Install Sophos Connect Client on macOS

Sophos Connect can be used on macOS for remote access to Sophos Firewall. In current versions, IPsec is no longer the only relevant option: since Sophos Connect 2.0, Remote Access SSL VPN on macOS is also available. This has changed the recommendation for many environments.

This article covers installation on macOS, importing the appropriate connection and the most important checks after establishing the connection. For the fundamental choice between Sophos Connect, SSL VPN, OpenVPN clients and ZTNA, see Sophos Connect or SSL VPN: Which Remote Access Solution Fits?.

Which Article Is Right for You?

Sophos Connect on macOS quickly overlaps with other remote access articles. Depending on the task, another starting point may be more suitable:

• Install Sophos Connect on macOS: This article.
• Set up SSL VPN on macOS with .ovpn: Set up Sophos SSL VPN with Sophos Connect on macOS.
• Prepare Sophos Connect on the firewall: Configure Sophos Connect on Sophos Firewall.
• Plan client versions, updates and profile maintenance: Check and Securely Update Sophos Connect Client Version.
• VPN is connected, but traffic does not work: Test Firewall Rule with Log Viewer, Policy Test and Packet Capture.

This distinction matters because installing the client is only one part of operating remote access. Firewall rules, DNS, MFA, certificates, the VPN Portal and profile distribution remain separate checkpoints.

Prerequisites

• Sophos Firewall with a configured remote access connection
• Sophos Connect Client in a version compatible with the firewall and platform
• For Sophos Connect 2.0 or later: macOS Ventura 13 or later
• Mac with an Intel processor or Apple Silicon using Rosetta 2
• Configuration file for IPsec (.scx) or SSL VPN (.ovpn)
• No old Sophos SSL VPN Client installed in parallel
• User account with VPN permission and working MFA if enabled
• Firewall rules for traffic from the VPN zone or the remote access zone in use

Sophos Connect 2.0 or later is required to use SSL VPN on macOS. Older internal instructions should therefore be checked to see whether they still assume the former IPsec-only situation. For version checks, update planning and typical DNS or profile issues, see Check and Securely Update Sophos Connect Client Version.

Important: automatic provisioning with .pro files is currently documented for Sophos Connect on Windows only. On macOS, import a .scx file for IPsec or an .ovpn file for SSL VPN. Firewall changes are not transferred to these profiles automatically; after relevant changes, the current file must be redistributed and imported again.

1. Download Sophos Connect Client

Depending on the environment, the Sophos Connect Client for macOS can be obtained from the firewall, the VPN Portal or the Sophos Download Page. Managed environments should define which client version is distributed and where users obtain the correct configuration file.

IPsec on macOS uses a .scx file. SSL VPN imports an .ovpn file. The correct file depends on the remote access configuration on the firewall.

• IPsec Remote Access: .scx; can be used with Sophos Connect on Intel and Apple Silicon.
• SSL VPN: .ovpn; requires Sophos Connect 2.0 or later.
• Provisioning: .pro; currently not supported on macOS and available only on Windows.

For a traditional Sophos Connect IPsec configuration, export the connection in WebAdmin:

1. On Sophos Firewall, open VPN > Sophos Connect Client.
2. Export the connection.
3. Store the file securely and provide it only to authorised users.

Depending on the download source, the installer may be supplied in a zip file. After extracting it, you will typically find the Sophos Connect.pkg package for macOS.

Do not distribute the installer widely across managed Macs without using a pilot group. If the organisation has both platforms, test at least one Intel Mac and one Apple Silicon Mac first.

2. Install Sophos Connect Client

Before installation, remove any existing old Sophos SSL VPN Client. Sophos states that Sophos Connect cannot be operated in parallel with another existing VPN client. The same rule applies when upgrading Sophos Connect: uninstall the existing version, then install the current version.

Double-click Sophos Connect.pkg to start the installation. Check the installation destination, click Install and complete the wizard with Finish.

Rosetta 2 may be required on Apple Silicon devices. If macOS displays a corresponding message during installation, install Rosetta 2 and then restart the client.

Check the version directly in the client after installation. This is particularly important if several installation packages have circulated internally or users have installed the client before.

3. Download the Connection File

When Sophos Connect starts for the first time, it requires a connection configuration. This file should come from the current firewall configuration and should not be reused from an old user archive.

Typical connection files are:

• IPsec Remote Access: .scx; export it from the current Remote Access IPsec configuration.
• SSL VPN: .ovpn; obtain it from the VPN Portal or an administrative export.

If old Remote Access IPsec configurations are still in use before an SFOS 22 MR1 upgrade, do not simply redistribute an old profile. First see Migrate Legacy Remote Access IPsec before SFOS 22 MR1.

Treat profiles like credentials. An old .ovpn or .scx file may still contain internal networks, gateway names, certificates or user references. If the gateway, certificate, DNS, user group, IP pool or authentication has changed, export and import the profile again.

4. Set Up Sophos Connect Client

Sophos Connect can be set up in a few steps:

1. Open Sophos Connect.
2. Select Import Connection.
3. Import the appropriate connection file.
4. Check the connection under Connections.
5. Click Connect.
6. Sign in with the VPN user and confirm MFA if enabled.

After the connection has been established, also check whether internal DNS names resolve and the required systems are reachable. If the connection is up but no traffic flows, use Log Viewer, Policy Test and Packet Capture. See Test Firewall Rule with Log Viewer, Policy Test and Packet Capture.

The DNS test is particularly important for SSL VPN on macOS. Sophos Connect 2.0 MR1 fixes an issue that prevented DNS settings for SSL VPN connections from being applied correctly on macOS. If internal names do not resolve, check the version and profile status before changing DNS rules without evidence.

Microsoft Entra ID SSO in Sophos Connect is currently documented only for Windows with Sophos Connect 2.4 or later. A macOS rollout must therefore not assume that the Windows SSO instructions or .pro provisioning work in the same way. MFA using the method configured on the firewall remains separate from this limitation.

Checks After Installation

Check the following after installation:

• The Sophos Connect version is compatible with the macOS version in use.
• Rosetta 2 is available on Apple Silicon if the client requires it.
• The imported file matches the required protocol: IPsec or SSL VPN.
• The user is authorised in the correct VPN group.
• MFA works and the prompt is clear to users.
• The client receives a suitable VPN IP address.
• Internal DNS names resolve.
• Firewall rules for the VPN zone allow only the required destinations.

Acceptance Test for macOS

A green connection status is not sufficient for acceptance. For a reliable rollout, a test user should complete these checks:

1. Check the client version: The version matches macOS, IPsec or SSL VPN and the internal release.
2. Check Apple Silicon: Rosetta 2 is available and Sophos Connect starts reliably.
3. Import the profile: The correct file for IPsec or SSL VPN is accepted.
4. Test MFA: Signing in requests the expected second factor.
5. Test DNS: Internal FQDNs resolve correctly.
6. Test access: Permitted servers work and unauthorised destinations remain blocked.
7. Check Log Viewer: Traffic from the VPN zone matches the expected firewall rule.
8. Test reconnection: Disconnecting, changing networks and reconnecting all work.

In mixed environments, test at least one Intel Mac and one Apple Silicon Mac. If Windows clients are also used, do not assume that their behaviour is identical. The platform, profile type and client version may differ.

Rollout Notes for Managed Macs

For a small number of users, manual installation with controlled profile import is often sufficient. In larger environments, treat Sophos Connect like other security-relevant client software.

Before a broad rollout, clarify:

• Which Sophos Connect version is approved?
• Which macOS versions are in use?
• Are Intel Macs, Apple Silicon Macs or both in use?
• Is IPsec, SSL VPN or both being used?
• Where do users obtain the current profile?
• Who informs users when profiles need to be imported again?
• How is Sophos Connect uninstalled before an upgrade and reinstalled afterwards?
• Is it documented that Entra ID SSO and .pro provisioning on macOS do not match the Windows feature set?
• How does the helpdesk identify outdated profiles?
• Are the VPN Portal, MFA and certificates monitored separately?

Remove old installation packages and profiles from internal download locations or mark them clearly as outdated. With remote access in particular, using an arbitrary old profile from the Downloads folder quickly creates unnecessary troubleshooting work.

Troubleshooting

The Connection Is Imported but Does Not Establish

First check that the file belongs to the correct protocol and that the Sophos Connect version supports it. SSL VPN on macOS requires Sophos Connect 2.0 or later. Then check user authorisation, MFA, the certificate, gateway, firewall time and whether the VPN Portal or gateway FQDN is reachable.

Internal Names Do Not Resolve

For SSL VPN on macOS, check the deployed Sophos Connect version because this area has received specific fixes. Then check the DNS servers, search domains, imported profile and firewall rules.

If IP addresses work but names do not, DNS is the likely cause. If IP addresses also fail, routing, firewall rules, NAT or the return path are more likely.

The Connection Is Up, but Nothing Is Accessible

The cause is often a firewall rule, routing, NAT or the return path. Log Viewer should show whether traffic from the VPN zone matches the expected rule. For IPsec-specific cases, see Sophos Firewall IPsec VPN Troubleshooting.

The Connection No Longer Works After a Profile Change

After changes to the gateway, certificate, port, DNS, IP pool, user group or authentication, export and import the profile again. A client update does not automatically replace an old profile.

The Option to Save Credentials Is Not Visible

Sophos re-enabled this option for SSL VPN on macOS in Sophos Connect 2.0 MR1. After an update, import the configuration file again to use the option. In environments with MFA, also check whether saving credentials is compatible with the security design.

Sophos Connect Does Not Open or Respond

If the interface does not open or respond to the icon in the macOS menu bar, the GUI process may be stuck. In Activity Monitor, select the Sophos Connect process, use Force Quit, then start the application again from Launchpad. This only terminates the unresponsive interface. If the problem recurs, check the client version and support report.

Web Access Stops Working After Disconnecting

After a full-tunnel connection is disconnected, macOS may continue using the VPN connection’s internal DNS servers. Websites and name resolution outside the tunnel then stop working. Briefly disconnect and reconnect Wi-Fi or Ethernet. If the problem recurs, document the client version, profile and DNS behaviour instead of permanently overriding the DNS servers manually.

The Connection Is Up, but Large Transfers Hang

If sign-in, DNS and small requests work but larger file transfers or certain applications hang, also check MTU and MSS. This pattern often indicates fragmentation, PPPoE, nested tunnels or an asymmetric path. See Check Sophos Firewall MTU and MSS for VPN Issues.

Collect Support Data

If the fault is not immediately apparent, document the time, user, macOS version, Sophos Connect version, profile type, source network and destination system. In Sophos Connect, three-dot menu > About > Generate technical support report creates the scvpntsr.zip file. It contains VPN configurations, connection events and endpoint information and should be shared only with authorised recipients through a controlled process.

On the firewall, use Log Viewer, sslvpn.log, IPsec logs, Packet Capture and the affected firewall rule in parallel. The log file mapping is documented in Sophos Firewall Troubleshooting: Services and Logs.

FAQ