Sophos

This document outlines how to set up a secure IPsec Site-to-Site VPN connection between Sophos Firewall and Timus Cloud. It connects Sophos_LAN (192.10.10.0/24) with Timus_LAN (192.168.249.0/24) for seamless communication.

Step 1: Create an IPsec Profile on Sophos

Navigate to System → IPsec Profiles and click Add.

Setting	Value
Name	Sophos_to_Timus
Key exchange	IKEv1
Authentication mode	Main mode
Key negotiation tries	3
Re-key connection	Enabled
Pass data in compressed format	Disabled
SHA2 with 96-bit truncation	Disabled

Phase 1 Settings

Parameter	Value
Key life	28800 seconds
Re-key margin	120 seconds
DH group (key group)	14 (Dh4048)
Encryption	AES256
Authentication	SHA256

Phase 2 Settings

Parameter	Value
PFS group (DH group)	Same as Phase 1
Key life	3600 seconds
Encryption	AES256
Authentication	SHA256

Dead Peer Detection: Enabled

Step 2: Configure the IPsec VPN Connection on Sophos

Navigate to Site-to-Site VPN → IPsec and click Add.

Setting	Value
Name	Sophos_to_Timus
IP version	IPv4
Connection type	Site-to-site
Gateway type	Respond only
Activate on save	Enabled
Create firewall rule	Disabled (manual)
Profile	Sophos_to_Timus
Authentication type	Pre-shared key

Gateway Settings

Field	Value
Listening interface	Port2 – Sophos public IP (e.g. 172.10.10.1)
Local subnet	Sophos_LAN
Gateway address	Timus public IP (e.g. 172.30.30.1)
Remote subnet	Timus_LAN

Create Local and Remote Subnets (Inside VPN Configuration)

During the VPN setup, define both the local and remote LAN networks.

Network Name	Type	IP Version	Address	Subnet Mask
Sophos_LAN	Network	IPv4	Your_LAN_Address (eg., 192.168.10.10)	/24 (255.255.255.0)
Timus_LAN	Network	IPv4	192.168.249.0	/24 (255.255.255.0)

Subnet Creation for Sophos and Timus LAN

Step 3: Add Firewall Rules on Sophos

Create two firewall rules to allow traffic between Sophos and Timus networks. Go to Rules and Policies → Firewall rules and select IPv4.
Click Add firewall rule → New firewall rule.
Configure two firewall rules as follows: -Firewall Rules Page:

Firewall Rules Page in Sophos Firewall

Setting	Outbound VPN Traffic	Inbound VPN Traffic
Action	Accept	Accept
Source zones	LAN	VPN
Source networks	Sophos_LAN	Timus_LAN
Destination zones	VPN	LAN
Destination networks	Timus_LAN	Sophos_LAN
Services	Any	Any
Log firewall traffic	Enabled	Enabled

Inbound VPN Traffic Rule Example:

Inbound VPN Traffic Rule Configuration in Sophos Firewall

Outbound VPN Traffic Rule Example:

Outbound VPN Traffic Rule Configuration in Sophos Firewall

Step 4: Configure Device Access on Sophos

Go to System →Administration → Device Access. Enable IPsec for the WAN zone and click Apply.

Timus Configuration for Sophos Firewall

In Timus Manager, go to Sites → Create New.
Select Connector and name it Timus_to_Sophos.

Parameters: You need to enable “Create firewall rules automatically.”

Miscellaneous Settings:

Enable Dead Peer Detection (DPD).
After configuring Phase 1 IKE, click Save.
Expand the gateway → click the three dots → select View.

On the View page, click Create New Tunnel to configure Phase 2.

Phase 2 Configuration on Timus

Parameter	Value
Local Network	Timus_LAN (192.168.249.0/24)
Remote Network	Sophos_LAN (192.10.10.0/24)
Encryption	AES256
Authentication	SHA256
Perfect Forward Secrecy (PFS)	Enabled
PFS Group	modp2048(14) Group 14
Lifetime	3600
Tunnel Protocol	ALL

Click Save after completing Phase 2 setup.

Verification

In Sophos → Site-to-Site VPN → IPsec, confirm the tunnel shows Active.
In Sophos and Timus Manager, confirm the connector shows Online (green).

Conclusion: You have successfully configured a secure Site-to-Site IPsec VPN between Sophos Firewall and Timus Cloud. Site Online Traffic now flows between Sophos_LAN (192.10.10.0/24) and Timus_LAN (192.168.249.0/24).

Updated December 30, 2025 14:07