Sophos Firewall

This guide explains how to protect Sophos Firewall with Ironchip through RADIUS with NPS or with OTP codes.

RADIUS with NPS

Set up the RADIUS service in Sophos and integrate it with an NPS server in an Active Directory environment.

Requirements

• Access to the Ironchip admin console.
• A Windows server with the NPS role configured and protected by Ironchip.
• An account with permissions to make changes in Sophos.

Configure Sophos

1. Go to Authentication.

2. In the Servers section, click ADD to add the RADIUS service.

3. In Server Type, select RADIUS Server and fill in the fields:

   1. NPS server name.
   2. NPS server IP.
   3. Authentication port. It defaults to 1812; this example changes it to 1645. Use the port your NPS server listens on.
   4. Authentication timeout. We recommend 60 seconds, as in the other RADIUS integrations, to give users time to accept the Ironchip notification.
   5. Shared secret.
   6. Group name attribute: to test the connection, leave it as group for now.

4. Test the connection to the server with the credentials of a user who has access to the NPS application in the Ironchip admin console.

Create the user group in Sophos

If you use RADIUS authentication on a Sophos service now, it fails, because the users are not in the local Sophos database. To fix this, create a group in Sophos that stores the users with authentication permissions.

1. Go to the Groups section and click Add. If you already have a group, you do not need to create one.
2. Fill in the required fields.

Add an attribute to the network policy

Tell the NPS server, through an attribute, which group manages the authentication users.

1. In NPS, open the network policy you created earlier by double-clicking it.
2. Go to Settings.
3. Under RADIUS Attributes, select Standard, click Add, select the Filter-Id attribute and click Add.
4. In the next window, enter the attribute value: String format and, below it, the group you created in Sophos.
5. In Sophos, go to Authentication, edit the configuration you made earlier in the Servers section and enter Filter-Id in Group name attribute.

Verify the integration

The Services section lists all the Sophos services where you can use RADIUS. This example tests with the Sophos user portal.

1. Go to User portal authentication methods, select the RADIUS checkbox and move it above Local so it takes priority. Click Apply.
2. Administration > Admin and Users settings has the section with the ports of the different Sophos portals. In this example the user portal is on 4443.
3. Open the user portal and sign in with a user who is in the domain and configured in the Ironchip admin console. The example uses a test user.
4. When you connect with a user who does not exist in the local Sophos database, Sophos creates it and adds it to the group set in the network policy.
5. When you enter the credentials, you receive a notification from the Ironchip authenticator to accept.

Use RADIUS in the SSL VPN

For the VPN service, the process is similar:

1. Go to Authentication, open the SSL VPN section, select the RADIUS checkbox and place it above Local so it takes priority.
2. Download the configuration file from the user portal and add it to the VPN client.

Troubleshooting

• The connection test or sign-in fails with a timeout: raise the RADIUS server timeout to 60 seconds. The user must accept the Ironchip notification before it runs out.
• The NPS server rejects the request: check that the shared secret and the port are the same in Sophos and in NPS, and that Sophos is configured as a RADIUS client in NPS.

OTP

Configure OTP codes in Sophos and add them to the Ironchip authenticator.

Requirements

• The Ironchip app installed and configured on your device.
• Sophos deployed and installed correctly.

Configure Sophos

1. In the Sophos administration panel, go to Authentication.

   

2. Go to Multifactor authentication and enable and configure OTP on this tab.

   

   1. Select whether OTP is not used, is used, or is used for specific groups and users.
   2. Enable this option so users have to set up OTP at their next sign-in.
   3. Select which services use OTP.

3. To use OTP with the administrator account, go to Administration and open Device access.

   

4. Scroll down to the MFA section and enable MFA for the default administrator.

   

5. When you click Apply, a window appears. Select Generate software token.

   

6. A QR code appears. Scan it with the Ironchip app from the OTP section, and enter the administrator password and the OTP code on the same line:

   <password><000000>

   

From now on, whenever a user with OTP enabled signs in to a service configured with OTP, they must enter the password and the OTP code on the same line: <password><000000>.

Troubleshooting

Correct credentials but access denied

If the username and the password plus OTP are correct but sign-in is still refused:

1. In the Sophos administration panel, go to Authentication.

   

2. Go to Multifactor authentication. At the bottom of the page there is a list of users with OTP enabled.

   

3. Click the sync icon of the affected user.

   

4. Enter the OTP code of that user account and run the synchronization.