The information provided below will assist you in configuring a split tunnel VPN server, which will allow access to your AD Users, and allow them to access the internet from their devices.
There are several benefits to using a Virtual Private Network (VPN) for remote access to a computer. One of the best is that a VPN allows users to connect to the network from almost any location they can connect to the internet. When a VPN is used for remote access of a computer this gives users the freedom to access computing resources from anywhere and from any system they have access to.
Follow this step-by-step guide to setup a remote access client to take over your network. If you want to implement a VPN (Virtual Private Network) on your home or small office network, you will need a client, which is a piece of software that allows you to connect to the VPN over the Internet. The steps in this guide explains how to install and configure the client.. Read more about sophos ssl vpn configuration and let us know what you think.
The Article’s Goal
Techbast describes how to set up SSL VPN remote access so that users with accounts synchronized from Active Directory can access a remote system.
2.diagram
Details:
- With a WAN IP of 192.168.1.50, the Sophos Firewall device was connected to the Internet through port 2.
- The Palo Alto appliance’s LAN area is set with IP 10.145.41.1/24 on port 1 and a DHCP subnet of 10.145.41.0/24.
- On the local network, there is also an AD server with the IP 10.145.41.11/24, on which an IT-OU is formed, the IT-OU has a support group, and the support group contains user1, user2, and user3.
- We’ll use a PC that isn’t connected to the Internet to set up an SSL VPN connection for remote access.
3.scenario
On the Sophos Firewall appliance, we set up SSL VPN remote access. We utilize an AD user to log in after configuration, and when he signs in, he obtains an IP address in the range of 10.81.234.5-10.81.234.55, as well as access to the LAN subnet resources.
4.adoption procedure
- AD-Sync
- Adding a new OU to a group
- Configure SSL VPN Configuration
- LAN and VPN Subnets: Creating a Profile
- For remote access, you’ll need to set up an SSL VPN access profile.
- On the WAN port, start the user portal and the SSL VPN service.
- Create a policy.
- Result
5.Configuration
AD Sync
The first step is to connect the Active Directory to the Sophos Firewall.
To synchronize, go to CONFIG > Authentication > Server > click Add.
Configure the parameters as follows:
- Select Active Directory as the server type.
- LearningIT, LearningIT, LearningIT, LearningIT, LearningIT, LearningIT, LearningIT,
- 10.145.41.11 is the server’s IP address and domain name.
- Connection security: Choose the simple text option.
- 389-389-389-389-389-389-389-389-389-389-3
- LEARNINGIT is a NetBIOS domain.
- Director is the ADS* user name.
- Password* : Enter the administrator’s password.
- Leave the display name blank.
- Reference e-mail address: mail
- *Learnit.xyz is a domain name.
- Research by Marie Curie* : Click Add, then type dc=learningit,dc=xyz, then OK.
- To test the connection to the AD server, click the Test Connection button.
- Save your work by pressing the Save button.
5.2.Add OE to the group
We must import OUs and groups from AD after a successful AD sync.
To start the import, click the icon as shown in the image.
When the group import wizard’s help window appears, click Start.
In the first stage, choose dc=learningit,dc=xyz from the drop down menu for the group’s base DN.
Step 2: Selecting AD Groups to Import displays the current OUs and groups in AD; in this case, techbast selects the Support group from the IT OU, as indicated.
Press the > button to continue.
Press the > button to continue.
Press the > key and press OK to continue.
To close the window, click Close.
After the import, we can check under CONFIGURATION > Authentication > Group whether the group has been imported.
The support group was established as a result of this.
To have the firewall device authenticate users from AD, you must go to CONFIGURATION > Authentication > Service.
Only local accounts are now authenticated on the firewall, according to the Firewall Authentication Methods section.
We’ll highlight the LearningIT field, which is the server we just synced, and drag it to Local on the right.
To save, click Apply.
5.3. Configuration of an SSL VPN
To configure the SSL VPN setting, go to CONFIG > VPN > view VPN settings > SSL VPN.
The IP lease range section and the Override hostname section are both empty.
We enter 192.168.1.50 as the Sophos XG’s WAN IP in the Override hostname box; this is the IP that will be used to establish the SSL VPN connection to the outside environment.
The IP location range is the set of IP addresses given to users who connect to the SSL VPN securely. We’ll leave this area alone for now, but based on your preferences, you can alter it to a different IP address range during setting.
To save, click Apply.
Subnet profiling for LAN and VPN
To create, go to SYSTEM > Hosts and Servers > click on Add.
Create a profile with the following settings at the LAN level:
- Local Name* :
- Version of IP*: IPv4
- Network Type*
- – Subnet: /24 – IP address*: 10.145.41.0 [255.255.255.0]
- Save your work by pressing the Save button.
Similarly, for the SSL VPN subnet, we’ll establish a profile with the following settings:
- SLL VPN remote access (name*)
- Version of IP*: IPv4
- Select an IP address range by typing *.
- 10.81.234.5 – 10.81.234.55 IP address*
- Save your work by pressing the Save button.
5.5.SSL VPN Remote Access Profile Configuration
To configure, go to CONFIG > VPN > SSL VPN [Remote Access] > Click Add.
Configure the parameters as follows:
- Remote access with SSL VPN (name*)
- Members of the Policy Committee: Select the individual or group to whom you want to allow VPN access, and then the Support group.
- Allowable network resources [IPv4]: Select the IP, subnet, or range of IP addresses that the VPN connection can access when connected to SSL VPN. Here, select the newly established local profile.
- Apply should be selected.
5.6.On the WAN port, start the user portal and the SSL VPN service.
We need to open both of these services on the WAN port of the Sophos device to allow users from outside the Internet to access the user portal and download the VPN software and connect to an SSL VPN.
To access it, go to SYSTEM > Administration > Device Access.
The two services User Portal and SSL VPN are selected in the WAN line.
Then, to connect, click the Apply button.
Developing a policy
The SSL VPN cannot connect to the local network when the user connects it to the system.
A policy that enables traffic between LAN and VPN zones is required.
To create a policy, go to PROTECT > Rules and Policies > click Add Firewall Rule > New Firewall.
Make in accordance with the following guidelines:
- The rule is now in effect.
- SSL VPN is the line’s name.
- CV is an action.
- Firewall traffic should be recorded: Please check the box.
- This is the proper stance: Top
- No, there isn’t a regulatory group.
- Select LAN and VPN as source areas*.
- Select two profiles, Local Remote Access and SSL VPN, for your networks and source devices*.
- Choose All Period at the scheduled time.
- Select LAN and VPN as target areas*.
- Select two remote and local SSL VPN access profiles as target networks*.
- Select a service* from the list below.
- Check to see if the users are familiar with the game.
- Users or Groups* in the table: Choose a support group. (This policy can only be used by members of this group when connecting to an SSL VPN.)
- Save by clicking the Save button.
5.8.Result
Once the installation is complete, create an SSL VPN connection from a machine that is not connected to the Internet.
To begin, go to the user portal and download the program as well as the SSL VPN profile.
Go to https://192.168.1.50 to enter the user portal.
We log in with an account and password after acquiring access.
is used to link user1 to AD, which is synchronized.
We click Download VPN and Client after logging in and setup Windows to download the program.
Then, as described below, install the SSL VPN remote access program.
The application will display on the taskbar in the bottom right corner of the screen once the installation is complete.
Connect by right-clicking on the traffic light icon.
Enter your user1 account and password in the login window and click OK.
When the connection is made, a notice similar to the one below appears.
The connection was successful, and the allocated IP address is 10.81.234.6, which matches the IP address distribution range we set up at the start.
Finally, test the LAN connection by pinging the AD server.
OTHER THINGS YOU MIGHT BE INTERESTED IN
I recently had to do a lot of work to our remote access solution and have decided to document it for others. First off, I am going to cover the basic overview of remote access and configuration. You can find more on this in the Office 365 Remote Access Architectural Reference article. I will also cover how to configure VPN for users in Active Directory.. Read more about ssl vpn user authentication and let us know what you think.
Related Tags
This article broadly covered the following related topics:
- ssl vpn user portal
- sophos ssl vpn client not connecting
- ssl vpn user authentication
- sophos ssl vpn client login
- sophos ssl vpn config file download
