The client validates the firewall's certificate against a stored hash. If the presented certificate changes unexpectedly (potential MITM), the connection is aborted.
After installation, verify these components: sophosconnect 2.5.0 ga%28ipsec and sslvpn%29.msi