Sophos SSL VPN Integration
General Overview
This guide explains the instructions on configuring Mirket multi-factor authentication for Sophos Firewall SSL VPN client. Prior configuration and deployment of Sophos Firewall are required before setting up MFA with Mirket.
Sophos Firewall offers various MFA configuration modes. In this integration, we've configured RADIUS authentication with Mirket.
This integration was tested using Sophos Firewall SFVUNL (SFOS 18.0.5 MR-5-Build586).
Preparation Steps
Before proceeding with these procedures, ensure the following:
You've completed the installation and configuration of the Mirket (go to Mirket Installation Steps).
End-users can access the Sophos Firewall SSL VPN client.
Configuring Sophos Firewall
Ensure your Sophos Firewall WAN, LAN, and DNS configurations are complete before proceeding with Sophos configuration. Also, confirm the installation and Internet connection of the Mirket (RADIUS server).
Identify Remote SSL VPN Range and a Local Subnet
Access the Sophos web UI. Then go to System > Hosts and services > IP host and click on Add.
Enter an IP hostname in the Name field. In this instance, we input the IP hostname as "Remote SSL VPN range".
Choose the IPv4 option in the IP version field.
Choose the Network option in the Type field.
Input the IP address utilized by the SSL VPN client to connect from the WAN in the IP address field.
Then click on Save to confirm settings.
Go to System > Hosts and services > IP host and click on Add.
Enter an IP hostname in the Name field. In this instance, we input the IP hostname as "Local subnet".
Choose the IPv4 option in the IP version field.
Choose the Network option in the Type field.
Input the IP address that remote clients can access in the IP Address field.
Then click on Save to confirm settings.
SSL VPN Group Configuration
Go to Configure > Authentication > Groups and click on Add.
Enter a group name in the Name field. In this instance, we input the group name as "Remote SSL VPN group".
Choose the "Normal" option from the Group type dropdown list.
Choose the "Unlimited Internet Access" option from the Surfing quota dropdown list.
Keep the remaining settings as default values.
Then click on Save to confirm settings.
SSL VPN Policy Configuration
Go to Configure > VPN > SSL VPN (remote access) and click on Add.
Enter a policy name in the Name field. In this instance, we input the policy name as "SSL VPN policy".
Under the Identity section, click on "Add new item" to add the group that you created previously in the Policy Members field. In this instance, we add the Remote SSL VPN group.
Under the Tunnel access section, click on "Add new item" to add the IP host that you created previously in the Permitted network resources (IPv4) field. In this instance, we add the Local subnet IP host.
Click on Apply to confirm settings.
SSL VPN Users Configuration
Go to Configure > Authentication > Users and click on Add.
Enter a username and name for this user account in the Username and the Name fields.
Choose the "User" option in the User Type field.
Enter a password for this user account in the Password field and re-enter it in the second Password field.
Enter the email address to associate with this user account into the Email field.
Choose the "Remote SSL VPN group" option from the Group dropdown list.
Choose the "SSL VPN policy" option from the Remote access dropdown list.
Keep the remaining settings as default values.
Then click on Save to confirm settings.
RADIUS Server Configuration
Go to Configure > Authentication > Servers and click on Add.
Choose the "RADIUS server" option from the Server type dropdown list.
Enter a RADIUS server name in the Server Name field. In this instance, we input the server name as "MirketRADIUS".
Input the host IP address of the machine where the Mirket is installed into the Server IP field.
Input 1812 for communication with the Mirket (Radius Server) in the Authentication port field. Also, you can use different ports to communicate.
Input 3 in the Time-out field.
Enter "radius" in the Group name attribute field.
Then click on Save to confirm settings.
Authentication Services Configuration
Go to Configure > Authentication > Services and click on Add.
Choose the "Set authentication method for SSL VPN" option in the SSL VPN authentication methods section.
Choose the RADIUS server that you configured previously. In this instance, we choose the server as "MirketRADIUS".
Then click on Apply to confirm settings.
Verify Device Access Settings
Go to System > Administration > Device access.
Make sure LAN, WAN, and WiFi checkboxes are checked in the SSL VPN section and LAN, DMZ, VPN, and WiFi checkboxes are checked in the User Portal section.
Verify SSL VPN Settings
Go to Configure > VPN. Then click on Show VPN Settings.
Check that the IPv4 Lease Range dropdown list under the SSL VPN tab displays the correct value.
Modify the other settings if required.
Create a Firewall Rule
Go to Protect > Rules and policies. Then select the Firewall rules tab and click on Add firewall rule > New firewall rule.
Enter a rule name in the Rule name field. In this instance, we input the rule name as "Remote SSL VPN access rule".
Choose the Accept option from the Action dropdown list.
Choose the "Top" option from the Rule position dropdown list.
Choose the None option from the Rule group dropdown list.
Click on "Add new item" to add the VPN option in the Source zones field.
Click on "Add new item" to add the IP host that you configured previously in the Source networks and devices field. In this instance, we add the "Remote SSL VPN range" IP host.
Click on "Add new item" to add the LAN option in the Destination zones field.
Click on "Add new item" to add the other IP host that you configured previously in the Destination networks field. In this instance, we add the "Local Subnet" IP host.
Check the "Match known users" checkbox.
Click on "Add new item" to add the group that you configured previously in the Users or groups field. In this instance, we add the "Remote SSL VPN group".
Keep the remaining settings as default values.
Then click on Save to confirm settings.
Configure Mirket
To enable Mirket to receive authentication requests from Sophos Firewall, follow these steps:
Define Sophos as a RADIUS client resource within Mirket.
Create an authentication policy for the Sophos RADIUS client resource or include it in an existing authentication policy.
Attach the Sophos resource to the Mirket Radius.
Add Sophos as a Resource in Mirket with Radius Gateway
Before starting, ensure that you have installed Mirket Radius Gateway from the Configuration > Gateway. To add a Radius Gateway to the Mirket, follow these steps:
Go to Configuration > Gateway and click on the Add Radius Gateway button.
On the displayed screen, enter a name for your Radius Gateway in the Name field.
Enter the SAM value of the gateway in the Sam Value field. In Mirket, user identification is done using the SAM (Security Account Manager) name. This is preferred over the standard username. This username is used for authentication and access controls.
Enter the IP address of the server where the gateway is installed in the Host IP Address field.
Enter the authentication port value you set for the gateway in the Auth Port field. The default value is 1812.
Enter the accounting port value you specified for the gateway in the Acc Port field. The default value is 1813. Note: After completing these fields, you must create a RADIUS client for the newly created RADIUS Gateway.
Click on the Add Radius Client option at the bottom of the displayed screen.
Enter a name for your Radius Client in the Radius Client field.
Enter the IP address of the client(firewall) that will communicate with the gateway in the IP Address field.
Enter the secret key that the client will communicate with the gateway in the Secret Key field.
Click on the Save button to confirm the settings.
Configuring Radius Gateway
After creating the Radius Gateway, click on the Download > Config from the menu on the right side of the gateway.
This option will generate a script related to the gateway, which will be displayed from the RADIUS Setup config file. The config file will automatically begin downloading once this option is selected.
Replace the existing config file in the
"C:\MirketRadius"directory with the downloaded file. Alternatively, copy the displayed script and paste it into the config file in"C:\MirketRadius".
Then, restart the Mirket Radius Service.
You can check whether the Radius Gateway you created is active by navigating to Configuration > Gateway.
User and Group configuration on Mirket
To set up multifactor authentication, make sure you have at least one user or group in Mirket.
If it is preferred to use a local user, you can first create a local group and then create a local user and make the user a member of the group. Alternatively, you can create a local user without creating a local group.
Add a Radius Rule to Mirket
Radius Rules define user access to resources and the authentication methods available (such as SMS, Approve / Deny, OTP, etc.).
First, you should follow these steps:
Go to Configuration > Radius Rules.
Click on the Add Radius Rule button.
On the displayed screen, enter a name for the rule in the Name field.
Enter the rule description in the Description field.
Select the Radius Client to which the rule will apply from the Radius Client dropdown list.
Enter the source IP addresses to which the rule will apply in the Source Adress field.
Select the source countries where the rule will be applied from the Source Country dropdown list.
Click on the Next button.
Specify whether the rule will be applied to a user or a group.
After specifying, click on the Next button.
Select the users or groups to which the rule will apply. Transfer your selections to the Selected Users/Groups table by clicking the arrow icon next to the Available Users/Groups table.
Click on the Next button.
Select the time period when the rule will run.
All: The rule will run every day.
Recurring: The rule will run on the specified days and times.
One Time: The rule will run within the date range you specify.
After selecting, click on the Next button.
Specify whether the user or group will be granted access based on the rule in the Action field.
Select the authentication provider to which the rule will apply from the Auth Method dropdown list.
Select the attribute type as "FilterId" from the Attribute Type dropdown list.
Enter the group to be granted authorization in the Value field. Please make sure that the value is the same as the group name you specify in Sophos.
Click on Save to confirm the settings.
Test the Integration
To validate the integration between Mirket MFA and your Sophos Firewall SSL VPN, perform authentication using a mobile token on your mobile device. For RADIUS resources, available authentication methods include Approve/Deny authentication.
In this example, we illustrate the use of the Approve/Deny authentication method.
Install the Sophos SSL VPN client that you downloaded on your computer. After the installation, click on the traffic light icon in the taskbar.
Enter your Mirket username in the Username field.
Input your password in the Password field.
Click on OK.
Then, select the 'Approve' option(found in the Mirket mobile app) immediately and make sure it doesn't time out.
Related Topics
Last updated
