{"id":24554,"date":"2025-07-10T10:29:51","date_gmt":"2025-07-10T03:29:51","guid":{"rendered":"https:\/\/vacif.com\/?p=24296"},"modified":"2025-08-08T15:37:59","modified_gmt":"2025-08-08T08:37:59","slug":"%f0%9f%94%90-huong-dan-cau-hinh-vpn-clientless-access-rdp-tren-sophos-xgs-firewall","status":"publish","type":"post","link":"https:\/\/vacif.com\/en\/%f0%9f%94%90-huong-dan-cau-hinh-vpn-clientless-access-rdp-tren-sophos-xgs-firewall\/","title":{"rendered":"H\u01b0\u1edbng D\u1eabn C\u1ea5u H\u00ecnh VPN Clientless Access (RDP) Tr\u00ean Sophos XGS Firewall"},"content":{"rendered":"\n

I – Gi\u1edbi thi\u1ec7u<\/span><\/h2><\/div><\/div><\/div>\n\n\n\n

Trong m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p hi\u1ec7n \u0111\u1ea1i, nhu c\u1ea7u truy c\u1eadp t\u1eeb xa v\u00e0o h\u1ec7 th\u1ed1ng n\u1ed9i b\u1ed9 l\u00e0 r\u1ea5t ph\u1ed5 bi\u1ebfn. Tuy nhi\u00ean, kh\u00f4ng ph\u1ea3i l\u00fac n\u00e0o ng\u01b0\u1eddi d\u00f9ng c\u0169ng c\u00f3 th\u1ec3 c\u00e0i \u0111\u1eb7t ph\u1ea7n m\u1ec1m VPN. V\u00ec v\u1eady, t\u00ednh n\u0103ng Clientless VPN tr\u00ean Sophos XGS Firewall l\u00e0 m\u1ed9t gi\u1ea3i ph\u00e1p l\u00fd t\u01b0\u1edfng. N\u00f3 cho ph\u00e9p ng\u01b0\u1eddi d\u00f9ng truy c\u1eadp c\u00e1c d\u1ecbch v\u1ee5 n\u1ed9i b\u1ed9 nh\u01b0 Remote Desktop (RDP), HTTP\/S, SSH… tr\u1ef1c ti\u1ebfp qua tr\u00ecnh duy\u1ec7t web, th\u00f4ng qua c\u1ed5ng VPN Portal b\u1ea3o m\u1eadt b\u1eb1ng SSL.<\/p>\n\n\n\n

B\u00e0i vi\u1ebft n\u00e0y s\u1ebd h\u01b0\u1edbng d\u1eabn c\u1ea5u h\u00ecnh ch\u1ee9c n\u0103ng Clientless VPN v\u1edbi giao th\u1ee9c RDP, nh\u1eb1m gi\u00fap ng\u01b0\u1eddi d\u00f9ng t\u1eeb xa c\u00f3 th\u1ec3 truy c\u1eadp m\u00e1y ch\u1ee7 n\u1ed9i b\u1ed9 nhanh ch\u00f3ng v\u00e0 an to\u00e0n m\u00e0 kh\u00f4ng c\u1ea7n c\u00e0i th\u00eam ph\u1ea7n m\u1ec1m.<\/p>\n\n\n\n

II – T\u00ecnh hu\u1ed1ng c\u1ea5u h\u00ecnh<\/span><\/h2><\/div><\/div><\/div>\n\n\n\n

M\u1ee5c ti\u00eau:<\/strong> Cho ph\u00e9p ng\u01b0\u1eddi d\u00f9ng truy c\u1eadp m\u00e1y ch\u1ee7 n\u1ed9i b\u1ed9 (Windows Server) th\u00f4ng qua RDP b\u1eb1ng tr\u00ecnh duy\u1ec7t web, s\u1eed d\u1ee5ng t\u00ednh n\u0103ng Clientless VPN tr\u00ean Sophos XGS.<\/p>\n\n\n\n

M\u00e1y ch\u1ee7 c\u1ea7n truy c\u1eadp:<\/strong> 192.168.20.21 \u2013 \u0111\u00e3 b\u1eadt t\u00ednh n\u0103ng RDP<\/p>\n\n\n\n

Ng\u01b0\u1eddi d\u00f9ng:<\/strong> Nh\u00e2n vi\u00ean \u0111\u01b0\u1ee3c c\u1ea5p t\u00e0i kho\u1ea3n (t\u00e0i kho\u1ea3n local ho\u1eb7c t\u1eeb AD\/LDAP)<\/p>\n\n\n\n

Truy c\u1eadp t\u1eeb xa:<\/strong> Th\u00f4ng qua portal SSL VPN t\u1ea1i \u0111\u1ecba ch\u1ec9
https:\/\/<WAN_IP ho\u1eb7c Domain>:445<\/p>\n\n\n\n

Y\u00eau c\u1ea7u b\u1ea3o m\u1eadt:<\/strong><\/p>\n\n\n\n

    \n
  • X\u00e1c th\u1ef1c ng\u01b0\u1eddi d\u00f9ng tr\u01b0\u1edbc khi hi\u1ec3n th\u1ecb bookmark RDP<\/li>\n\n\n\n
  • Kh\u00f4ng c\u00e0i \u0111\u1eb7t ph\u1ea7n m\u1ec1m, s\u1eed d\u1ee5ng giao di\u1ec7n HTML5<\/li>\n\n\n\n
  • Gi\u1edbi h\u1ea1n quy\u1ec1n truy c\u1eadp theo user c\u1ee5 th\u1ec3<\/li>\n<\/ul>\n\n\n\n

    III – H\u01b0\u1edbng d\u1eabn c\u1ea5u h\u00ecnh<\/span><\/h2><\/div><\/div><\/div>\n\n\n\n

    1 – T\u1ea1o Bookmarks<\/span><\/h2><\/div><\/div><\/div>\n\n\n\n
      \n
    • V\u00e0o menu: Remote Access VPN<\/strong> <\/strong>\u2192 Clientless SSL<\/strong> VPN policy <\/strong>\u2192<\/strong> Bookmarks<\/strong><\/li>\n\n\n\n
    • Nh\u1ea5n Add<\/strong> \u0111\u1ec3 t\u1ea1o k\u1ebft n\u1ed1i m\u1edbi.<\/li>\n<\/ul>\n\n\n
      \n
      \"\"<\/figure>\n<\/div>\n\n\n

      2 – \u0110i\u1ec1n th\u00f4ng tin Bookmarks<\/span><\/h2><\/div><\/div><\/div>\n\n\n\n
        \n
      • Name<\/strong>: \u0111\u1eb7t t\u00ean (v\u00ed d\u1ee5: WINDOW_SERVERS)<\/li>\n\n\n\n
      • Type<\/strong>: ch\u1ecdn RDP<\/strong><\/li>\n\n\n\n
      • URL<\/strong>: nh\u1eadp IP m\u00e1y c\u1ea7n truy c\u1eadp (v\u00ed d\u1ee5: 192.168.20.21)<\/li>\n\n\n\n
      • Port<\/strong>: 3389<\/li>\n\n\n\n
      • Protocol security<\/strong>: ch\u1ecdn TLS<\/li>\n\n\n\n
      • Nh\u1ea5n Save<\/strong>.<\/li>\n<\/ul>\n\n\n
        \n
        \"\"<\/figure>\n<\/div>\n\n\n

        3 – T\u1ea1o Policies<\/strong><\/span><\/h2><\/div><\/div><\/div>\n\n\n\n
          \n
        • Chuy\u1ec3n sang tab: Policies<\/strong><\/li>\n\n\n\n
        • Nh\u1ea5n Add<\/strong> \u0111\u1ec3 t\u1ea1o ch\u00ednh s\u00e1ch truy c\u1eadp.<\/li>\n<\/ul>\n\n\n
          \n
          \"\"<\/figure>\n<\/div>\n\n\n

          4 – \u0110i\u1ec1n th\u00f4ng tin Policies<\/strong><\/span><\/h2><\/div><\/div><\/div>\n\n\n\n
            \n
          • Name<\/strong>: \u0111\u1eb7t t\u00ean cho policy (v\u00ed d\u1ee5: ALLOW_RDP_WIN_SVR)<\/li>\n\n\n\n
          • Policy<\/strong> members<\/strong>: ch\u1ecdn user\/group \u0111\u01b0\u1ee3c c\u1ea5p quy\u1ec1n<\/li>\n\n\n\n
          • Published<\/strong> bookmarks<\/strong>: ch\u1ecdn bookmark \u0111\u00e3 t\u1ea1o \u1edf b\u01b0\u1edbc 2<\/li>\n\n\n\n
          • Nh\u1ea5n Save<\/strong><\/li>\n<\/ul>\n\n\n
            \n
            \"\"<\/figure>\n<\/div>\n\n\n

            5 – M\u1edf truy c\u1eadp WAN<\/strong><\/span><\/h2><\/div><\/div><\/div>\n\n\n\n
              \n
            • V\u00e0o menu: Administration \u2192 Device Access<\/strong> <\/strong>\u2192<\/strong> Local service ACL<\/strong><\/li>\n\n\n\n
            • \u1ede d\u00f2ng VPN<\/strong> Protal<\/strong>, tick ch\u1ecdn zone WAN<\/strong><\/li>\n<\/ul>\n\n\n
              \n
              \"\"<\/figure>\n<\/div>\n\n\n

              6 – Truy c\u1eadp v\u00e0o VPN Portal<\/strong><\/span><\/h2><\/div><\/div><\/div>\n\n\n\n
                \n
              • Tr\u00ean tr\u00ecnh duy\u1ec7t, truy c\u1eadp: https:\/\/<WAN-IP ho\u1eb7c domain>:8443 (M\u1eb7c \u0111\u1ecbnh port truy c\u1eadp VPN Portal c\u1ee7a Sophos l\u00e0 445<\/strong>, \u1edf \u0111\u00e2y do m\u00ecnh \u0111\u00e3 \u0111\u1ed5i port)<\/li>\n<\/ul>\n\n\n
                \n
                \"\"<\/figure>\n<\/div>\n\n\n

                7 – Ki\u1ec3m tra<\/span><\/h2><\/div><\/div><\/div>\n\n\n\n
                  \n
                • Sau khi \u0111\u0103ng nh\u1eadp, ch\u1ecdn tab Clientless Access<\/strong><\/li>\n\n\n\n
                • Nh\u1ea5n v\u00e0o bi\u1ec3u t\u01b0\u1ee3ng RDP<\/strong> t\u01b0\u01a1ng \u1ee9ng \u0111\u1ec3 k\u1ebft n\u1ed1i t\u1eeb tr\u00ecnh duy\u1ec7t<\/li>\n<\/ul>\n\n\n
                  \n
                  \"\"<\/figure>\n<\/div>\n\n
                  \n
                  \"\"<\/figure>\n<\/div>\n\n\n

                  ** Ch\u00fa \u00fd:<\/strong> N\u1ebfu khi th\u1ef1c hi\u1ec7n k\u1ebft n\u1ed1i RDP xu\u1ea5t hi\u1ec7n l\u1ed7i:<\/span><\/h2><\/div><\/div><\/div>\n\n\n\n

                  “Error: protocol security negotiation failure”<\/strong>,
                  th\u00ec c\u1ea7n t\u1eaft x\u00e1c th\u1ef1c NLA<\/strong> (Network Level Authentication) tr\u00ean Windows Server.<\/p>\n\n\n\n

                  C\u00e1ch th\u1ef1c hi\u1ec7n:<\/strong><\/span><\/h2><\/div><\/div><\/div>\n\n\n\n
                    \n
                  1. Nh\u1ea5n Windows + R<\/strong><\/li>\n\n\n\n
                  2. G\u00f5 l\u1ec7nh: SystemPropertiesRemote \u2192 nh\u1ea5n Enter<\/strong><\/li>\n\n\n\n
                  3. Trong c\u1eeda s\u1ed5 System Properties<\/strong>, tab Remote<\/strong><\/li>\n\n\n\n
                  4. B\u1ecf ch\u1ecdn d\u00f2ng:
                    \u201cAllow connections only from computers running Remote Desktop with Network Level Authentication\u201d<\/strong><\/li>\n\n\n\n
                  5. Nh\u1ea5n Apply<\/strong> \u2192 OK<\/strong><\/li>\n<\/ol>\n\n\n
                    \n
                    \"\"<\/figure>\n<\/div>","protected":false},"excerpt":{"rendered":"

                    Trong m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p hi\u1ec7n \u0111\u1ea1i, nhu c\u1ea7u truy c\u1eadp t\u1eeb xa v\u00e0o h\u1ec7 th\u1ed1ng n\u1ed9i b\u1ed9 l\u00e0 r\u1ea5t ph\u1ed5 bi\u1ebfn. Tuy nhi\u00ean, kh\u00f4ng ph\u1ea3i l\u00fac n\u00e0o ng\u01b0\u1eddi d\u00f9ng c\u0169ng c\u00f3 th\u1ec3 c\u00e0i \u0111\u1eb7t ph\u1ea7n m\u1ec1m VPN. V\u00ec v\u1eady, t\u00ednh n\u0103ng Clientless VPN tr\u00ean Sophos XGS Firewall l\u00e0 m\u1ed9t gi\u1ea3i ph\u00e1p l\u00fd t\u01b0\u1edfng. N\u00f3 […]<\/p>\n","protected":false},"author":2,"featured_media":24315,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[617,70,618],"tags":[334],"class_list":["post-24554","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-study-thuc-te","category-firewall","category-huong-dan","tag-sophos-firewall","entry","has-media"],"_links":{"self":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/24554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/comments?post=24554"}],"version-history":[{"count":1,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/24554\/revisions"}],"predecessor-version":[{"id":25572,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/24554\/revisions\/25572"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/media\/24315"}],"wp:attachment":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/media?parent=24554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/categories?post=24554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/tags?post=24554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}