Mac Sophos Connect can't import SSL VPN Config File

Hi PD_Pat,

Thank you for reaching out to the Community! 

The option "comp-lzo" was introduced in OpenVPN 2.4, and it comes with the warning that the "comp-lzo" option is going to disappear in favor of the new "compress lzo" in version 2.5. So, when the configuration is downloaded from the Sophos XG and used with the stock OpenVPN (or Tunnelblick, for that matter), the message is presented.

You can ignore the warning; it won't affect the remote user's connectivity.

"The Sophos Connect client 2.0 and later versions are available for SSL VPN connections on Windows 8.1 and Windows 10 devices. macOS, Windows 7 SP2, and Windows 8 users can continue to use the legacy SSL VPN client." 

Reference: Sophos Connect client

If possible, I'd suggest using the IPsec(Remote Access) with Connect Client on macOS. 

Thanks,

>You can ignore the warning; it won't affect the remote user's connectivity.
Okay this I can understand and it doesn't bother me at the moment. But worries me that it won't support the config anymore in the future. What is the solution to that? And I would prefer not to use another method for a couple of mac users.

Were you able to figure this out? I'm running into the EXACT same issue. 

This option will be removed in the future. 

Hi, I would suggest moving away from tunnelblick and using Sophos Connect if you can. If im not mistaken, you cannot import an .opvn file into Sophos Connect. It will only accept .scx or .tgb configuration files that are downloaded from the XG. Sophos Connect is fairly easy to configure and setup and you wont need users to download .opvn files. You can use a standard .scx file for everyone and then filter traffic etc using firewall rules assigned to users. 

NOTE: if you are using a Virtual Sophos XG in AWS for example, you would need to modify the .scx file to replace the private ip address with the public Elastic IP since the config file will have the private ip listed in the config.

Let me know if i can be of any help with configuration.

Tunnelblick is a OpenVPN solution. Sophos Connect for MacOS is a IPsec Application.

Yes thats correct. IPSec for Remote Access. I mentioned that Sophos Connect doesnt support .opvn files above. If i read the post above correctly i think he was trying to import that into Sophos Connect.

Yes this is correct but I was not able to get Sophos Connect running on Mac so far. On the Windows Machine I was able to import the files. Where is the difference? And yes we are using SSL VPN.

can you provide a screenshot of the error your getting? I know for SSL VPN specifically, Sophos has its own client that is built off OpenVPN. Its a Stop Light icon on windows. Not sure if you saw the following?

https://support.sophos.com/support/s/article/KB-000035542?language=en_US - for setting up SSL VPN with windows

https://support.sophos.com/support/s/article/KB-000036421?language=en_US - for setting up SSL VPN with Mac

With Sophos Connect in the XG, when your done setting up that config, you can download the Connect client and SCX Config File at the bottom of the screen.

https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/VPNIPsecSophosConnectClient.html - for setting up IPSec Remote Access with Sophos Connect.

SophosConnect for macOS does not support openvpn,yet.
Also,you can change "comp-lzo yes" to "compress lzo" in .ovpn file.