Sophos SSL VPN Integration
General Overview
This guide explains the instructions on configuring Mirket multi-factor authentication for Sophos Firewall SSL VPN client. Prior configuration and deployment of Sophos Firewall are required before setting up MFA with Mirket.
Sophos Firewall offers various MFA configuration modes. In this integration, we've configured RADIUS authentication with Mirket.
This integration was tested using Sophos Firewall SFVUNL (SFOS 18.0.5 MR-5-Build586).
Preparation Steps
Before proceeding with these procedures, ensure the following:
You've completed the installation and configuration of the Mirket (go to Mirket Installation Steps).
End-users can access the Sophos Firewall SSL VPN client.
Configuring Sophos Firewall
Ensure your Sophos Firewall WAN, LAN, and DNS configurations are complete before proceeding with Sophos configuration. Also, confirm the installation and Internet connection of the Mirket (RADIUS server).
Identify Remote SSL VPN Range and a Local Subnet
Access the Sophos web UI. Then go to System > Hosts and services > IP host and click on Add.
Enter an IP hostname in the Name field. In this instance, we input the IP hostname as "Remote SSL VPN range".
Choose the IPv4 option in the IP version field.
Choose the Network option in the Type field.
Input the IP address utilized by the SSL VPN client to connect from the WAN in the IP address field.
Then click on Save to confirm settings.
Go to System > Hosts and services > IP host and click on Add.
Enter an IP hostname in the Name field. In this instance, we input the IP hostname as "Local subnet".
Choose the IPv4 option in the IP version field.
Choose the Network option in the Type field.
Input the IP address that remote clients can access in the IP Address field.
Then click on Save to confirm settings.
SSL VPN Group Configuration
Go to Configure > Authentication > Groups and click on Add.
Enter a group name in the Name field. In this instance, we input the group name as "Remote SSL VPN group".
Choose the "Normal" option from the Group type dropdown list.
Choose the "Unlimited Internet Access" option from the Surfing quota dropdown list.
Keep the remaining settings as default values.
Then click on Save to confirm settings.
SSL VPN Policy Configuration
Go to Configure > VPN > SSL VPN (remote access) and click on Add.
Enter a policy name in the Name field. In this instance, we input the policy name as "SSL VPN policy".
Under the Identity section, click on "Add new item" to add the group that you created previously in the Policy Members field. In this instance, we add the Remote SSL VPN group.
Under the Tunnel access section, click on "Add new item" to add the IP host that you created previously in the Permitted network resources (IPv4) field. In this instance, we add the Local subnet IP host.
Click on Apply to confirm settings.
SSL VPN Users Configuration
Go to Configure > Authentication > Users and click on Add.
Enter a username and name for this user account in the Username and the Name fields.
Choose the "User" option in the User Type field.
Enter a password for this user account in the Password field and re-enter it in the second Password field.
Enter the email address to associate with this user account into the Email field.
Choose the "Remote SSL VPN group" option from the Group dropdown list.
Choose the "SSL VPN policy" option from the Remote access dropdown list.
Keep the remaining settings as default values.
Then click on Save to confirm settings.
RADIUS Server Configuration
Go to Configure > Authentication > Servers and click on Add.
Choose the "RADIUS server" option from the Server type dropdown list.
Enter a RADIUS server name in the Server Name field. In this instance, we input the server name as "MirketRADIUS".
Input the host IP address of the machine where the Mirket is installed into the Server IP field.
Input 1812 for communication with the Mirket (Radius Server) in the Authentication port field. Also, you can use different ports to communicate.
Input 3 in the Time-out field.
Enter "radius" in the Group name attribute field.
Then click on Save to confirm settings.
Authentication Services Configuration
Go to Configure > Authentication > Services and click on Add.
Choose the "Set authentication method for SSL VPN" option in the SSL VPN authentication methods section.
Choose the RADIUS server that you configured previously. In this instance, we choose the server as "MirketRADIUS".
Then click on Apply to confirm settings.
Verify Device Access Settings
Go to System > Administration > Device access.
Make sure LAN, WAN, and WiFi checkboxes are checked in the SSL VPN section and LAN, DMZ, VPN, and WiFi checkboxes are checked in the User Portal section.
Verify SSL VPN Settings
Go to Configure > VPN. Then click on Show VPN Settings.
Check that the IPv4 Lease Range dropdown list under the SSL VPN tab displays the correct value.
Modify the other settings if required.
Create a Firewall Rule
Go to Protect > Rules and policies. Then select the Firewall rules tab and click on Add firewall rule > New firewall rule.
Enter a rule name in the Rule name field. In this instance, we input the rule name as "Remote SSL VPN access rule".
Choose the Accept option from the Action dropdown list.
Choose the "Top" option from the Rule position dropdown list.
Choose the None option from the Rule group dropdown list.
Click on "Add new item" to add the VPN option in the Source zones field.
Click on "Add new item" to add the IP host that you configured previously in the Source networks and devices field. In this instance, we add the "Remote SSL VPN range" IP host.
Click on "Add new item" to add the LAN option in the Destination zones field.
Click on "Add new item" to add the other IP host that you configured previously in the Destination networks field. In this instance, we add the "Local Subnet" IP host.
Check the "Match known users" checkbox.
Click on "Add new item" to add the group that you configured previously in the Users or groups field. In this instance, we add the "Remote SSL VPN group".
Keep the remaining settings as default values.
Then click on Save to confirm settings.
Configure Mirket
To enable Mirket to receive authentication requests from Sophos Firewall, follow these steps:
Define Sophos as a RADIUS client resource within Mirket.
Create an authentication policy for the Sophos RADIUS client resource or include it in an existing authentication policy.
Attach the Sophos resource to the Mirket Radius.
Add a Sophos as Resource in Mirket with Mirket Radius Gateway
Before starting, ensure that you have installed Mirket Radius Gateway. To add a Radius Client to the Mirket Radius Gateway, follow these steps:
First, navigate to the directory
C:\MirketRadiusand open theconfig.jsonfile.
Fill in the gateway and radiusClientList fields according to the provided specifications to ensure accurate and secure network configuration.
samName: Enter the SAM name of the gateway. In Mirket, user identification is done using the SAM (Security Account Manager) name. This is preferred over the standard username. This username is used for authentication and access controls. Please provide your domain name, such as 'mirket'.
authenticationPort: Enter the authentication port value you set for the gateway. The default value is 1812.
accountingPort: Enter the accounting port value you specified for the gateway. The default value is 1813.
gatewayIp: Enter the IP address of the server where the Mirket is installed.
ipAddress: Enter the IP address of your firewall.
secretKey: Enter your secret key. This secret key is used to link your radius client and radius server, so ensure they are identical.
Once you've made the necessary changes to the config.json file, save and close it. Note: You can add multiple RADIUS clients.
After completing the configuration, restart the 'Mirket Radius Gateway Service'.
User and Group configuration on Mirket
To set up multifactor authentication, make sure you have at least one user group in Mirket.
If it is preferred to use a local user, first create a local group and then create a local user and make the user a member of the group.
If it is preferred to use LDAP users, the priority LDAP group is created by pulling users from Active Directory or OpenLDAP in Mirket.
Create an Authorization Profile on Mirket
After authentication, in scenarios requiring authorization (Example: Sending group name to the Radius client in SSL VPN), you can complete the process by creating an authorization profile in Mirket and selecting the created profile in Radius rules.
The following steps should be followed to create an authorization profile:
Select Authorization Profiles.
Click on Add New.
Enter an authorization profile name in the Name field.
Select the attribute type as "FilterId" from the Attribute Type dropdown list.
Enter the group to be granted authorization in the Value field. Please ensure that value is the same as the group name you specify in Sophos.
Click on Save to confirm settings.
Add a Radius Rules to Mirket
Radius Rules define user access to resources and the authentication methods available (such as SMS, Approve / Deny, OTP etc.).
First, you should follow these steps:
Select Rules > Radius Rules.
Click on Add New.
Enter a rule name in the Name field.
Enter the rule description in the Description field.
Select the group to which the rule applies from the Group dropdown list.
Select the provider to which the rule applies from the Provider dropdown list.
Select the authorization profile to which the rule applies from the Authorization dropdown list.
Click on Save to confirm settings.
Test the Integration
To validate the integration between Mirket MFA and your Sophos Firewall SSL VPN, perform authentication using a mobile token on your mobile device. For RADIUS resources, available authentication methods include Approve/Deny authentication.
In this example, we illustrate the use of the Approve/Deny authentication method.
Install the Sophos SSL VPN client that you downloaded on your computer. After the installation, click on the traffic light icon in the taskbar.
Enter your Mirket username in the Username field.
Input your password in the Password field.
Click on OK.
Then, select the 'Approve' option(found in the Mirket mobile app) immediately and make sure it doesn't time out.
Related Topics
Last updated
