Install Sophos Connect Client on Windows

Sophos Connect is the central Sophos client for many remote access scenarios with Sophos Firewall. On Windows, the client can use IPsec and SSL VPN connections depending on the firewall configuration. The client version, Windows platform, configuration file and firewall setup must all be compatible.

This guide covers installation on Windows and the most important checks after importing the connection. To choose between IPsec, SSL VPN, mobile clients and ZTNA, first read Sophos Connect or SSL VPN: Which remote access solution is right?.

For mobile Apple devices, Sophos Connect is not the IPsec client. The separate guide Set up Sophos Firewall IPsec VPN on iPhone explains how to download, install, check and withdraw the native iOS profile.

Which article should I use?

Sophos Connect on Windows is only one part of remote access operations. A different starting point may suit your task better:

• Install Sophos Connect on Windows: This article.
• Set up SSL VPN on Windows with .ovpn: Set up Sophos SSL VPN with Sophos Connect on Windows.
• Configure Sophos Connect on the firewall: Configure Sophos Connect on Sophos Firewall.
• Set up Microsoft Entra ID SSO for Sophos Connect: Set up Microsoft Entra ID SSO for Sophos Connect and VPN Portal.
• Maintain client versions, updates and profiles: Check and safely update the Sophos Connect Client version.
• The VPN is connected, but traffic does not work: Test firewall rules with Log Viewer, Policy Test and Packet Capture.

This separation prevents troubleshooting in the wrong place. An installed client does not prove that VPN Portal, authentication, the profile, firewall rules, DNS and the return path are configured correctly.

Requirements

• Sophos Firewall with a configured remote access setup
• Sophos Connect Client in a version compatible with the firewall and platform
• 64-bit Windows 10 or Windows 11; from Sophos Connect 2.5, Windows 10 or 11 on ARM is also supported
• Configuration file for IPsec (.scx) or SSL VPN (.ovpn), or a provisioning file (.pro)
• No old Sophos SSL VPN Client installed in parallel
• User account with VPN permission and working MFA, if enabled
• Firewall rules for traffic from the VPN zone or the remote access zone in use

To use Sophos Connect with Microsoft Entra ID SSO, Windows requires Sophos Connect 2.4 or later and a suitable SSO configuration on the firewall. The procedure is covered in Set up Microsoft Entra ID SSO for Sophos Connect and VPN Portal.

SSO by firewall version: SFOS 22 describes Entra ID SSO for Windows with Sophos Connect 2.4 or later; SFOS 23 extends this route to supported OpenID Connect identity providers (OIDC) for IPsec, SSL VPN and provisioning. This does not mean every OIDC provider is supported or the feature is available in every firmware build. The Entra setup remains valid. See Sophos Connect provisioning for version and profile requirements; for Google, use Google Workspace OIDC setup on SFOS 23. These guides also provide provider- and version-specific diagnostics; do not apply the Microsoft-specific advice below to other IdPs indiscriminately.

For direct .scx or .ovpn profiles, select the IdP under Authentication > Services before downloading the profile. SSL VPN requires the same IdP for VPN Portal and the tunnel; direct IPsec permits the same or a different IdP. SSO provisioning with .pro, by contrast, requires the same configured IdP for VPN Portal, IPsec and SSL VPN.

Sophos Connect supports Windows ARM from version 2.5. If old software packages are still distributed internally, verify which version is actually installed before rollout. For the rollout, pilot group and update check, see Check and safely update the Sophos Connect Client version.

Support boundary: Sophos Connect 2.5 and later does not support Windows 11 Enterprise Multi-session. This includes Azure Virtual Desktop environments using that operating system. Treat standard single-user Windows 11 and Windows 11 Enterprise Multi-session as separate platforms during approval.

Plan new deployments of current Sophos Connect versions for 64-bit Windows 10 or 11. Do not continue old 32-bit installations as the new standard merely because Sophos Connect 1.0 to 2.4 had different platform boundaries in some cases.

1. Download Sophos Connect Client

Users download the client from the Sophos Firewall VPN Portal under VPN > Sophos Connect client > Download for Windows. Administrators can obtain it in WebAdmin under Remote access VPN > IPsec or Remote access VPN > SSL VPN by clicking Download client, then distribute it in a controlled manner. The version offered there follows the Sophos Connect pattern updates under Backup & Firmware > Pattern updates. The Sophos Connect product documentation is the reference, not a reliably versioned package source for a managed rollout.

VPN Portal is available at https://<Firewall-FQDN>:443 by default. If the VPN portal port has been changed, document that port consistently in the URL, provisioning and SSO plan.

In managed environments, individual users should not install arbitrary client versions. Use a defined package with an approved version, rollout group and rollback plan. This is especially important when using Windows ARM, SSL VPN through Sophos Connect or provisioning files.

Update Sophos Connect regularly. New releases include not only feature changes but also updated components such as OpenVPN, strongSwan and OpenSSL.

For larger environments, the installation source must be unambiguous. If old MSI files, a VPN Portal download and software distribution exist at the same time, the helpdesk can quickly deploy inconsistent client versions.

2. Install Sophos Connect Client

Before installation, remove any existing old Sophos SSL VPN Client. Sophos Connect cannot run in parallel with another VPN client that is already installed. According to Sophos, upgrading Sophos Connect is not a simple in-place update either: uninstall the existing version, then install the current version.

Start the downloaded MSI package. Accept the licence terms, click Install, then complete the wizard with Finish. Do not add undocumented MSI switches to software distribution until they have been checked against the exact approved package.

After installation, verify the version directly in the client or through software inventory. This is particularly important for Windows ARM, Entra SSO, provisioning files and recurring service errors, because small version differences can change the symptoms.

3. Download the connection file

When first launched, Sophos Connect requires a connection configuration. Depending on the remote access design, this is an IPsec, SSL VPN or provisioning file.

Typical connection files:

• IPsec Remote Access: .scx; exported from the Remote Access IPsec configuration.
• SSL VPN: .ovpn; from VPN Portal or an administrative export.
• Automatic import through provisioning: .pro; a centrally prepared provisioning file.

For a classic IPsec configuration, export the file in WebAdmin:

1. In SFOS 22 WebAdmin, open Remote access VPN > IPsec.
2. After configuring the settings, scroll to the bottom and click Export connection.
3. From the downloaded tar.gz archive, distribute the .scx file only to authorised Sophos Connect users. The archive also contains a .tgb file for third-party clients; Sophos recommends the .scx file with its advanced settings for Sophos Connect.

For SSL VPN, the configuration is usually provided through VPN Portal or the remote access configuration. The exact source depends on how remote access is configured on the firewall. The detailed procedure for .ovpn import, VPN Portal and SSL VPN tests is described in Set up Sophos SSL VPN with Sophos Connect on Windows.

SSL profiles and identity: An .ovpn contains user-specific certificates and private keys and must never be shared between users. Distinguish it from reusable raw .pro metadata. The client documentation for SFOS 22 associates the SSL profile generated during import with the user identity, authentication method and domain. Import separately for a different method or domain; reusing the imported SSL profile can cause Login failed. Wrong fingerprint of certificate. This documented restriction does not apply to .scx IPsec profiles. See Provisioning and SSL identity for this distinction.

The saved client documentation for SFOS 23 omits this identity section without explaining a runtime change. This establishes neither permission to reuse profiles nor unchanged binding across every version. Until authoritative version-specific clarification is available, separate SSL imports by identity, method and domain as a precaution; this is not a verified SFOS 23 runtime rule.

Distribute profiles in a controlled manner. After changing the gateway, certificate, DNS, user group, IP pool, SSO or authentication, do not rely on old files in download folders. Re-export and re-import the affected connections, or update them correctly through provisioning.

A .pro file does not simply contain the gateway for the subsequent VPN tunnel. Sophos Connect first uses the gateways defined in the file to reach VPN Portal and retrieve the .scx and .ovpn configurations assigned to the user. The tunnel then uses the gateways in those configuration files.

Check these provisioning requirements deliberately:

• IPsec provisioning requires Sophos Connect 2.1 or later.
• Remote users need access to VPN Portal. For access from the WAN, VPN Portal must be allowed for the WAN zone under Administration > Device access > Local service ACL. This increases the publicly reachable attack surface, so use MFA, a valid certificate and portal hardening.
• The gateway in the .pro file must be reachable as an FQDN or IPv4 address. For SSO, use the firewall host in the configured IdP’s Redirect URI section: Entra ID as documented for SFOS 22, supported OIDC IdPs as documented for SFOS 23. Enter only the FQDN/IP, not the complete callback URI; set the portal port separately in vpn_portal_port. For Google, follow the public FQDN requirements in the linked provider guide.
• The default locally signed portal certificate can cause an Untrusted certificate error during provisioning. For production rollouts, VPN Portal should use a certificate trusted by the clients.
• A connection created with a .pro file can retrieve changes from VPN Portal. Edit connection > Update policy becomes available after the first successful connection for an on-demand pull. If connection attempts repeatedly fail, update the policy first and retest. For manually imported .scx or .ovpn files, the administrator must instead distribute a current file and the user must import it.

A provisioning file simplifies distribution but does not replace technical acceptance of the connection. For setup and GPO distribution, see Configure Sophos Connect on Sophos Firewall.

The complete .pro structure, MFA fields, multiple gateways, and GPO deployment are covered in Sophos Connect provisioning with .pro and GPO.

4. Set up Sophos Connect Client

Setup takes only a few steps:

1. Open Sophos Connect.
2. Select Import Connection.
3. Import the appropriate connection file.
4. Check the connection under Connections.
5. Click Connect.
6. Sign in with the VPN user and confirm MFA, if enabled.

After a successful sign-in, Sophos Connect should show the connection as connected. Do not stop at the green status: test DNS, internal destinations and firewall rules. If the connection is established but no traffic flows, see Test firewall rules with Log Viewer, Policy Test and Packet Capture.

With Entra ID SSO, also verify that the SSO flow uses the expected Microsoft Entra ID server and that Conditional Access or MFA works as intended. A successful local sign-in does not prove that SSO, group mapping and VPN permissions are correct.

On shared Windows devices, disconnect the tunnel first. Then open the Sophos Connect menu at the top right, select Force SSO re-login and confirm with OK. This clears the embedded browser’s cookies. In the pilot, check that the next user signs in with their own SSO identity: Microsoft Entra ID on SFOS 22, or the configured OIDC provider in the supported SFOS 23 Windows workflow. Simply disconnecting the tunnel is not a substitute for this user handover. A fresh sign-in is needed afterwards; do not restore another user’s session cookies.

If automatic password sign-in is caused by Remember username and password, rather than SSO, select Edit connection > Clear credentials. The sign-in options return at the next Connect. The user must enter their credentials again; this changes neither the profile nor VPN authorization and is not a substitute for Force SSO re-login. Change the client’s VPN portal port only on the administrator’s instructions, because SSO also uses this port.

Validate MFA and SSO deliberately

When signing in with a username and password, the username is case-sensitive. If the client asks for a verification code, enter it in the MFA step shown; the actual method must match the firewall and identity-provider configuration. Microsoft Entra ID SSO on Windows requires Sophos Connect 2.4 or later. The sign-in flow also requires the VPN Portal port and current SSO values in the .scx or .ovpn profile.

If Single sign-on (SSO) is grayed out, first export a current configuration file or download it from VPN Portal and import it again. Without sso_api_port and sso_api_domain in the profile, the client can’t offer SSO. If the Microsoft sign-in page doesn’t open, check WebView2 and the Windows update level. This diagnosis is safer than changing the profile or firewall rules speculatively.

Checks after installation

Check the following after installation:

• The Sophos Connect version matches the platform, especially for Windows ARM.
• The imported file matches the intended protocol: IPsec or SSL VPN.
• The user is authorised in the correct VPN group.
• MFA works and does not block the connection process.
• The client receives a suitable VPN IP address.
• Internal DNS names resolve.
• Firewall rules for the VPN zone allow only the required destinations.
• Old profiles have not been reused accidentally.

If legacy Remote Access IPsec configurations still exist before an SFOS 22 MR1 upgrade, first read Migrate legacy Remote Access IPsec before SFOS 22 MR1.

Acceptance test for Windows

A green client status is not sufficient for acceptance. For a reliable rollout, a test user should verify the following:

1. Check client version: The version matches Windows 10/11, Windows ARM and the internal release.
2. Import profile: .scx, .ovpn or .pro is recognised correctly.
3. Test SSO: Entra SSO starts only where intended.
4. Test MFA: OTP, RADIUS MFA or Entra MFA behaves as documented.
5. Test DNS: Internal FQDNs resolve correctly.
6. Test access: Permitted destinations work and unauthorised destinations remain blocked.
7. Check Log Viewer: Traffic from the VPN zone matches the expected firewall rule.
8. Test reconnect: Network changes, standby and reconnection are traceable.

In mixed environments, test at least one standard Windows 10/11 device and one Windows ARM device if ARM is used in production. If macOS clients are also used, document their behaviour separately.

Rollout notes for managed Windows clients

Manual installation may be sufficient for a small number of users. In larger environments, manage Sophos Connect through the normal software distribution or endpoint management system.

Clarify the following before a broad rollout:

• Which Sophos Connect version is approved?
• Which Windows versions and CPU architectures are in use?
• Is IPsec, SSL VPN, Entra SSO or provisioning used?
• Are there users with OTP, RADIUS MFA or Entra MFA?
• How are new profiles distributed?
• How are old profiles removed or marked as obsolete?
• How is Sophos Connect uninstalled before an upgrade and reinstalled afterwards?
• How is Force SSO re-login enforced on shared devices?
• Who checks DNS, firewall rules and reconnect behaviour after client updates?
• Which logs and screenshots does the helpdesk need for support cases?

On shared Windows devices, verify that Sophos Connect starts reliably for all affected users. The internally maintained guide Check the Sophos Connect Client version and update it safely puts four relevant Sophos Connect 2.5 MR1 fixes from June 18, 2026 into context: NCL-2570 fixes missing autostart for additional Windows users after installation by another user, NCL-2783 an incorrect SSO status after an internet failure disconnected the VPN, NCL-2992 different OTP verification prompts during IPsec and SSL VPN reconnection, and NCL-2795 failed SSL VPN connections through provisioning when certificates contained special characters. These fixes justify an update but do not replace pilot and reconnect testing.

Controlled rollback after a failed update

Because Sophos specifies uninstalling the current version and then installing the new version for an upgrade, prepare the rollback in advance as well. Before the pilot update, record the approved previous version, its .scx/.ovpn/.pro files and the acceptance results. If a failure occurs, first save scvpntsr.zip and the firewall logs so the downgrade does not erase the evidence.

Then uninstall the faulty Sophos Connect version through Control Panel > Programs > Uninstall a program, restart Windows if setup or the services require it, and install the unchanged package of the last approved version. Import only the profile approved with that version, then retest sign-in, MFA/SSO, VPN IP, DNS, permitted and blocked destinations, and reconnect. If this acceptance test also fails, stop the rollout rather than masking the problem with repeated profile or firewall changes.

Troubleshooting

Sophos Connect does not start or shows service errors

First verify that the Sophos Connect service is running and that a current client version is installed. For older installation packages, a clean reinstallation of the approved version is usually worthwhile. If several Windows users share the same device, also check that the client starts automatically and correctly in each user context.

If the interface shows SSL VPN error: 0x20000000 and scvpn.log also contains socket connect failed:0x0000274D, the local OpenVPN management service was often not ready when the connection was attempted. This can occur immediately after Windows startup, after resume, or under heavy CPU or memory load. The combination is an indicator, not proof of the cause.

Save the timestamp and scvpn.log before intervening. Then wait briefly and retry the connection once. If the error remains, check the Sophos Connect and OpenVPN service status in Windows Services and restart the affected service in a controlled manner. Restart Windows only if that does not help. If the error returns, check the gateway, port, profile, certificate chain, and network path like a normal SSL VPN failure; repeated service restarts do not replace this diagnosis.

The connection imports but does not connect

The usual causes are user permissions, MFA, the certificate, preshared key, firewall version or an incorrect file type. Do not mix IPsec and SSL VPN profiles. For provisioning files, also check the gateway, VPN Portal port, certificate, SSO configuration and reachable Microsoft endpoints when Entra SSO is involved.

Provisioning shows Untrusted certificate or does not load a profile

First verify that the gateway entered in the .pro file is reachable and that the WAN zone can access VPN Portal under Administration > Device access > Local service ACL. Then check the certificate chain, FQDN, VPN Portal port and, for SSO, whether the firewall host matches the Redirect URI section of the IdP configured for that SFOS version; do not use the complete callback URI as gateway. The firewall’s default locally signed certificate is not an appropriate trust basis for a managed production rollout.

SSO status is unclear after an internet interruption

In Entra SSO environments, an internet interruption can produce confusing status information. Sophos Connect 2.5 MR1 fixes this issue as NCL-2783. Nevertheless, verify whether the tunnel is actually disconnected, whether the client is reconnecting and whether the firewall uses the expected Microsoft Entra ID server under Authentication > Services.

OTP is requested differently during reconnect

If users with classic OTP or MFA use IPsec and SSL VPN in parallel, test the reconnect behaviour. Sophos Connect 2.5 MR1 fixes this sign-in verification difference as NCL-2992.

SSL VPN through provisioning fails with special characters in certificates

If the failure occurs only with SSO, SSL VPN and a .pro file while a current manually imported profile works, record the client version and certificate names. Sophos Connect 2.5 MR1 fixes this issue as NCL-2795. Do not rename certificates speculatively before updating; that can affect trust, SSO and other services at the same time.

The connection is established, but internal systems are unreachable

In this case, the cause is often not the client but firewall rules, routing, DNS or NAT. Log Viewer should show whether traffic from the VPN zone matches the expected rule. For IPsec-specific cases, see Sophos Firewall IPsec VPN troubleshooting.

The connection no longer works after a profile change

First distinguish how the profile is managed. A manually imported .scx or .ovpn connection does not retrieve changes from VPN Portal. After changing the gateway, certificate, VPN Portal port, DNS, IP pool, user group, Entra SSO or authentication, the administrator must therefore export and distribute a current file, and the user must import it again. A connection created with .pro, by contrast, retrieves its assigned configurations from VPN Portal. After the first successful connection, the user can trigger an on-demand pull with Edit connection > Update policy. A client update does not replace either profile-refresh process.

The connection is established, but large transfers stall

If sign-in, DNS and small requests work but large file transfers or certain applications stall, also check MTU/MSS. This pattern often indicates fragmentation, PPPoE, nested tunnels or an asymmetric path. The procedure is described in Check Sophos Firewall MTU and MSS for VPN issues.

Collect support data

If the cause is not immediately visible, document the time, user, Windows version, CPU architecture, Sophos Connect version, profile type, source network and destination system. In Sophos Connect, three-dot menu > About > Generate technical support report creates scvpntsr.zip. It includes openvpn.log, charon.log, scvpn.log, scgui.log, configs.txt, route.txt, ipconfig.txt and systeminfo.txt. These expose VPN configuration, events, routing, IP configuration and system information, so protect the archive as support data and share it only with authorised recipients or Sophos Support.

On the firewall, use Log Viewer, sslvpn.log, IPsec logs, Packet Capture and the affected firewall rule in parallel. The log file mapping is described in Sophos Firewall troubleshooting: services and logs.

FAQ