Sophos UTM SG mit Sophos Connect Client und extra OTP Eingabefeld

We have the same issue. After investigating all different ways to deploy our clients with the sophos connect client i found this infos:

extra otp field is possible via ".pro" file. ( https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/SConProvisioningFile.html )
See option otp -  "This will give the user a third input box to input the OTP code in the Sophos Connect client."

Note: for using the .pro File you have to enable access to user portal because sophos connect clients wants to load the actual vpn config from it. in our case we do not want to make user portal accessible to the internet so we have to connect the clients first from inside. i still looking for a good solution ;(

when importing an ovpn file i cant see any possibility to enable the third otp box ;(

Hi Robert, thanks for these information.

But the .pro file import is only possible with the sophos xg, not with the sg utm, isn't it? 

yes indeed, sorry i have not seen that we are in the UTM SG Forum ;)

Hallo Thomas,

I PM'd with Lucar Toni and he confirms your understanding.

• Pro Files does not work with a UTM. Pro files require a Sophos Firewall instead. Pro files have the capabilities to download the ovpn file from SFOS user portal. And there are no technique to do this from a UTM. 
  What we can do is using an existing OVPN files from UTM and import it to Sophos Connect, but i assume it does not work for the "extra OTP field".

Cheers - Bob

Hallo Thomas,

I PM'd with Lucar Toni and he confirms your understanding.

• Pro Files does not work with a UTM. Pro files require a Sophos Firewall instead. Pro files have the capabilities to download the ovpn file from SFOS user portal. And there are no technique to do this from a UTM. 
  What we can do is using an existing OVPN files from UTM and import it to Sophos Connect, but i assume it does not work for the "extra OTP field".

Cheers - Bob

I can recommend to look at a smaller XG(S) Box for VPN anyway. The performance of the XGS appliance out stand the SG Hardware by far and the VPN (Site to Site and Remote Access) is included in the base License. 

Therefore you can simply purchase a XGS appliance, get the Enhance Support for RMA etc. and move your VPN to the appliance. 

So you can use Remote VPN, filter on the users etc. Use IPsec/SSLVPN with Sophos Connect in a streamlined process. 

There is even a script to migrate existing UTM SSLVPN Configs to Sophos Connect: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/128936/sophos-connect-migration-script-from-utm-sslvpn Thanks to twister5800

Seriously? we should move to a XG Box for VPN?

Sophos should streamline the Sophos Connect to the UTM in the same way like to the XG Boxes. I am really wondering if the the Sophos Connect Client will be implemented in the UTM for download as well, like the old SSL VPN, or if we have to download it always seperately.

Also why dont UTM Users dont get the Admin Tool for the Sophos Connect Client? (You have to setup a XG Test Appliance, in order to download the current Admin Tool)