Alternate VPN clients

Question

Hello. We recently rolled out a couple Sophos XG appliances to replace some SonicWall's. Love the Sophos XG but were not overly happy about the VPN client options. The SSL VPN client has been around for quite some time and while efficient it does not allow for a lot of the functionality of the SonicWall Netextender (Domain Login scripts, etc). Although the Netextender has been very problematic with windows 10 upgrades as of late. 
 I see the Sophos Connect is there now with 17.5 and that is a good start but it is EAP and we need to roll this out to over 20 remote users initially. I tested the Sophos Connect and it does not seem to work with AD back end even though the SSLVPN client does. But we will likely wait to attempt to deploy sophos connect for 6 months or so until 18 is out. 
 That being said does anyone know of a VPN client that will work with Sophos XG firewalls that would provide the functionality we are looking for (Domain login scripts, etc) as well as AD backend authentication support? 
 
 Also should we be looking at clientless VPN? Honestly, I was under the impression that IPSec VPN clients were going the way of the dodo. 
 Thanks for any information 
 
 Dave

LuCar Toni · Accepted Answer

First of all, Clientless VPN is not a good alternativ to provide VPN for your user. It demands a high CPU / RAM usage per user on XG/SG. 
 
 Sophos Connect should use backend authentication. Most likely it will use the user, which is created on XG, but uses the credentials out of AD. 
 Domain Login script could be done with GPO&acute;s etc. But not with the tool itself. 
 https://community.sophos.com/kb/en-us/133280 
 
 This is not in the EAP, right now, but there are couple of plans to implement them as well. 
 
 As a (paid) alternative, there are couple of Clients on the market. Thegreenbow, NCP etc. You name it. Most likely they will work with XG as IPsec is quite a standard nowadays.

LuCar Toni · Answer

Can you please update to MR1? 
 https://community.sophos.com/products/xg-firewall/b/xg-blog/posts/sophos-connect-1-1-mr1-released 
 NC-41387 [Remote Access] DNS server is not assigned to the Sophos TAP adapter after tunnel is established on Windows

LuCar Toni · Answer

The User in XG should be a copy of your AD User. But you cannot use groups (right now). 
 So you have to "sync" all users into XG. To sync them, those user have to initial authenticate themself with XG. 
 STAS helps alot to get all users into XG in the first place. Also possible is a initial login via user portal.