Skip to content
Avanet

Set up Sophos Firewall IPsec VPN on iPhone

Sophos Firewall

For native remote access IPsec on iPhone, download the iOS profile directly from the Sophos Firewall VPN Portal and install it in the system settings. Sophos Connect and OpenVPN Connect are not the import route for this. The .ovpn file and the separate guide for SSL VPN on iPhone and iPad belong to a different protocol.

The quick route is: check the iOS version and approval, sign in to the VPN Portal in Safari, open VPN > VPN configuration > IPsec VPN profile > Download for iOS, check and install the profile, then verify the VPN status and permitted internal destinations. A successful download alone does not mean the connection works.

Before downloading: clarify the version and permissions

The administrator must have configured remote access IPsec and assigned the appropriate policy to the user. Without this configuration, the iOS IPsec download does not appear. A visible SSL VPN download does not prove IPsec permission. Configure Sophos Connect on Sophos Firewall explains the firewall-side preparation; its desktop profiles .scx and .pro are not used here.

Before installation, record:

  • the SFOS build and iOS version in use, and the administrator’s approval of this combination;
  • the exact portal address, user, authentication method and expected profile name;
  • the permitted internal application, internal DNS names and intended split-tunnel or full-tunnel behaviour;
  • existing VPN profiles and whether the iPhone is managed through MDM;
  • where the installed iOS version displays profile installation and VPN connection status, and how to disconnect this specific tunnel.

The following Apple menu labels are given in English; they may differ on a device using another language. Apple describes installed profiles under Settings > General > VPN & Device Management. Establish the location of the VPN switch in advance for the version actually in use. If profile installation is blocked on a managed device, contact the administrator rather than removing management or security features.

The native client must support the intended authentication method. A Windows guide for Sophos Connect with OIDC or Entra SSO does not establish support for native iOS IPsec. Assess MFA for VPN Portal and remote access separately for the portal and the tunnel. If the required second factor cannot be implemented securely in the native workflow, stop the rollout and choose an approved alternative; do not disable MFA to troubleshoot the problem.

Obtain and install the profile in Safari

  1. In Safari, open the VPN Portal address confirmed by the administrator. Example: https://vpn.example.com:443. vpn.example.com is a placeholder for your own portal FQDN; 443 is the default port. Use a different port only as instructed by the administrator. Resolve certificate warnings before downloading; do not bypass them permanently.
  2. Sign in with your own VPN user account and confirm the intended second factor. Open VPN, then tap Download for iOS under VPN configuration > IPsec VPN profile. This is neither the mobile SSL VPN download nor a Windows client package.
  3. Approve the download shown only if it is for the expected profile. In Settings, open Profile Downloaded. Check the profile’s origin, organisation, VPN gateway and included settings with the administrator. Do not install unexpected certificates or additional management settings without checking them.
  4. Only then select Install and complete the displayed confirmations, including the device passcode. Apple removes a downloaded profile that has not been installed after eight minutes; if it is missing later, download it again from the confirmed portal. Only one downloaded profile can be waiting for installation at a time. If Stolen Device Protection prevents installation, first use a familiar location and the approved support process rather than routinely disabling protection.
  5. Identify the installed profile in the system settings. In its SFOS 22/23 guides, Sophos describes an automatic IPsec connection after downloading. This is not a guarantee for the current iOS version: Apple profile installation and, where necessary, sign-in must be completed. Check the actual VPN status; if it is not connected, use the VPN switch identified in advance for this profile and complete the intended credential or MFA steps. If the switch is missing or the prompts differ, do not improvise; contact support.

Treat the profile as confidential and do not pass it on to other users. Portal SSO, profile installation and tunnel sign-in are three separate processes; none alone proves that the others have succeeded.

Check the connection with a pilot user

The following checks are acceptance steps, not device tests that have already been performed. Perform the first test outside the internal Wi-Fi network, on an approved external network, so that direct LAN access does not distort the result.

  1. In the iOS VPN settings, check whether the expected profile is connected. The administrator checks the user and session on the firewall.
  2. Open a permitted internal application using its documented DNS name. For example, https://intranet.example.com represents your own approved application; replace the placeholder with the actual internal name. Check DNS resolution and application access separately.
  3. A destination agreed with the administrator that is not permitted must remain blocked. Do not broaden firewall rules to create an apparent success.
  4. The administrator checks in Log Viewer whether traffic from the VPN zone matches the expected, narrowly scoped rule; logging must be enabled for this. The process is described in Check firewall rules with Log Viewer and Packet Capture.
  5. Check that the second factor is enforced wherever the security requirements demand it. An MFA prompt in the portal does not prove MFA at the IPsec tunnel. Acceptance also includes reconnecting and a controlled switch between Wi-Fi and mobile networks. Internet traffic must follow the agreed split-tunnel or full-tunnel design.

If the tunnel is established but application access fails, first investigate the policy, rule, return path and DNS. If the tunnel is missing, check the profile, user permissions, authentication and IPsec network path. IPsec troubleshooting helps the administrator narrow down the cause; disabling certificate validation or MFA is not a diagnostic step.

Disconnect and replace profiles in a controlled manner

Sophos specifies Settings > General > VPN > Status for disconnecting the relevant connection. This source label is not a universal current iOS navigation path. Open the VPN area identified during the preflight checks, select your specific connection and set its status to disconnected. Then check that the tunnel is no longer connected and that a new request to the test application accessible only through VPN no longer works. Do not rely on browser pages that have already loaded. If a managed setting prevents disconnection or the connection re-establishes itself, involve the MDM administrator rather than deleting other profiles.

Reinstall after administrative changes

If a previously working tunnel stops connecting after a configuration change, Sophos requires the configuration to be installed again. Native iOS IPsec does not use automatic Sophos Connect provisioning here.

  1. Before replacing the profile, record its name, version, the reason for the change and the rollback route approved by the administrator. Agree a maintenance window because replacement interrupts access. Do not reset all network profiles or device settings indiscriminately.
  2. Disconnect the tunnel and download the current iOS IPsec profile again from the VPN Portal in Safari. The administrator determines whether it replaces the existing profile or whether that specific old profile must first be removed. For an MDM profile, replacement follows the responsible management process.
  3. Check and install the new profile as described above. Then check the connection, MFA requirements, DNS, permitted destinations and blocked destinations again. Do not retain several identically named profiles in parallel without controlling them.
  4. If acceptance fails, disconnect the new tunnel and stop the deployment. Reinstate an old profile only if the administrator confirms that the gateway, keys or certificates and permissions remain valid. After security changes, it is not a reliable rollback route. Remove old downloads and outdated profiles selectively only after successful acceptance.

Replace or lose a device, or withdraw access

Before removing a profile under Settings > General > VPN & Device Management, check the relevant profile and its contents. Confirm the offered profile removal only for the clearly identified VPN profile and after approval. Apple warns that removing a profile can also remove associated settings, apps and data. Do not delete a shared management profile as supposed VPN housekeeping. If removal is blocked, the management team must handle withdrawal.

After withdrawal, check that the profile is absent and no new connection is possible. If a device is lost or a user leaves, also revoke user or group permissions server-side, end existing VPN sessions and have the administrator determine how to handle any potentially exposed keys or certificates. Deleting only the local file does not revoke VPN permission. Profile copies in downloads and backups must also be included in the withdrawal process.