specify the Client Information.
Primary DNS Server
Select the DNS server to be used at the client end.
Secondary DNS Server
Select the alternate DNS server to be used at the client end.
Primary WINS Server
Specify the WINS server to be used at the client end.
Secondary WINS Server
Specify the alternate WINS server to be used at the client end.
Figure 209: Client Information
5. Click Apply to save the configuration.
6. Use the other buttons if required.
Add Member(s) (available only if PPTP is configured)
Click to select users who are to be allowed remote access through PPTP.
Show Members (available only if PPTP is configured)
Sophos XG Firewall | Configure | 248
Click to view a list of PPTP members.
Related tasks
Add PPTP Member
The Add PPTP Member page allows you to select users who are to be allowed remote access through PPTP.
1. Go to Configure > VPN > PPTP (Remote Access) and click Add Member(s) to add users or user groups. A new window is displayed showing a list of users and user groups.
2. Select users or user groups who are to be allowed remote access through PPTP. You can add a single or multiple users or user groups.
3. Click Apply to add these users and user groups to the PPTP members list.
PPTP Members
The PPTP Members page allows you to view list of PPTP members and remove members for whom remote access through PPTP is to be disabled.
1. Go to Configure > VPN > PPTP (Remote Access) and click Show Members to view a list of PPTP members. A new window is displayed showing a list of PPTP users who who are allowed access through the PPTP connection.
2. Select the users for whom you want to disable PPTP access. You can select multiple users or user groups.
3. Click Delete.
IPsec Profiles
This IPsec Profiles page displays a list of all preconfigured and custom IPsec policies.
A policy describes the security parameters used for negotiations to establish and maintain a secure tunnel between two peers.
Before you set up your secure tunnels, to make their configuration faster and easier, you can create VPN policies that work on a global level. Rather than configuring the policy parameters for every tunnel you create, you can configure general policies and then later apply them to your secure tunnels.
Click Show Configuration to show all configuration tabs.
Authentication mode
To ensure secure communication, there are two phases to every IKE (Internet Key Exchange) negotiation - Phase 1
(Authentication) and Phase 2 (Key exchange).
The Phase 1 negotiation establishes a secure channel between peers and determines a specific set of cryptographic protocols, exchanges shared secret keys and encryption and authentication algorithm that will be used for generating keys.
The Phase 2 negotiation establishes a secure channel between peers to protect data. During Phase 2 negotiation, the protocol security association for the tunnel is established. Either of the peers can initiate Phase 1 or Phase 2 renegotiation at any time. Both can specify intervals after which to negotiate.
Key life
Lifetime of key is specified as key life.
Once the connection is established after exchanging authenticated and encrypted keys, connection is not dropped till the key life. If the key life of both the peers is not same then negotiation will take place whenever the key life of any one peer is over. This means intruder has to decrypt only one key to break in your system.
Key generation and key rotation are important because the longer the life of the key, the larger the amount of data at risk, and the easier it becomes to intercept more ciphered text for analysis.
Sophos XG Firewall | Configure | 249
Perfect Forward Secrecy (PFS)
It becomes difficult for a network intruder to get the big picture if keys are changing and they have to keep cracking keys for every negotiation. This is achieved by implementing PFS. By selecting PFS, new key will be generated for every negotiation and a new DH key exchange is included. So every time intruder will have to break yet another key even though he already knows the key. This enhances security.
Diffie-Hellman (DH) Group (IKE group)
Diffie-Hellman is a public-key cryptography scheme that allows peers to establish a shared secret over an insecure communications channel. Diffie-Hellman Key Exchange uses a complex algorithm and public and private keys to encrypt and then decrypt the data.
The Diffie-Hellmann Group describes the key length used in encryption. Group number is also termed as Identifiers.
14
15
16
2
5
DH Group
1
Key length (bits)
768
1024
1536
2048
3072
4096
If mismatched groups are specified on each peer, negotiation fails. The group cannot be switched during the negotiation.
Re-key Margin
Time before the next key is exchanged. Time is calculated by subtracting the time elapsed since the last key exchange from the key life. By turning Re-keying ‘Yes’, negotiation process starts automatically without interrupting service before key expiry.
Dead Peer Detection settings
Use to check whether device is able to connect the IP Address or not. Set time interval after which the status of peer is to be checked and what action to take, if peer is not alive.
Tunnel Negotiation
Negotiation process starts to establish the connection when local or remote peer wants to communicate with each other. Depending on the connection parameters defined, the key is generated which is used for negotiations. Lifetime of key is specified as Key life. Once the connection is established, connection is alive/active and data can be transferred up to the specified key life. Connection will be closed/deactivated once the key expires.
If the connection is to be activated again then the entire negotiation process is to be started all over again. Negotiation process can be started again automatically by either local or remote peer only if Allow Re-keying is set to ‘Yes’.
Set the re-keying time in terms of the remaining key life when negotiation is to be started automatically without interrupting the communication before key expiry. For example, if key life is 8 hours and Re-key margin time is 10 minutes then negotiation process will automatically start after 7 hours 50 minutes of key usage.
Negotiation process will generate new key only if Perfect Forward Secrecy (PFS) is set to ‘Yes’. PFS will generate a new key from scratch and there will be no dependency between old and new key.
Re-keying
Yes
Result
Local and remote peer both will be able to initiate request for connection. Depending on PFS, negotiation process will use same key or generate a new key.
Sophos XG Firewall | Configure | 250
No Only remote peer will be able to initiate request for connection. Depending on PFS, negotiation process will use same key or generate a new key.
Device provides 5 default policies and you can also create a custom policy to meet your organization’s requirement.
To make VPN connection configuration an easy task, following five preconfigured VPN policies are included for the frequently used VPN deployment scenarios:
• Road warrior
• L2TP
• Head office connectivity
• Branch office connectivity
• Default
It also provides option to add a new policy, update the parameters of an existing policy, or delete the policy. Instead of creating a policy from scratch, you can also create a new policy based on the already created policy by duplicating its parameters.
Duplicate - Click the icon in the Manage column against the VPN Policy to be duplicated. The Add VPN Policy window is displayed which has the same values for parameters as the existing policy. Click OK to add a new policy with modification in values for parameters.
Note: The default policy can be updated but cannot be deleted.
Related tasks
on page 250
This page describes how to quickly configure a new IPsec policy.
Create a New IPsec Policy
This page describes how to quickly configure a new IPsec policy.
The Add IPsec Policy menu allows you to manually enter details to add a IPsec policy.
1. Go to Configure > VPN > IPsec Profiles and click Add.
2. Specify the General Settings details.
Name
Enter a unique name for the IPsec policy.
Description
Enter a description for the IPsec policy.
Allow Re-keying
Enable Re-Keying to start the negotiation process automatically before key expiry. The process will start automatically at the specified time in re-key margin.
If enabled, the negotiation process can be initiated by both the local or remote peer. Depending on
PFS, the negotiation process will use the same key or generate a new key.
Key Negotiation Tries
Specify maximum key negotiation trials allowed. Set 0 for an unlimited number of trials.
Authentication Mode
Select an authentication mode. It is used for exchanging authentication information.
Available Options:Main Mode - Consists of 6 messages. It processes and validates the diffiehellman in 3 exchanges.Aggressive Mode - Consists of 3 messages. With Aggressive Mode, a tunnel can be established faster than using Main Mode as less number of messages are exchanged during authentication and no cryptographic algorithm is used to encrypt the authentication information. Use Aggressive Mode when remote peer has dynamic IP addresses.
Sophos XG Firewall | Configure | 251
Depending on Authentication Mode, the phase 1 parameters are exchanged for authentication purpose.
In Main Mode, the phase 1 parameters are exchanged in multiple rounds with encrypted authentication information while in Aggressive Mode phase1 parameters are exchanged in single messages without encrypted information.
Pass Data In Compressed Format
Enable to pass data in compressed format to increase throughput.
Figure 210: General Settings
3. Specify the Phase 1 details.
Encryption Algorithm
Select the encryption algorithm that would be used by communicating parties for integrity of exchanged data for phase 1.
Supported Encryption algorithms: DES, 3DES, AES128, AES192, AES256, TwoFish, BlowFish, and Serpent.
3DES – Triple DES is a symmetric strong encryption algorithm that is compliant with the OpenPGP standard. It is the application of DES standard where three keys are used in succession to provide additional security.
AES – Advanced Encryption Standard offers the highest standard of security. The effective key lengths that can be used with AES are 128, 192 and 256 Bits. This security system supports a number of encryption algorithms.
Serpent – Serpent is a 128-bit block cipher i.e. data is encrypted and decrypted in 128-bit chunks variable key length to be 128, 192, or 256 bits. The Serpent algorithm uses 32 rounds, or iterations of the main algorithm.
Serpent is faster than DES and more secure than Triple DES.
BlowFish – BlowFish is a symmetric encryption algorithm which uses the same secret key to both encrypt and decrypt messages. It is also a block cipher which divides a message into fixed length blocks during encryption and decryption. It has a 64-bit block size and a key length of anywhere from 32 bits to 448 bits and uses 16 rounds of main algorithm.
TwoFish – TwoFish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits.
Authentication Algorithm
Sophos XG Firewall | Configure | 252
Select an authentication algorithm that would be used by communicating parties for integrity of exchanged data for phase 1.
Supported Authentication algorithms: MD5, SHA1
Maximum three combinations of encryption and authentication algorithms can be selected. The remote peer must be configured to use at least one of the defined combinations.
Click the icon to add more than one combination of encryption and authentication algorithms.
Default: MD5
DH Group (Key Group)
Select one Diffie-Hellman Group from 1, 2, 5, 14, 15 or 16. DH Group specifies the key length used for encryption.
• DH Group 1 uses 768-bit encryption
• DH Group 2 uses 1024-bit encryption
• DH Group 5 uses 1536-bit encryption
• DH Group 14 uses 2048-bit encryption
• DH Group 15 uses 3072-bit encryption
• DH Group 16 uses 4096-bit encryption
The remote peer must be configured to use the same group. If mismatched groups are specified on each peer, negotiation fails.
Key Life
Specify the key life in terms of seconds. Key life is the amount of time that will be allowed to pass before the key expires.
Default: 3600 seconds
Re-Key Margin
Specify the re-key margin. Set time in terms of the remaining key life. Re-key margin is the time when the negotiation process should be started automatically without interrupting the communication before the key expiry.
For example, if Key Life is 8 hours and Re-key Margin is 10 minutes then negotiation process will automatically start after 7 hours 50 minutes usage of key life.
Default: 120 seconds
Randomize Re-Keying Margin By
Specify the randomize re-keying time.
For example, if Key Life is 8 hours, Re-Key Margin is 10 minutes and Randomize Re-Keying time is 20% then the re-key margin will be 8 to 12 minutes and negotiation process will start automatically 8 minutes before the key expiry and will try up to 2 minutes after key expiry.
Default: 0%
Dead Peer Detection
Enable to check at regular interval whether peer is live or not.
Default: Enabled
Check Peer After Every (only if the Dead Peer Detection option is enabled)
Specify time after which the peer should be checked for its status. Once the connection is established, peer which initiated the connection checks whether another peer is live or not.
Default: 30 seconds
Wait For Response Upto (only if the Dead Peer Detection option is enabled)
Specify till what time (seconds) initiated peer should wait for the status response. If the response is not received within the specified time, the peer is considered to be inactive.
Sophos XG Firewall | Configure | 253
Default: 120 seconds
Action When Peer Unreachable (only if the Dead Peer Detection option is enabled)
Specify what action should be taken if peer is not active.
Available Options:Hold - Holds the connectionDisconnect - Closes the connectionRe-initiate -
Re-establishes the connection
Default: Disconnect
Figure 211: Phase 1
4. Specify the Phase 2 details.
Encryption Algorithm
Select the encryption algorithm that would be used by communicating parties for integrity of exchanged data for phase 2.
Supported encryption algorithms: DES, 3DES, AES128, AES192, AES256, TwoFish, BlowFish, and Serpent.
3DES – Triple DES is a symmetric strong encryption algorithm that is compliant with the OpenPGP standard. It is the application of DES standard where three keys are used in succession to provide additional security.
AES – Advanced Encryption Standard offers the highest standard of security. The effective key lengths that can be used with AES are 128, 192 and 256 Bits. This security system supports a number of encryption algorithms.
Serpent – Serpent is a 128-bit block cipher i.e. data is encrypted and decrypted in 128-bit chunks variable key length to be 128, 192, or 256 bits. The serpent algorithm uses 32 rounds, or iterations of the main algorithm.
Serpent is faster than DES and more secure than Triple DES.
BlowFish – BlowFish is a symmetric encryption algorithm which uses the same secret key to both encrypt and decrypt messages. It is also a block cipher which divides a message into fixed length blocks during encryption and decryption. It has a 64-bit block size and a key length of anywhere from 32 bits to 448 bits and uses 16 rounds of main algorithm.
TwoFish – TwoFish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits.
Authentication Algorithm
Select an authentication algorithm that would be used by communicating parties for integrity of exchanged data for phase 2.
Sophos XG Firewall | Configure | 254
Supported Authentication algorithms: MD5, SHA1
Maximum three combinations of encryption and authentication algorithm can be selected. The remote peer must be configured to use at least one of the defined combinations.
Click the icon to add more than one combination of encryption and authentication algorithm.
Default: MD5
PFS Group (DH Group)
Select one Diffie-Hellman Group from 1, 2, 5, 14, 15 or 16. DH Group specifies the key length used for encryption.
• DH Group 1 uses 768-bit encryption
• DH Group 2 uses 1024-bit encryption
• DH Group 5 uses 1536-bit encryption
• DH Group 14 uses 2048-bit encryption
• DH Group 15 uses 3072-bit encryption
• DH Group 16 uses 4096-bit encryption
The remote peer must be configured to use the same group. If mismatched groups are specified on each peer, negotiation fails.
If Same as Phase-1 is selected PFS group specified at connection initiator’s end will be used.
If No PFS is selected, this security parameter cannot be added for Phase 2.
Key Life
Specify the key life in terms of seconds. Key life is the amount of time that will be allowed to pass before the key expires.
Default: 3600 seconds
Figure 212: Phase 2
5. Click Save.
SSL VPN
This page describes how to configure general SSL VPN settings.
The SSL VPN tab allows you to define parameters requested for remote access such as protocols, server certificates and IP addresses for SSL clients. The SSL VPN client supports most business applications such as native Outlook, native Windows file sharing, and many more.
1. Go to Configure > VPN > SSL VPN.
2. Specify the SSL VPN Settings.
Protocol
Select the protocol to use. You can choose either TCP or UDP. UDP is recommended because it provides a better performance.
SSL Server Certificate
Sophos XG Firewall | Configure | 255
Select a local SSL certificate to be used by the SSL VPN server to identify itself against the clients.
Default: ApplianceCertificate
Note: The SSL VPN server does not support self-signed certificates that are not approved by a CA (which is not identical to the Generate self-signed certificate option in the Certificate section.)
Override Hostname
Here you can set the server IP address for client VPN connection. Usually this should be the external IP address of Sophos XG Firewall.
IPv4 Lease Range
Set an IP address range which is used to distribute IP addresses to the SSL clients. This should be a private IP address range.
Default Range: 10.81.234.5 to 10.81.234.55
Subnet Mask
Select a netmask for the IP address range above. The netmask must not be greater than 29 bits, because OpenVPN cannot handle address ranges whose netmask is /30, /31, or /32. The netmask is limited to a minimum of 16.
IPv6 Lease (IPv6/Prefix)
If you want to lease IPv6 addresses to clients, set the IPv6 prefix in the first field and the netmask in the last field.
You then also have to select the option IPv4 and IPv6 both in parameter Lease Mode.
Lease Mode
Select if you want to only lease IPv4 addresses to SSL clients or both IPv4 and IPv6 addresses.
IPv4 DNS
Specify up to two IPv4 DNS servers, primary and secondary, of your organization.
IPv4 WINS
Specify up to two IPv4 WINS servers, primary and secondary, of your organization.
Windows Internet Naming Service (WINS) is Microsoft's implementation of NetBIOS Name Server
(NBNS) on Windows operating systems. Effectively, WINS is to NetBIOS names what DNS is to domain names—a central mapping of hostnames to IP addresses.
Domain Name
Enter the hostname of your Sophos XG Firewall as a Fully Qualified Domain Name (FQDN). The
FQDN is an unambiguous domain name that specifies the node's absolute position in the DNS tree hierarchy, for example sf.example.com. A hostname may contain alphanumeric characters, dots, and hyphens. At the end of the hostname there must be a TLD (top level domain) such as com, org, or de. The hostname will be used in notification messages to identify the Sophos XG Firewall.
Disconnect dead peer after
Enter a time limit in seconds after which a dead connection will be terminated by Sophos XG
Firewall.
Default: 180 seconds.
Disconnect idle peer after
Enter a time limit in minutes when an idle connection will be terminated.
Default: 15 minutes.
Sophos XG Firewall | Configure | 256
Figure 213: SSL VPN Settings
3. Specify the Cryptographic Settings.
Encryption Algorithm
Specify the algorithm used for encrypting the data sent through the VPN tunnel. The following algorithms are supported and all in Cipher Block Chaining (CBC) mode:
• DES-EDE3-CBC
• AES-128-CBC (128 bit)
• AES-192-CBC (192 bit)
• AES-256-CBC (256 bit)
• BF-CBC (Blowfish (128 bit))
Authentication Algorithm
• SHA-1 (160 bit)
• SHA2 256 (256 bit)
• SHA2 384 (384 bit)
• SHA2 512 (512 bit)
• MD5 (128 bit)
Key Size
The key size (key length) is the length of the Diffie-Hellman key exchange. The longer this key is, the more secure the symmetric keys are. The length is specified in bits. You can choose between a key size of 1024 or 2048 bits.
Key Lifetime
Enter a time period after which the key will expire.
Default: 28,800 seconds
Figure 214: SSL VPN Cryptographic Settings
Sophos XG Firewall | Configure | 257
4. Specify the Compression Settings.
Compress SSL VPN Traffic
If enabled, all data sent through SSL VPN tunnels will be compressed prior to encryption.
5. Specify the Debug Settings.
Enable Debug Mode
When enabling debug mode, the SSL VPN log file will contain extended information useful for debugging purposes.
6. Click Apply.
L2TP
This page describes how to enable and configure settings for L2TP connections.
Following is a description of the settings of this page:
1. Go to Configure > VPN > L2TP.
2. Click to enable L2TP.
3. Specify the General Settings.
Assign IP from
Set an IP address range which is used to distribute IP addresses to L2TP clients. This should be a private IP address range.
Allow leasing IP address from RADIUS server for L2TP, PPTP and CISCO VPN Client
If this option is enabled and if the user is authenticated via a RADIUS server, the configured IP address (static or leased from the IP address range) is overridden with the IP address provided by the RADIUS server. If no IP addresses are configured on the RADIUS server, the static IP address configured for the user will be assigned, else an IP address will be leased from configured IP address range.
4. Specify the Client Information.
Primary DNS Server
Select the DNS server to be used at the client end.
Secondary DNS Server
Select the alternate DNS server to be used at the client end.
Primary WINS Server
Specify the WINS server to be used at the client end.
Secondary WINS Server
Specify the alternate WINS server to be used at the client end.
5. Click Apply to save the configuration.
6. Use the other buttons if required.
Add Member(s) (available only if L2TP is configured)
Click to select users who are to be allowed remote access through L2TP.
Show Members (available only if L2TP is configured)
Click to view a list of L2TP members.
Related tasks
on page 257
on page 258
Add L2TP Member
This page describes how to add an L2TP member.
Letöltés
A nyilvános link frissítve
A csevegés nyilvános linkje frissítve lett. You may view and manage your chat links after registration here.
Dokumentum nyilvános linkje
Hirdetés
