VPN Clients

ViciousMagician1116,

you can use SSL VPN Client, which must be download from User Portal from the Appliance. You cannot download cyberoam ssl client, because it is not compatible and also the certificate is missing. SSL VPN Client works like a charm on Windows. Thanks to ReesRichards:

https://community.sophos.com/products/xg-firewall/f/initial-setup/88341/how-to-install-and-login-the-ssl-vpn-client-for-windows-10

Take note that XG supported "unlimited" SSL VPN clients (until the HW is running out of resources). The other option is to use Sophos IPSec client (sold separately), whre the features are:

• Authentication: Pre-Shared Key (PSK), PKI (X.509), Smartcards, Token and XAUTH
• Encryption: AES (128/192/256), DES, 3DES (112/168), Blowfish, RSA (up to 2048 Bit), DH groups 1/2/5/14, MD5 and SHA-256/384/512
• Intelligent split-tunneling for optimum traffic routing
• NAT-traversal support
• Client-monitor for graphical overview of connection status
• Multilingual: German, English, and French

Regards

Thanks.  We may have a look at the ipsec client.  I was just playing with the OpenVPN client which has the ability to let users save the password which would make them happier. 

Thanks.  We may have a look at the ipsec client.  I was just playing with the OpenVPN client which has the ability to let users save the password which would make them happier. 

I think a good way to get a VPN connection to XG will also be:
- configure SSL VPN for users on XG,
- download the configuration for Andriod / iOS from the XG portal,
- download and install the OpenVPN Client GUI  ("install-openvpn-2.4.2-I601" or higher),
- copy the configuration file downloaded from the portal to the "config" directory of the OpenVPN client,
- launch the OpenVPN Client GUI and connect the SSL VPN channel (login user).

Regards
Jan

We would like to pre-setup new users' computers with the SSL VPN client but cannot login as them to download their personalized config. Is there a way around this? Also, these users do not have admin rights so they cannot install the client or config themselves anyway. How are other people doing this???