Skip to content
Avanet

Set up Sophos Firewall Clientless SSL VPN for RDP and SSH

Sophos Firewall

With Clientless SSL VPN, a Sophos Firewall provides individual internal RDP, SSH, VNC, or file server connections directly in the browser. The user does not install a VPN client and does not receive general access to an internal network. Instead, the user signs in to the VPN Portal and sees only the bookmarks published by the applicable clientless policy.

The similar name can easily lead to the wrong configuration: Clientless Users map a fixed internal IP to an identity. They don’t publish bookmarks and aren’t part of this remote access workflow.

Signing in to the VPN Portal and signing in to the target are two separate steps. Clientless SSL VPN does not support credential passthrough: The password for the VPN Portal is not automatically forwarded as the Windows or SSH login. Two logins are therefore normal unless target credentials are stored in the bookmark.

The core process is short:

  1. Define a fixed target system, port, and authorized user group.
  2. Create an RDP or SSH bookmark under Remote access VPN > Clientless SSL VPN policy > Bookmarks.
  3. Connect the user group and bookmark under Policies.
  4. Secure the VPN Portal, certificate, authentication, MFA, and Device Access.
  5. Test access externally under VPN > Clientless access connections with an authorized and an unauthorized user.

When Clientless SSL VPN fits—and when it does not

Clientless Access is particularly suitable for a small number of fixed targets, occasional access, or external technicians when no VPN client should be installed on the device in use. RDP and SSH then do not need to be published directly to the internet through DNAT. Instead, the secured VPN Portal is publicly accessible.

However, it is not a lightweight replacement for every Remote Access VPN:

  • Clientless SSL VPN is suitable for individual static RDP, SSH, VNC, or file server targets that can be operated in a browser.
  • Sophos Connect with IPsec or SSL VPN is a better fit when a managed device needs multiple networks, native applications, DNS, or different protocols. The Remote Access decision guide explains the options.
  • ZTNA is designed for persistent application-specific access with identity, device health, and central policies. The basics are covered in What is Zero Trust Network Access?.
  • RD Gateway, a jump host, or PAM should be considered when privileged administration, personal target accounts, session recording, or approval workflows are essential.

For RDP, it is also important to note that the clipboard has not been supported in clientless sessions since SFOS 19. If copy and paste or other native RDP functions are essential to the workflow, a client-based or specialized access method is the better choice.

Clientless SSL VPN does not support dynamic target IP addresses. A hostname is allowed as a target, but the firewall must resolve it reliably and it must point to the intended system. A frequently changing target should not be planned as a reliably updated dynamic DNS scenario.

The browser is only the user interface: It establishes the HTTPS connection to the VPN Portal, while the firewall establishes the second connection to the target system. Pop-up blockers must allow the new session window for the portal FQDN. SFOS 22 cannot publish arbitrary internal HTTP or HTTPS applications as clientless bookmarks; use WAF or ZTNA for those applications, depending on the requirements.

Requirements and example values

Before configuration, clarify the target, identity, and portal access:

  • The target system is reachable from the firewall through routing and DNS, and the required service is running.
  • A user or, preferably, a narrowly scoped group exists on the firewall or the connected authentication server.
  • The VPN Portal has a public or internally reachable FQDN and a matching trusted certificate.
  • A suitable method is selected under VPN portal authentication methods in Authentication > Services.
  • MFA and an independent recovery method are prepared.
  • A decision has been made on whether target credentials may be stored in the bookmark.

The following RDP example uses:

  • VPN Portal: https://vpn.example.com
  • Target server: rdp-app01.intern.example
  • Target IP: 10.20.30.25
  • RDP port: 3389
  • Bookmark: RDP-Fibu-Test
  • Group: Clientless-RDP-Fibu
  • Policy: Clientless-RDP-Fibu
  • RDP security for the initial test: TLS
  • Automatic login: disabled
  • Share session: disabled

example.com is a reserved example domain and 10.20.30.25 is a private example address. Replace the FQDN, IP, group, and names with values from the local environment. Port 3389 is correct only if the Windows server actually uses the standard RDP port.

Set up an RDP bookmark

Bookmark with TLS and a personal target login

Create a new bookmark with Add under Remote access VPN > Clientless SSL VPN policy > Bookmarks:

  1. Enter RDP-Fibu-Test under Name.
  2. Select RDP as Type.
  3. Enter rdp-app01.intern.example or the fixed IP 10.20.30.25 under URL.
  4. Use service port 3389. Enter a different port only if it has deliberately been configured differently on the target system.
  5. Leave Automatic login disabled for the initial test.
  6. Enter the Windows network domain if required, for example CORP or corp.example.com.
  7. Select TLS under Protocol security. The third option, RDP, uses the RDP protocol’s own security; Sophos recommends TLS or NLA instead.
  8. Leave Share session disabled.
  9. Select Save.

Without Automatic login, the user enters the credentials in the RDP window that opens. This allows a login with a personal Windows account if the target server’s security model permits this TLS mode.

The VPN Portal certificate and Protocol security: TLS serve different purposes. The portal certificate protects the browser connection to the firewall. The RDP setting protects the downstream connection from the firewall to the Windows system. A valid portal certificate therefore does not replace appropriate RDP security.

When the Windows server requires NLA

Many Windows systems require Network Level Authentication (NLA). In that case, select NLA in the bookmark. SFOS then enables Automatic login, and the username and password for the target system must be stored in the bookmark.

This is not merely a convenience option. All users authorized for this bookmark then work on the target system with the same stored Windows identity. Use only a dedicated, minimally privileged, and rotatable account. Domain admin accounts, personal administrator accounts, and broadly privileged service accounts do not belong in a clientless bookmark.

Do not disable NLA on the Windows server solely to make the TLS example work. If stored credentials or a shared target identity are unacceptable, Clientless RDP is not suitable for this server. A regular VPN, RD Gateway, PAM, or a controlled jump host better preserves personal accountability.

Leave Share session disabled as well. The option is intended for a deliberately planned collaboration scenario. In a shared session, Stop session ends the connection for all participants, while Suspend session pauses only the current user. Sessions should not be shared for privileged administration.

VNC bookmark for Linux and UNIX systems

A VNC bookmark follows the same basic principle but uses Type: VNC. Under URL, enter the target system’s static IP address or a stably resolvable hostname. Only enter a different VNC port if the service is actually listening on a non-standard port.

With Automatic login, SFOS stores the target password in the VNC bookmark. If the option remains off, the user enters the password when opening the connection. A username isn’t configured in a VNC bookmark. Leave Share session disabled for normal individual access and use it only when a shared session is explicitly required.

ℹ️ The VPN Portal login isn’t passed through to the target system for VNC either. A successful portal login therefore proves neither that the VNC password is correct nor that the firewall can reach the VNC service.

Configure the clientless policy and VPN Portal

Connect users and bookmarks in a policy

An existing bookmark alone does not make the target visible to any user. The policy connects the identity and resource:

  1. Open Remote access VPN > Clientless SSL VPN policy.
  2. Select Add under Policies.
  3. Enter Clientless-RDP-Fibu as Name.
  4. Under Policy members, select only the Clientless-RDP-Fibu group.
  5. Under Published bookmarks, select RDP-Fibu-Test.
  6. Select Apply.

A bookmark group is useful only when the same users need multiple targets. For a single RDP target, it only adds another administrative layer.

Secure the VPN Portal

Users open clientless connections through the VPN Portal. The default port is 443; the port and certificate are configured under Administration > Admin and user settings > Admin console and end-user interaction. In this example, the certificate must contain vpn.example.com as a SAN and be accepted by the browser without a warning. Import and assign certificates on Sophos Firewall explains the general certificate assignment.

Under Administration > Device access, VPN portal must be allowed for the access that is actually required. If the portal must be reachable from all WAN sources, enable WAN in the matrix. For known source networks, use the narrower option: Leave WAN disabled in the matrix and create a rule under Local service ACL exception rule with Source zone: WAN, the specific Source Network / Host, the required firewall address as Destination host, Services: VPN portal, and Action: Accept. An additional Accept exception does not narrow an already enabled general WAN matrix permission. This does not automatically permit WebAdmin, User Portal, SSH, or SSL VPN as well. Firewall rules do not control these local services. Device Access and Local Service ACL explains secure planning.

⚠️ A VPN Portal reachable from the WAN is a public login surface. It should not be operated without MFA, a trusted certificate, narrow policy membership, and login monitoring. If the VPN Portal and SSL VPN use the same port, Login security settings do not work. If they also use the same protocol, allowing SSL VPN from a zone also makes the VPN Portal reachable, even if it is disabled for that zone under Device access. Use a unique port-protocol combination for each local service and recheck reachability after every port change.

For local Sophos OTP, first select Specific users and groups under Authentication > Multi-factor authentication. For self-registration with an authenticator app, enable Generate OTP token with next sign-in, select VPN portal under Require MFA for, and save with Apply. The user can then scan the QR code on the VPN Portal. SFOS 22 supports SHA1, SHA256, and SHA512; Sophos recommends SHA256 or SHA512. However, the app must support the selected algorithm: Sophos lists Intercept X for Mobile and Google Authenticator as suitable examples; Microsoft Authenticator can scan a SHA256 or SHA512 QR code, but the subsequent sign-in fails. When changing the algorithm, delete the existing entries under Issued tokens, then have users scan the QR code again. Enable MFA for Sophos Firewall covers the pilot and recovery path. The VPN Portal does not support challenge-based RADIUS MFA, so an existing RADIUS method must be tested specifically for this portal login. If the portal should use Microsoft Entra ID SSO and Conditional Access instead, Entra ID SSO for Sophos Connect and VPN Portal explains the complete identity chain.

Under Authentication > Services, you can select no more than 20 servers for each authentication method. The global Maximum session timeout and Simultaneous logins settings do not apply only to the VPN Portal. SFOS checks authorization every three minutes, and the simultaneous-login restriction only applies to users added after you set the value. Do not treat these limits as immediate, portal-specific access controls.

Test external access

Test from a genuinely external network, for example through a mobile hotspot. A test from the LAN does not prove that DNS, the certificate, Device Access, and an upstream router work correctly from the internet.

  1. Open https://vpn.example.com in a private browser window.
  2. Check the certificate name, certificate chain, and browser status.
  3. Sign in with a member of Clientless-RDP-Fibu and complete MFA.
  4. Under VPN > Clientless access connections, verify that RDP-Fibu-Test appears.
  5. Select Connect. The session must open in a new browser window.
  6. With Automatic login disabled, enter the personal Windows credentials and verify the RDP login.
  7. Sign out cleanly from the Windows system, then leave the VPN Portal.
  8. Test with a user outside the group. The bookmark must not appear for that user.
  9. As a test, remove the test user from the policy group and verify that access disappears after a new login.

Success means more than seeing a desktop. The positive-test user sees exactly the intended bookmarks, the negative-test user sees none, MFA is enforced, the certificate is trusted, the target login works, and the session ends traceably on both the portal and target system.

Use session and keyboard controls in the browser

In RDP, VNC, SSH, and Telnet sessions, move the pointer to the top of the remote screen to reveal the session options. Connection provides Stop session and Suspend session. After Suspend session, the same user resumes the session the next time they select Connect in the VPN Portal. Other participants in a shared session continue working; Stop session, in contrast, ends it for all participants.

For RDP and VNC connections, Keyboard lets users select keyboard shortcuts and change the keyboard language. To apply a listed language other than English, the documented workflow requires the target server’s language to be set to US English. This prerequisite concerns the language selection under Keyboard, not clipboard support.

SSH, VNC, and file server options

SSH bookmark with a verified host key

For SSH, select SSH as Type under Bookmarks > Add. This example uses srv-linux01.intern.example, port 22, and the user clientless-test.

The Public host key must belong to the expected server. On a Linux target, display the public host key directly at the trusted server console and document its fingerprint:

sudo cat /etc/ssh/ssh_host_ed25519_key.pub
sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Run these commands on the Linux target server, not on the Sophos Firewall. If the server uses a different host key type, adjust the filename accordingly. Do not blindly accept a key from an unverified browser warning or an arbitrary network scan.

The first command outputs the public ED25519 host key that is pasted into Public host key in the bookmark. The second command only displays the fingerprint for the documented comparison; do not paste the fingerprint into the field instead of the key.

Then create the complete SSH bookmark:

  1. Under Name, enter SSH-Linux-Test, for example.
  2. Select SSH as Type.
  3. Enter srv-linux01.intern.example under URL and 22 as the port.
  4. Under Username, enter clientless-test or the intended target user.
  5. Leave Automatic login disabled if the user should enter the target password personally.
  6. Paste the public host key verified directly on the target system under Public host key.
  7. Leave Share session disabled and select Save.
  8. Add the bookmark to Published bookmarks in the clientless policy and select Apply.
  9. In the VPN Portal, select Connect under VPN > Clientless access connections, enter the target password, and verify that the expected terminal prompt appears. Then close the SSH session cleanly.

Without Automatic login, the user enters the target password when connecting; the username remains part of the bookmark. Different personal SSH usernames therefore require separate bookmarks or another access method. With Automatic login, SFOS can use a password or private key. Privileged or widely used private keys should not be stored in a shared published bookmark.

File servers with FTP, FTPS, SFTP, or SMB

File server bookmarks are also created under Remote access VPN > Clientless SSL VPN policy > Bookmarks > Add. Available values for Type are FTP, FTPS, SFTP, and SMB. URL contains a static IP address or stable hostname; Clientless SSL VPN doesn’t support dynamic target addresses. Under Init remote folder, you can optionally specify the folder in which the user starts after connecting.

The methods mainly differ in transport and target authentication:

  • FTP, FTPS, and SMB can be used with or without Automatic login. Without stored credentials, the user signs in to the target system after opening the bookmark. FTP transmits data without encryption and shouldn’t be used for new external workflows.
  • For SMB, you can also optionally enter the Windows network domain to which the target account and system belong, for example CORP, corp.example, or corp.example.com. Replace these examples with the actual domain in your environment.
  • FTPS protects the FTP connection with TLS. Under Public host key, also store the expected server certificate in .pem format. Verify the certificate and name directly on the managed target system rather than accepting them from an unverified connection.
  • SFTP uses SSH. The bookmark contains the target username and either a password or a private key. Under Public host key, store the server’s verified public host key. The private user key and the public server host key serve different purposes and must not be confused.

With Automatic login, the target system’s username and password are stored in the bookmark for FTP, FTPS, and SMB. All authorized users then use this stored target identity, so the same least-privilege and rotation requirements apply as in the NLA example. This is not credential passthrough from the VPN Portal.

In this SFTP workflow, SFOS automatically authenticates with the target credentials stored in the bookmark. The user is not prompted for the target password; the optional interactive login available for SSH and FTP, FTPS, and SMB does not apply to SFTP.

In the browser, FTP, FTPS, and SFTP sessions allow users to transfer files, create folders, and navigate directories. SFOS starts downloads without another prompt and saves them in the endpoint’s default download folder. For that reason, validate permissions, the initial folder, and a test with non-sensitive files before production use. A file server bookmark doesn’t create a regular Windows network drive and doesn’t replace personal authorization checks on the target server.

The buttons in the upper-right corner of FTP, FTPS, and SFTP sessions let users stop the session, upload a file, create a folder, and go to the parent folder.

For Telnet, select Telnet as Type under Bookmarks > Add, then enter the fixed target host under URL; only set a port if it differs from the service default. Share session is optional. Telnet provides neither transport encryption nor a verifiable SSH host key, so don’t use it for new access or across untrusted networks. If a legacy device requires temporary access, restrict it to a narrow group and an isolated management target, then replace Telnet with SSH. HTTP and HTTPS bookmarks aren’t among the currently documented clientless types for SFOS 22. Depending on the protection requirements, Web Application Firewall or ZTNA is the more suitable architecture for internal web applications.

When the same targets must be assigned to multiple policies, create a group under Bookmark groups > Add and add the existing bookmarks with Add new item. The policy then publishes the group instead of each target individually. A bookmark group doesn’t extend permissions on the target system; it only simplifies assignment in SFOS.

When creating or updating a group through the XML API, the entity is SSLBookmarkGroup. The API documentation for SFOS 23.0 allows UTF-8 characters in its Name, prohibits commas and retains the maximum of 50 characters. The SFOS 22.0 documentation already specifies this maximum but not the two additional character rules; this does not establish how older builds enforce them. A suitable example name is Clientless-München, as in <Name>Clientless-München</Name>; adapt the name to your environment. After the API call, inspect the status code and message in the XML response and read back the saved group: its name and bookmarks must match the intended membership. This note concerns the group name in the API, not a blanket rule for individual bookmark names; in the UI described above, follow the field requirements of the installed build.

Troubleshoot common issues

  • VPN Portal is unreachable: Check the public DNS record, port, upstream NAT, Administration > Device access, and possible port-sharing behavior.
  • Portal login fails: Under Authentication > Services, check VPN Portal authentication, user status, MFA, and access_server.log.
  • Clientless access connections is missing: The user is not assigned to a clientless policy, or the policy does not publish a bookmark.
  • The bookmark is visible to the wrong user: Check Policy members, group memberships, and Published bookmarks. If several groups match, Clientless SSL VPN can combine the permissions from the corresponding policies. The positive and negative tests must verify which bookmarks a real user consequently sees.
  • The bookmark opens, but the target remains unreachable: Check DNS resolution from the firewall’s perspective, the static target address, routing, target port, service status, and host firewall.
  • VPN Portal login works, but Windows login does not: The portal and target logins are separate. Check the domain, target account, password, and TLS or NLA.
  • NLA enables Automatic login: This is the documented behavior. Do not disable NLA without planning; reassess the account and access model instead.
  • SSH reports a different host key: Stop the connection and verify the change directly on the target system or with the responsible operator. An unexpected key can indicate a reinstallation, the wrong target, or an attack.

Under Diagnostics > Tools > Troubleshooting logs, different files help with different stages:

  • vpnportal.log for the VPN Portal;
  • access_server.log for authentication and authorization;
  • clientless_access.log for clientless connections and establishing the target connection;
  • oauth_sso_vpn.log for VPN Portal logins using SSO.

Document the test time, user, bookmark, and target together. This makes it possible to distinguish portal, identity, and target problems in the logs. Sophos Firewall service logs explains the general log assignment and access through Advanced Shell.

Before a production change, record the existing policy assignment, Device Access matrix, ACL exceptions, portal port, and certificate selection. If the positive test fails or the negative-test user sees a bookmark, do not broaden access: Remove the new policy assignment or bookmark publication, restore changed portal and ACL values to the recorded prior state, sign in again, and repeat the negative test. Only roll back target accounts or host keys separately if this change actually modified them.

Operation and known RDP limitations

Review clientless policies regularly like other Remote Access permissions. Remove users, bookmarks, and target accounts that are no longer required. Stored passwords or private keys need an owner, an expiry date, and a rotation process. Include Automatic login and Share session in every access review.

For a live view of signed-in remote users, open Current activities > Remote users in the admin console. You can filter connections by connection date, username, source IP address, and leased IP address. An administrator can select Disconnect to disconnect the selected remote user. Check the user and connection first because this interrupts access. It does not replace removing the user from the clientless policy or signing out cleanly on the target system, and it does not guarantee that every downstream target session has ended.

Before changing firmware, use the Avanet firmware decision runbook to identify changes affecting the installed build and target release. Include Clientless Access, VPN portal, RDP, and the authentication method in the review. Repeat the complete positive and negative test after the upgrade.

RDP has two current limitations that should not be treated as configuration errors:

  • The clipboard has not been supported in clientless RDP bookmarks since SFOS 19. Copy and paste between the local device and the RDP session is therefore not a reliable workflow.
  • The mouse pointer can appear as a cross or X instead of a normal arrow in the HTML5 RDP session. Sophos currently lists no workaround.

If the clipboard, native RDP functions, broader network access, or personal target accounts on an NLA-enforced server without stored credentials are essential, Clientless SSL VPN is not the right shortcut. Deliberately move access to Sophos Connect, RD Gateway, PAM, a jump host, or ZTNA instead.