Two-Factor Authentication (2FA) for Sophos VPN

Last updated on July 1, 2026

Two-Factor Authentication (2FA) for Sophos VPN is an extra layer of security added to the traditional username and password credentials during VPN logins. Sophos VPN Two-Factor Authentication provides top-notch security for users who log in to Sophos UTM VPN (Sophos SG routers) and Sophos Firewall VPN (Sophos XG and XGS routers). Even if hackers steal a user’s password, Sophos VPN 2FA will stop them from connecting to the corporate network.

Enable Entra ID logins to Sophos VPN using Rublon MFA

If Sophos VPN authenticates users through LDAP or RADIUS, you can use Rublon Authentication Proxy to validate primary credentials against Microsoft Entra ID and then enforce Rublon MFA. This allows users to sign in to Sophos VPN with Microsoft Entra ID credentials, even when Sophos VPN does not support Microsoft Entra ID, SAML, OAuth 2.0, or OpenID Connect natively.

See how to authenticate LDAP and RADIUS with Microsoft Entra ID credentials and MFA, or explore the related use case: Microsoft Entra ID logins for LDAP and RADIUS applications with MFA.

Overview of 2FA for Sophos VPN

Rublon MFA integrates with Sophos VPN to enable Two-Factor Authentication (2FA) for Sophos VPN user logins, including Sophos UTM VPN and Sophos XG Firewall SSL VPN, IPsec VPN, and PPTP VPN.

Rublon MFA introduces Two-Factor Authentication to Sophos VPN in a number of ways.

Before You Start

Ensure you have properly configured Sophos VPN.
Ensure that you have properly set up your authentication source, that is, an external Identity Provider (IdP) like FreeRADIUS, Microsoft Active Directory, or OpenLDAP.