MFA for Sophos Firewall
Sophos Firewall gives remote users SSL VPN access and a VPN portal where they download their connection settings. Both face the internet, and by default a password is all it takes to get in. Sophos Firewall can check those logins against an external RADIUS server. Authnull becomes that server and requires MFA on SSL VPN and VPN portal logins. You add Authnull as a RADIUS authentication server, select it for VPN and portal authentication, and users must approve a factor before access is granted.
Sophos Firewall forwards the login; Authnull adds the factor.
Sophos Firewall sends the login to Authnull over RADIUS. Authnull checks the password against your directory, asks for the factor, and returns Access-Accept. Set the RADIUS timeout to 60 seconds so users have time to approve.
Configure MFA for Sophos Firewall
Real steps — the exact menus, fields, and values. Follow along in your console; the whole thing takes about 20 minutes.
Add Authnull as a RADIUS server
Create a new authentication server of type RADIUS with the Authnull connector IP, port 1812, the shared secret and a 60-second timeout. Use Test connection to confirm it responds.
Select it for SSL VPN and the VPN portal
Add the Authnull server to the authentication methods for SSL VPN and the VPN portal, above the local server.
Allow the right users
Add the users or groups that should have remote access to your SSL VPN remote-access policy.
Test the connection
Sign in to the VPN portal or connect with Sophos Connect using a test account, approve the factor, and confirm the login in the Authnull logs.
Closes the MFA gap auditors look for
Enforcing MFA on Sophos Firewall gives you evidence for the remote-access and privileged-access controls in SOC 2 and the access requirements under CCPA — with per-login logs you can hand straight to an assessor.
Add MFA to Sophos Firewall — free to start.
Spin up Authnull, point Sophos Firewall at it, and enforce a factor on a pilot group today. No card, no rip-and-replace.