Set up Sophos Firewall Clientless SSL VPN for RDP and SSH

With Clientless SSL VPN, a Sophos Firewall provides individual internal RDP, SSH, VNC, or file server connections directly in the browser. The user does not install a VPN client and does not receive general access to an internal network. Instead, the user signs in to the VPN Portal and sees only the bookmarks published by the applicable clientless policy.

The similar name can easily lead to the wrong configuration: Clientless Users map a fixed internal IP to an identity. They don’t publish bookmarks and aren’t part of this remote access workflow.

Signing in to the VPN Portal and signing in to the target are two separate steps. Clientless SSL VPN does not support credential passthrough: The password for the VPN Portal is not automatically forwarded as the Windows or SSH login. Two logins are therefore normal unless target credentials are stored in the bookmark.

The core process is short:

Define a fixed target system, port, and authorized user group.
Create an RDP or SSH bookmark under Remote access VPN > Clientless SSL VPN policy > Bookmarks.
Connect the user group and bookmark under Policies.
Secure the VPN Portal, certificate, authentication, MFA, and Device Access.
Test access externally under VPN > Clientless access connections with an authorized and an unauthorized user.

When Clientless SSL VPN fits—and when it does not

Clientless Access is particularly suitable for a small number of fixed targets, occasional access, or external technicians when no VPN client should be installed on the device in use. RDP and SSH then do not need to be published directly to the internet through DNAT. Instead, the secured VPN Portal is publicly accessible.

However, it is not a lightweight replacement for every Remote Access VPN:

Clientless SSL VPN is suitable for individual static RDP, SSH, VNC, or file server targets that can be operated in a browser.
Sophos Connect with IPsec or SSL VPN is a better fit when a managed device needs multiple networks, native applications, DNS, or different protocols. The Remote Access decision guide explains the options.
ZTNA is designed for persistent application-specific access with identity, device health, and central policies. The basics are covered in What is Zero Trust Network Access?.
RD Gateway, a jump host, or PAM should be considered when privileged administration, personal target accounts, session recording, or approval workflows are essential.

For RDP, it is also important to note that the clipboard has not been supported in clientless sessions since SFOS 19. If copy and paste or other native RDP functions are essential to the workflow, a client-based or specialized access method is the better choice.

Clientless SSL VPN does not support dynamic target IP addresses. A hostname is allowed as a target, but the firewall must resolve it reliably and it must point to the intended system. A frequently changing target should not be planned as a reliably updated dynamic DNS scenario.

The browser is only the user interface: It establishes the HTTPS connection to the VPN Portal, while the firewall establishes the second connection to the target system. Pop-up blockers must allow the new session window for the portal FQDN. SFOS 22 cannot publish arbitrary internal HTTP or HTTPS applications as clientless bookmarks; use WAF or ZTNA for those applications, depending on the requirements.

Requirements and example values

Before configuration, clarify the target, identity, and portal access:

The target system is reachable from the firewall through routing and DNS, and the required service is running.
A user or, preferably, a narrowly scoped group exists on the firewall or the connected authentication server.
The VPN Portal has a public or internally reachable FQDN and a matching trusted certificate.
A suitable method is selected under VPN portal authentication methods in Authentication > Services.
MFA and an independent recovery method are prepared.
A decision has been made on whether target credentials may be stored in the bookmark.

The following RDP example uses:

VPN Portal: https://vpn.example.com
Target server: rdp-app01.intern.example
Target IP: 10.20.30.25
RDP port: 3389
Bookmark: RDP-Fibu-Test
Group: Clientless-RDP-Fibu
Policy: Clientless-RDP-Fibu
RDP security for the initial test: TLS
Automatic login: disabled
Share session: disabled

example.com is a reserved example domain and 10.20.30.25 is a private example address. Replace the FQDN, IP, group, and names with values from the local environment. Port 3389 is correct only if the Windows server actually uses the standard RDP port.

Set up an RDP bookmark

Create a new bookmark with Add under Remote access VPN > Clientless SSL VPN policy > Bookmarks:

Enter RDP-Fibu-Test under Name.
Select RDP as Type.
Enter rdp-app01.intern.example or the fixed IP 10.20.30.25 under URL.
Use service port 3389. Enter a different port only if it has deliberately been configured differently on the target system.
Leave Automatic login disabled for the initial test.
Enter the Windows network domain if required, for example CORP or corp.example.com.
Select TLS under Protocol security. The third option, RDP, uses the RDP protocol’s own security; Sophos recommends TLS or NLA instead.
Leave Share session disabled.
Select Save.

Without Automatic login, the user enters the credentials in the RDP window that opens. This allows a login with a personal Windows account if the target server’s security model permits this TLS mode.

The VPN Portal certificate and Protocol security: TLS serve different purposes. The portal certificate protects the browser connection to the firewall. The RDP setting protects the downstream connection from the firewall to the Windows system. A valid portal certificate therefore does not replace appropriate RDP security.

When the Windows server requires NLA

Many Windows systems require Network Level Authentication (NLA). In that case, select NLA in the bookmark. SFOS then enables Automatic login, and the username and password for the target system must be stored in the bookmark.

This is not merely a convenience option. All users authorized for this bookmark then work on the target system with the same stored Windows identity. Use only a dedicated, minimally privileged, and rotatable account. Domain admin accounts, personal administrator accounts, and broadly privileged service accounts do not belong in a clientless bookmark.

Do not disable NLA on the Windows server solely to make the TLS example work. If stored credentials or a shared target identity are unacceptable, Clientless RDP is not suitable for this server. A regular VPN, RD Gateway, PAM, or a controlled jump host better preserves personal accountability.

Leave Share session disabled as well. The option is intended for a deliberately planned collaboration scenario. In a shared session, Stop session ends the connection for all participants, while Suspend session pauses only the current user. Sessions should not be shared for privileged administration.

VNC bookmark for Linux and UNIX systems

A VNC bookmark follows the same basic principle but uses Type: VNC. Under URL, enter the target system’s static IP address or a stably resolvable hostname. Only enter a different VNC port if the service is actually listening on a non-standard port.

With Automatic login, SFOS stores the target password in the VNC bookmark. If the option remains off, the user enters the password when opening the connection. A username isn’t configured in a VNC bookmark. Leave Share session disabled for normal individual access and use it only when a shared session is explicitly required.

ℹ️ The VPN Portal login isn’t passed through to the target system for VNC either. A successful portal login therefore proves neither that the VNC password is correct nor that the firewall can reach the VNC service.

Configure the clientless policy and VPN Portal

Connect users and bookmarks in a policy

An existing bookmark alone does not make the target visible to any user. The policy connects the identity and resource:

Open Remote access VPN > Clientless SSL VPN policy.
Select Add under Policies.
Enter Clientless-RDP-Fibu as Name.
Under Policy members, select only the Clientless-RDP-Fibu group.
Under Published bookmarks, select RDP-Fibu-Test.
Select Apply.

A bookmark group is useful only when the same users need multiple targets. For a single RDP target, it only adds another administrative layer.

Secure the VPN Portal

Users open clientless connections through the VPN Portal. The default port is 443; the port and certificate are configured under Administration > Admin and user settings > Admin console and end-user interaction. In this example, the certificate must contain vpn.example.com as a SAN and be accepted by the browser without a warning. Import and assign certificates on Sophos Firewall explains the general certificate assignment.

Under Administration > Device access, VPN portal must be allowed for the access that is actually required. If the portal must be reachable from all WAN sources, enable WAN in the matrix. For known source networks, use the narrower option: Leave WAN disabled in the matrix and create a rule under Local service ACL exception rule with Source zone: WAN, the specific Source Network / Host, the required firewall address as Destination host, Services: VPN portal, and Action: Accept. An additional Accept exception does not narrow an already enabled general WAN matrix permission. This does not automatically permit WebAdmin, User Portal, SSH, or SSL VPN as well. Firewall rules do not control these local services. Device Access and Local Service ACL explains secure planning.

⚠️ A VPN Portal reachable from the WAN is a public login surface. It should not be operated without MFA, a trusted certificate, narrow policy membership, and login monitoring. If the VPN Portal and SSL VPN use the same port, Login security settings do not work. If they also use the same protocol, allowing SSL VPN from a zone also makes the VPN Portal reachable, even if it is disabled for that zone under Device access. Use a unique port-protocol combination for each local service and recheck reachability after every port change.

For local Sophos OTP, first select Specific users and groups under Authentication > Multi-factor authentication. For self-registration with an authenticator app, enable Generate OTP token with next sign-in, select VPN portal under Require MFA for, and save with Apply. This direct VPN Portal QR flow applies to SFOS 22. In SFOS 23, with Generate OTP token with next sign-in enabled, also choose Share QR code before Apply: Email emails the QR code at the next VPN or User Portal sign-in; Portals displays it in User Portal and VPN Portal after the next VPN Portal, User Portal or WebAdmin sign-in. Explicitly select Portals for the portal-scanning example here.

SFOS 22 supports SHA1, SHA256, and SHA512; Sophos recommends SHA256 or SHA512. However, the app must support the selected algorithm: Sophos lists Intercept X for Mobile and Google Authenticator as suitable examples; Microsoft Authenticator can scan a SHA256 or SHA512 QR code, but the subsequent sign-in fails.

When changing the algorithm, delete the existing entries under Issued tokens, then have users scan the QR code again. Before deletion, check that Generate OTP token with next sign-in is enabled for this flow. Reissued QR codes follow the same version distinction: SFOS 22 displays the code at the portal; SFOS 23 uses Email or Portals under Share QR code, keeping Portals selected for this portal example. Enable MFA for Sophos Firewall covers the pilot and recovery path.

The VPN Portal does not support challenge-based RADIUS MFA, so an existing RADIUS method must be tested specifically for this portal login. If the portal should use Microsoft Entra ID SSO and Conditional Access instead, Entra ID SSO for Sophos Connect and VPN Portal explains the complete identity chain.

Under Authentication > Services, you can select no more than 20 servers for each authentication method. The global Maximum session timeout and Simultaneous logins settings do not apply only to the VPN Portal. SFOS checks authorization every three minutes, and the simultaneous-login restriction only applies to users added after you set the value. Do not treat these limits as immediate, portal-specific access controls.

Test external access

Test from a genuinely external network, for example through a mobile hotspot. A test from the LAN does not prove that DNS, the certificate, Device Access, and an upstream router work correctly from the internet.

Open https://vpn.example.com in a private browser window.
Check the certificate name, certificate chain, and browser status.
Sign in with a member of Clientless-RDP-Fibu and complete MFA.
Under VPN > Clientless access connections, verify that RDP-Fibu-Test appears.
Select Connect. The session must open in a new browser window.
With Automatic login disabled, enter the personal Windows credentials and verify the RDP login.
Sign out cleanly from the Windows system, then leave the VPN Portal.
Test with a user outside the group. The bookmark must not appear for that user.
As a test, remove the test user from the policy group and verify that access disappears after a new login.

Success means more than seeing a desktop. The positive-test user sees exactly the intended bookmarks, the negative-test user sees none, MFA is enforced, the certificate is trusted, the target login works, and the session ends traceably on both the portal and target system.

Use session and keyboard controls in the browser

In RDP, VNC, SSH, and Telnet sessions, move the pointer to the top of the remote screen to reveal the session options. Connection provides Stop session and Suspend session. After Suspend session, the same user resumes the session the next time they select Connect in the VPN Portal. Other participants in a shared session continue working; Stop session, in contrast, ends it for all participants.

For RDP and VNC connections, Keyboard lets users select keyboard shortcuts and change the keyboard language. To apply a listed language other than English, the documented workflow requires the target server’s language to be set to US English. This prerequisite concerns the language selection under Keyboard, not clipboard support.

SSH, VNC, and file server options

SSH bookmark with a verified host key

For SSH, select SSH as Type under Bookmarks > Add. This example uses srv-linux01.intern.example, port 22, and the user clientless-test.

The Public host key must belong to the expected server. On a Linux target, display the public host key directly at the trusted server console and document its fingerprint:

sudo cat /etc/ssh/ssh_host_ed25519_key.pub
sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Run these commands on the Linux target server, not on the Sophos Firewall. If the server uses a different host key type, adjust the filename accordingly. Do not blindly accept a key from an unverified browser warning or an arbitrary network scan.

The first command displays the public ED25519 host key as an identification example at the trusted target console. This does not confirm that the installed clientless SSH build accepts ED25519 or the displayed OpenSSH representation under Public host key. Before inserting it, confirm both the accepted algorithm and serialized public-key representation using official clientless SSH documentation applicable to that build or Sophos Support. Linux SSH support, WebAdmin SSH settings, SFTP and identical source texts do not establish this field compatibility. The second command only displays the fingerprint for the documented comparison; do not paste the fingerprint into the field instead of the key.

Then create the complete SSH bookmark:

Under Name, enter SSH-Linux-Test, for example.
Select SSH as Type.
Enter srv-linux01.intern.example under URL and 22 as the port.
Under Username, enter clientless-test or the intended target user.
Leave Automatic login disabled if the user should enter the target password personally.
Paste the public host key verified directly on the target system under Public host key only after confirming the algorithm and representation for the installed clientless SSH build.
Leave Share session disabled and select Save.
Add the bookmark to Published bookmarks in the clientless policy and select Apply.
In the VPN Portal, select Connect under VPN > Clientless access connections, enter the target password, and verify that the expected terminal prompt appears. Then close the SSH session cleanly.

Without Automatic login, the user enters the target password when connecting; the username remains part of the bookmark. Different personal SSH usernames therefore require separate bookmarks or another access method. With Automatic login, SFOS can use a password or private key. Privileged or widely used private keys should not be stored in a shared published bookmark.

File servers with FTP, FTPS, SFTP, or SMB

File server bookmarks are also created under Remote access VPN > Clientless SSL VPN policy > Bookmarks > Add. Available values for Type are FTP, FTPS, SFTP, and SMB. URL contains a static IP address or stable hostname; Clientless SSL VPN doesn’t support dynamic target addresses. Under Init remote folder, you can optionally specify the folder in which the user starts after connecting.

The methods mainly differ in transport and target authentication:

FTP, FTPS, and SMB can be used with or without Automatic login. Without stored credentials, the user signs in to the target system after opening the bookmark. FTP transmits data without encryption and shouldn’t be used for new external workflows.
For SMB, you can also optionally enter the Windows network domain to which the target account and system belong, for example CORP, corp.example, or corp.example.com. Replace these examples with the actual domain in your environment.
FTPS protects the FTP connection with TLS. Under Public host key, also store the expected server certificate in .pem format. Verify the certificate and name directly on the managed target system rather than accepting them from an unverified connection.
SFTP uses SSH. The bookmark contains the target username and, under Authentication method, either Password or Private key with the corresponding target credential. Public host key is used to verify the server’s identity. The private user key and the public server host key serve different purposes and must not be confused.

⚠️ The SFTP input format for Public host key remains unclear: The SFOS 22 and 23 file server instructions specify a server certificate in .pem format, whereas the separate SSH instructions require a public server key. This establishes neither an X.509 requirement nor confirmed acceptance of OpenSSH or ED25519 values in the SFTP field. The SSH commands above are therefore not an SFTP format guide. Before production use, clarify the accepted SFTP representation for the installed build with Sophos Support and verify the server’s identity directly on the trusted target system; do not convert formats by guesswork or bypass identity verification.

For file server bookmarks too, set a different service port only if the corresponding service on the target server actually uses a non-default port.

With Automatic login, the target system’s username and password are stored in the bookmark for FTP, FTPS, and SMB. All authorized users then use this stored target identity, so the same least-privilege and rotation requirements apply as in the NLA example. This is not credential passthrough from the VPN Portal.

In this SFTP workflow, SFOS automatically authenticates with the target credentials stored in the bookmark. The user is not prompted for the target password; the optional interactive login available for SSH and FTP, FTPS, and SMB does not apply to SFTP.

In the browser, FTP, FTPS, and SFTP sessions allow users to transfer files, create folders, and navigate directories. SFOS starts downloads without another prompt and saves them in the endpoint’s default download folder. For that reason, validate permissions, the initial folder, and a test with non-sensitive files before production use. A file server bookmark doesn’t create a regular Windows network drive and doesn’t replace personal authorization checks on the target server.

The buttons in the upper-right corner of FTP, FTPS, and SFTP sessions let users stop the session, upload a file, create a folder, and go to the parent folder.

For Telnet, select Telnet as Type under Bookmarks > Add, then enter the fixed target host under URL; only set a port if it differs from the service default. Share session is optional. Telnet provides neither transport encryption nor a verifiable SSH host key, so don’t use it for new access or across untrusted networks. If a legacy device requires temporary access, restrict it to a narrow group and an isolated management target, then replace Telnet with SSH. HTTP and HTTPS bookmarks aren’t among the currently documented clientless types for SFOS 22. Depending on the protection requirements, Web Application Firewall or ZTNA is the more suitable architecture for internal web applications.

When the same targets must be assigned to multiple policies, create a group under Bookmark groups > Add: enter a group name under Name, select the existing bookmarks with Add new item, and save with Save. The policy then publishes the group instead of each target individually. A bookmark group doesn’t extend permissions on the target system; it only simplifies assignment in SFOS.

When creating or updating a group through the XML API, the entity is SSLBookmarkGroup. The API documentation for SFOS 23.0 allows UTF-8 characters in its Name, prohibits commas and retains the maximum of 50 characters. The SFOS 22.0 documentation already specifies this maximum but not the two additional character rules; this does not establish how older builds enforce them. A suitable example name is Clientless-München, as in <Name>Clientless-München</Name>; adapt the name to your environment. After the API call, inspect the status code and message in the XML response and read back the saved group: its name and bookmarks must match the intended membership. This note concerns the group name in the API, not a blanket rule for individual bookmark names; in the UI described above, follow the field requirements of the installed build.

Individual bookmarks through the XML API: The Add/Edit example for SSLBookmark in SFOS 22.0 and 23.0 is a reference with type-specific branches, not a single payload that can be executed for all protocols. The values HTTP and HTTPS it contains establish neither current UI support nor support in the installed build. In the example, NLA requires AutoLogin to be enabled; for SSH/SFTP, the comment describes a password or private key as alternatives when AutoLogin is enabled. This does not override the SSH host key and SFTP format boundaries described above or imply an interactive SFTP login.

However, the parameter table marks Private Key, Public Host Key and UserName as mandatory without qualifying this by type. It restricts URL to hostname-style characters, while the second Domains row, for a list of referred domains/URLs, requires entries to start with HTTP:// or HTTPS://. In the example, this list appears under the literal token RefferredDomains; it is not the Windows domain Domain for RDP/SMB, even though the table also contains an RDP row named Domains. Do not rename tokens by guesswork or combine the conflicting table rules into a universal payload. Before an automated change, clarify the accepted fields, conditions and representations for the type and installed build using the applicable official documentation or Sophos Support; do not execute the unconfirmed mutation until then. Beforehand, save the actual bookmark and its assignments as the baseline; afterwards, check the XML status and message and read back the saved bookmark, group membership and publication. If there are discrepancies, roll back only your own change to that exact baseline and repeat the access tests; do not include passwords or private keys in audit output or unprotected payload files.

Troubleshoot common issues

VPN Portal is unreachable: Check the public DNS record, port, upstream NAT, Administration > Device access, and possible port-sharing behavior.
Portal login fails: Under Authentication > Services, check VPN Portal authentication, user status, MFA, and access_server.log.
Clientless access connections is missing: The user is not assigned to a clientless policy, or the policy does not publish a bookmark.
The bookmark is visible to the wrong user: Check Policy members, group memberships, and Published bookmarks. If several groups match, Clientless SSL VPN can combine the permissions from the corresponding policies. The positive and negative tests must verify which bookmarks a real user consequently sees.
The bookmark opens, but the target remains unreachable: Check DNS resolution from the firewall’s perspective, the static target address, routing, target port, service status, and host firewall.
VPN Portal login works, but Windows login does not: The portal and target logins are separate. Check the domain, target account, password, and TLS or NLA.
NLA enables Automatic login: This is the documented behavior. Do not disable NLA without planning; reassess the account and access model instead.
SSH reports a different host key: Stop the connection and verify the change directly on the target system or with the responsible operator. An unexpected key can indicate a reinstallation, the wrong target, or an attack.

Under Diagnostics > Tools > Troubleshooting logs, different files help with different stages:

vpnportal.log for the VPN Portal;
access_server.log for authentication and authorization;
clientless_access.log for clientless connections and establishing the target connection;
oauth_sso_vpn.log in SFOS 22 for VPN Portal logins using SSO; in SFOS 23, oauth_sso_svc.log for VPN Portal OIDC/Entra SSO. Also check the Authentication module in Log viewer for these VPN Portal sign-ins.

Document the test time, user, bookmark, and target together. This makes it possible to distinguish portal, identity, and target problems in the logs. Sophos Firewall service logs explains the general log assignment and access through Advanced Shell.

Before a production change, record the existing policy assignment, Device Access matrix, ACL exceptions, portal port, and certificate selection. If the positive test fails or the negative-test user sees a bookmark, do not broaden access: Remove the new policy assignment or bookmark publication, restore changed portal and ACL values to the recorded prior state, sign in again, and repeat the negative test. Only roll back target accounts or host keys separately if this change actually modified them.

Operation and known RDP limitations

Review clientless policies regularly like other Remote Access permissions. Remove users, bookmarks, and target accounts that are no longer required. Stored passwords or private keys need an owner, an expiry date, and a rotation process. Include Automatic login and Share session in every access review.

Withdrawing publication is not deletion: Before removal, clarify whether an individual bookmark or a Bookmark Group is intended, and record the exact name, current group membership and publication in all affected policies. First withdraw only the publication or assignment that is no longer wanted; this does not delete the object. Delete the exact object only when it is genuinely unused and its dependencies have been clarified. If relationships remain, stop and do not cascade-delete production groups or policies merely to force removal.

The Delete references for SFOS 22.0 and 23.0 each require Name with a maximum of 50 characters and list the XML status values 200, 500 and 504. For 504, they refer to BookMarkDeleteRelationExists for bookmarks and BookMarkGroupDeleteRelationExists for groups: these are unresolved message identifiers, not confirmed runtime message texts or an HTTP status. The references provide neither an example Delete payload nor any assurance about cascading; do not derive deletion syntax from them. After the change, actually read back the remaining bookmarks, groups and intended publications, and repeat the positive and negative tests. If unexpected access occurs, restore your own assignment changes to the recorded baseline; for this reason, avoid unnecessary object deletions when merely withdrawing publication.

For a live view of signed-in remote users, open Current activities > Remote users in the admin console. You can filter connections by connection date, username, source IP address, and leased IP address. An administrator can select Disconnect to disconnect the selected remote user. Check the user and connection first because this interrupts access. It does not replace removing the user from the clientless policy or signing out cleanly on the target system, and it does not guarantee that every downstream target session has ended.

The documentation for the Mode column distinguishes the following cases:

SSL VPN (remote access): The user is connected through remote access SSL VPN.
User portal (clientless access): According to this mapping, the user is signed in to the User Portal and is a member of a clientless SSL VPN policy.
User portal: According to this mapping, the user is signed in to the User Portal but is not a member of a clientless SSL VPN policy.

These labels come from the SFOS 22 and 23 Remote users instructions. The clientless instructions instead specify the VPN portal as the access path. The terminology is therefore inconsistent; the list confirms neither the current Mode labels of the installed build nor a change from SFOS 22 to 23. Continue to use the VPN Portal setup described above. Check portal sign-in, policy membership, and actual bookmark visibility separately rather than inferring authorization from a Mode label alone.

Before changing firmware, use the Avanet firmware decision runbook to identify changes affecting the installed build and target release. Include Clientless Access, VPN portal, RDP, and the authentication method in the review. Repeat the complete positive and negative test after the upgrade.

RDP has two current limitations that should not be treated as configuration errors:

The clipboard has not been supported in clientless RDP bookmarks since SFOS 19. Copy and paste between the local device and the RDP session is therefore not a reliable workflow.
The mouse pointer can appear as a cross or X instead of a normal arrow in the HTML5 RDP session. Sophos currently lists no workaround.

If the clipboard, native RDP functions, broader network access, or personal target accounts on an NLA-enforced server without stored credentials are essential, Clientless SSL VPN is not the right shortcut. Deliberately move access to Sophos Connect, RD Gateway, PAM, a jump host, or ZTNA instead.