Sophos Connect Client Troubleshooting

If Sophos Connect does not connect, diagnosis begins at the endpoint: note the error time, read the message for this attempt under Events, and check only the affected path. Changing firewall rules, VPN policies, or certificates on suspicion makes analysis harder. This runbook covers the client on Windows and macOS; the installation guides for Windows and macOS cover installation.

Narrow down quickly

1. Record the initial situation: Time with time zone, user, operating system, Sophos Connect version, IPsec or SSL VPN and profile source (.scx, .ovpn or .pro).
2. Check local network: The physical adapter needs a valid IP address. A public name must be resolvable without a VPN.
3. Read the event: Under Events, match the entry to the connection attempt. Preserve its exact wording and placeholder values.
4. Separate client and remote-side faults: If the GUI or service does not start, continue on the endpoint. If the client reaches the gateway but fails at policy, authentication, or IKE, ask the firewall administrator to correlate the attempt.
5. Check result: Reconnect after exactly one action and note a new time stamp.
6. Escalate: Pass repeatable errors with event, VPN log and scvpntsr.zip; do not write access data in the ticket.

A status Connected only proves that the tunnel has been established. DNS, routing and access to a permitted internal destination are separate tests.

Read events correctly

The message under Events is the best first filter. However, it does not describe the ultimate cause in every case. For example, DNS resolution failed can only confirm that the client could not resolve the gateway name; Why the resolver used does not respond must be clarified separately.

Network, DNS and provisioning

• No network connection: Ethernet or WiFi does not have an IP address. First, restore local connectivity without VPN.
• DNS resolution failed: The gateway name cannot be resolved. Check whether a DNS server is assigned to the physical interface and run nslookup www.sophos.com in Command Prompt on Windows or in Terminal on macOS. At least one IP address is expected. If this public test fails, the next step lies with the local network or provider, not with the VPN policy.
• DNS resolution failed for gateway: <gateway name:port>: Hostname in provisioning is invalid; for imported .ovpn, the firewall admin must check the SSL VPN settings.
• Cannot connect to policy gateway: <gateway name>: For provisioning on Windows and on macOS from Sophos Connect 2.1. Compare gateway and user_portal_port with the gateway and the VPN Portal HTTPS port. Also check for a blocked outbound port or an unavailable policy gateway.
• Import file contains a duplicate connection: <connection name>: For provisioning on Windows and on macOS from Sophos Connect 2.1. Give each duplicate display_name value in the .pro file a unique name.
• The connection data could not be added. Connection with name <connection name> already exists: Check already imported connection and only delete it if the current profile source is available for re-import.

Authentication and profile status

• User authentication of <username entered> failed: Repeat entry carefully once. If the error repeats, the firewall admin must check the password status, user and VPN authorization. Multiple guesses can trigger locking mechanisms.

• Server expected remote ID <expected ID value> but got <actual ID value>: Local ID on firewall and client profile do not match. Obtain current profile from firewall admin.

• Possible pre-shared key mismatch <connection name>: IPsec only. Preshared key and exported profile are not the same; do not transfer the key in the ticket or chat.

• No SSL VPN policy is defined for this user: <username>: The SSL VPN remote access policy does not contain matching members. This is a firewall-side authorization task.

• The Single sign-on (SSO) option is grayed out: Windows from Sophos Connect 2.4; macOS from 2.1. The current troubleshooting guidance identifies missing sso_api_port and sso_api_domain values in the .ovpn or .scx profile on both platforms. Ask the firewall administrator to provide an updated configuration, import it, and reconnect; this is not an instruction to edit profiles manually. This does not add SSO support to macOS client 2.0.

• SSO Authentication failed due to Webview2 setup error: Repair or update WebView2 and the Windows update status; the client could not open the Microsoft login page.

• Entra SSO fails in the browser or does not return to the client (macOS, Sophos Connect 2.1 or later): Check the macOS SSO browser workflow for browser selection, fallback and returning to Sophos Connect. If a different browser mode is needed, ask IT to provide an approved .pro file following the provisioning schema for sso_auth_browser_type. Meet compliance requirements or contact IT; do not weaken Conditional Access, MFA or certificate validation.

IPsec events

• UDP ports 500/4500 blocked: Local firewall or router blocks IKE/NAT-T. If you don’t manage the router, check with a mobile hotspot. If the same client works there, that is a strong indication of the original network path.
• No response from gateway: <gateway FQDN or IP specified in connection>: The IPsec gateway is not responding to IKE. The firewall admin must check accessibility and public WAN connection.
• Received NO_PROPOSAL_CHOSEN notification from gateway: The Sophos Connect policy is inactive, or its phase 1 proposal no longer matches the exported profile. Do not weaken proposals blindly; compare the policy and profile in a controlled manner.
• SA disabled or deleted by gateway: The gateway deleted the SA, for example after a policy change or manual disconnection. Reconnect once; correlate with the firewall timestamp when repeated.
• Failure to add route [network/mask] prevented phase 2 completion: Windows only. After Phase 2 SA was set up, the route could not be set. Deactivate and reactivate the TAP adapter. If the error persists, open Command Prompt as administrator:

net stop scvpn
net start scvpn

The service is then expected to be running again and a new connection attempt will set the route. Stopping breaks existing Sophos Connect tunnels on this device.

• Failed to load connection info into strongSwan: Windows only; charon-svc.exe or the strongSwan service is not running. Start in Command Prompt as Administrator:

net start strongswan

If the service does not start or fails again, do not continue in a restart loop, but back up the support report and Windows events.

SSL VPN events

• Policy mismatch error. Will download policy and retry connection.: A Windows connection created from .pro downloads the changed policy and reconnects automatically. With TCP, the client detects the change while connected; with UDP, the inactivity timer may have to expire first.
• Policy mismatch error. Import a new policy for this connection.: A manually imported .ovpn is out of date. Obtain and import a new user-specific .ovpn from the VPN portal.
• Compression mismatch error. Will retry connection.: For .ovpn, reconnect manually; a provisioned connection tries it automatically.
• Server certificate cannot be verified: <gateway name>. Do you want to continue? During provisioning, the VPN Portal presents a certificate that the endpoint cannot verify, usually the firewall’s self-signed certificate. Continue only after verifying the gateway and certificate through a trusted channel. The firewall administrator should assign a publicly trusted certificate for Admin console and end-user interaction, or distribute the Sophos Firewall CA to managed endpoints’ trust stores. Do not disable certificate validation.
• Could not connect to untrusted server: <gateway>: The certificate warning has been canceled. First clarify identity and chain of trust, then try again.
• Timed out waiting for server response: The SSL VPN override hostname or DDNS record does not resolve to the correct public address, or neither is configured and the WAN interface has no public address. For a Windows .pro connection, use Update policy after the firewall administrator corrects the settings. For .ovpn, download and import a new file.

Fix GUI and service errors

Interface does not open or respond

On Windows, open Task Manager > Details, select scgui.exe, choose End task, and open Sophos Connect from the desktop shortcut. On macOS, open the Sophos Connect process in Activity Monitor, select Force Quit, and open the application from Launchpad. This closes the unresponsive interface; it does not fix the underlying cause. If the problem returns, record the version and preserve scgui.log.

Service is unavailable

On Windows, the event means that scvpn is not running. Open Command Prompt as Administrator:

net start scvpn

For Service Unavailable after a hanging IPsec disconnect on macOS, first close the GUI in Activity Monitor. Then reload the documented service in Terminal with administrator rights:

sudo /bin/launchctl unload -w /Library/LaunchDaemons/com.sophos.connect.scvpn.plist
sudo /bin/launchctl load -w /Library/LaunchDaemons/com.sophos.connect.scvpn.plist

Reopen Sophos Connect and see if the message has disappeared. These commands interrupt the tunnel. If an error recurs, do not reload services repeatedly, but save logs and reports.

More local SSL VPN service errors

• Management port is unavailable: Sophos Connect could not occupy TCP port 25340 for communication with OpenVPN. Check what other local application is using the port and only terminate it if its function is known. Then reconnect.
• OpenVPN service is unavailable: On Windows, check the OpenVPN service startup type. If it is Disabled, record the existing value, change it to Manual, then restart the Sophos Connect service. This interrupts active tunnels. Afterwards, check the service and connection; if the attempt fails, restore the previous startup type and escalate. Do not apply this Windows service setting to macOS.
• Failed to create temporary file: Restart device. The client was unable to create the temporary file to pass connection attributes.
• Failed to write to pipe or more generally SSL VPN error: Reconnect once. If the error persists, restart the device; then escalate with logs instead of continuously restarting.
• Sophos Connect can’t establish a tunnel after installing both clients: For the legacy Sophos SSL VPN Client, the troubleshooting guidance describes reinstalling both clients in this order: the old SSL VPN Client first, then Sophos Connect. However, the installation guide rules out running Sophos Connect alongside other VPN clients. These conflicting statements are not general approval for coexistence. If the old client is no longer required, use the approved target setup without it; if both are essential, first confirm the specific combination with Sophos and plan a separate pilot and rollback path rather than installing both on suspicion.
• Manually imported .ovpn or .scx profiles do not automatically retrieve later policy changes. Auto-connect and Update policy require provisioning: on Windows with a compatible client, and on macOS from 2.1, not 2.0. auto_connect_host enables Auto-connect; Update policy becomes available after the first successful connection. Rename, Clear credentials and Delete remain separate connection actions; manual profiles require reimport after Delete.
• An upgrade or uninstall leaves old processes running on macOS with Sophos Endpoint installed: According to the troubleshooting guidance, Tamper Protection can prevent Sophos Connect daemons from unloading. Preserve logs, restart the Mac once during a maintenance window, then check the client and process state. The current removal guide no longer calls for blanket protection disabling; this implies neither a requirement to disable protection nor a guarantee that protection is never involved. If removal remains blocked, clarify the specific Endpoint/client combination with IT or Sophos. Make a temporary protection change only if explicitly approved, then re-enable protection and verify that it is active both on the endpoint and in the management console, even if the attempt fails. Profile protection and rollback are covered in the macOS removal workflow; do not kill daemons repeatedly.

Connected but DNS or traffic is not working

First draw a clear dividing line:

• Internal IP address accessible, internal FQDN not: Check DNS server, search domain and profile status. If DNS changes while an IPsec tunnel is active, Sophos Connect will only show the new values ​​after disconnecting and reconnecting.
• After a disconnected full tunnel, web access no longer works: Particularly under macOS, internal DNS servers can remain on the physical adapter. Disconnect and reconnect local Wi-Fi or Ethernet connection. If this is repeated, document the version, profile and time; Do not permanently overwrite DNS manually.
• Neither internal IP nor name accessible: This is not evidence of a client error. Check VPN IP, destination network, return route, NAT and firewall rule on the Sophos Firewall. Check firewall rules with Log Viewer, Policy Test and Packet Capture takes care of this diagnosis.
• Only IPsec setup or SAs fail: The firewall side runbook is Sophos Firewall IPsec VPN Troubleshooting.
• SSL VPN policy or gateway configuration is incorrect: The configuration belongs in Setting up SSL VPN Remote Access, not in a client service workaround.
• Small requests work, large transfers hang: Check MTU/MSS along the path with Check Sophos Firewall MTU and MSS for VPN problems.

Received connection reset from gateway: <gateway name> appears in scvpn.log for SSL VPN when the firewall settings change, an administrator disconnects the user, or Sophos Firewall restarts. Import a current configuration and reconnect. Client logs alone cannot prove which firewall-side action occurred.

Back up logs and technical support reports

To get started, open Events or select Open VPN log from the three-dot menu. Preserve the current failure before restarting: each log is rotated only once. After an endpoint or client restart, for example, the previous session is in openvpn.log.old and the current session is in openvpn.log. The logs have no documented maximum size; .txt files aren’t rotated.

For Received connection reset from gateway, Sophos documents scvpn.log as being in the installation folder but doesn’t publish a version-independent Windows or macOS log-directory path. Don’t guess or hard-code one. Use Open VPN log or the support report so the client resolves the installed location. The macOS service commands above deliberately use the documented absolute path /Library/LaunchDaemons/com.sophos.connect.scvpn.plist.

Sophos Connect generates scvpntsr.zip via three-dot menu > About > Generate technical support report. The report includes VPN configurations, connection events, provisioning details, SSO authentication information, browser details, and endpoint information. This includes the following diagnostic files:

• openvpn.log: SSL VPN connection attempts, status, virtual interface, packet flow and errors.
• charon.log: strongSwan, IKE, ESP, security events, configuration changes and packet flow.
• scvpn.log: Login, connection, disconnection and other VPN events.
• scgui.log: Sophos Connect and OpenVPN versions, WebView2 version information on Windows only, and SSO logins. Do not infer a WebView2 dependency on macOS from this.
• configs.txt: Details of imported .pro, .ovpn and .scx connections; Sophos describes this file as containing no personal information.
• route.txt: Endpoint routing tables.
• ipconfig.txt: IP configuration of the endpoint.
• systeminfo.txt: Endpoint system information.

The statement about the absence of personal information applies only to configs.txt, not to the entire archive, and does not mean that all configuration data it contains is safe to disclose. Store the report as confidential support material in accordance with internal guidelines and provide it only to authorized recipients through the approved transfer channel. Never copy passwords, OTPs, or private keys into ticket text or a public log excerpt.

Additional SCCLI checks on macOS

The documented default location of the SCCLI tool is /Library/Sophos\ Connect/. On a pilot Mac, first check whether the package actually installed contains sccli at that location and which options its local help lists. The following read-only examples show the version and connections; they do not report a macOS runtime test performed here and establish neither MDM deployment nor the portability of Windows scripts:

/Library/Sophos\ Connect/sccli show --version
echo $?
/Library/Sophos\ Connect/sccli list -d
echo $?

Check the status with echo $? immediately after each SCCLI command, before another command overwrites it. Windows Command Prompt uses echo %ERRORLEVEL% instead; that is not macOS syntax. The shell returns the process status, which is not necessarily the unchanged numeric diagnostic code from an internal client message. If the binary is missing or does not start, check the package and installation state; do not interpret the status as a tunnel test.

The error reference lists -1 for invalid options or empty credentials, 1 for invalid input or input that cannot be parsed, 2 for a missing file or an empty password/certificate, 5 for unreadable files, 14 for a response that cannot be parsed, 101 for a failed request, and 120 for missing server data. 1016 requests credentials, 1024 means “connection not found”, 1101 indicates a failed login, and 9009 indicates a command that cannot be found or started. These codes are diagnostic guidance from the reference, not a guarantee that each will appear unchanged as a shell status on macOS. Record the exact message, immediate status, and client version together; for file or connection errors, check the source and names, and for login errors, clarify authorization and authentication with IT rather than repeatedly guessing passwords.

SCCLI also offers add, remove, update, enable, disable, get, and show; this does not imply a newly introduced command set or one tested on every Mac version. State-changing actions are outside this diagnostic example: remove may disconnect an active connection first and cannot remove a managed connection; policies may restrict add, remove, or disable. Auto-connect through add -a is marked as TBD in the source and is not described here as a working rollout method. Never put passwords or OTPs in command arguments, scripts, shell history, or logs. If a separately approved login workflow uses SCCLI, use its interactive prompt rather than the documented password arguments. Read the installed tool’s help for further options; make changes only with a secured profile source, an approved rollback path, and a subsequent VPN test.

Escalate cleanly

An actionable case contains operating system and build, Sophos Connect version, profile type and source, error time with time zone, exact event text, expected destination, result by IP and by name, and scvpntsr.zip. If there is suspicion on the firewall side, the corresponding log viewer excerpt and the relevant IPsec or SSL VPN logs are added; Sophos Firewall Services and Logs classifies them.

Escalate if a service fails again after a single controlled start, the same error is reproducible in a shared profile, certificate identity remains unclear, or client and firewall timestamps conflict. A support case can be submitted in a structured manner using Prepare and open Sophos support ticket.

FAQ