Sophos XG Firewall | Monitor and Analyze | 11
• System
Note:
• Use F1 key for page specific help.
Each section in this guide shows the menu path to the configuration page. For example, to reach the High Availability page, choose System Services menu from Configure section in the navigation bar, and then choose High Availability tab. Online help mentions this path as:
Configure > System Services > High Availability
Pages
A Leaf page is a page from where all the configurations can be done. The admin tab on the upper rightmost corner of every page provides access to several commonly used functions like:
1. Support: Opens the customer login page for creating a Technical Support Ticket. It is fast, easy and puts your case right into the Technical Support queue.
2. About Product: Opens the device registration information page.
3. Wizard: Opens the Network Configuration Wizard.
4. Console: Opens the Command Line Interface (CLI) console.
5. Reboot Device: Reboots the device.
6. Shutdown Device: Shut downs the device.
7. Lock: Locks the Admin Console. Admin Console is automatically locked if the device is in inactive state for more than 3 minutes. To unlock the Admin Console you need to relogin. By default, Lock functionality is disabled.
Enable Admin Session Lock from System > Administration > Settings
8. Logout: Logs out from the Admin Console.
Clicking Help hyperlink on the upper rightmost corner of every page opens the content-sensitive help page.
Click How-To Guides to browse through our extensive library of how-to videos for XG Firewall.
List Navigation Controls
The Admin Console pages display information in the form of lists and many lists are spread across the multiple pages.
Page Navigation Controls at the bottom of the list provides navigation buttons for moving through list pages with large number of entries. It displays the current page and total number of pages.
Monitor and Analyze
Control Center
The Control Center appears as soon as you logon to the Admin Console.
Sophos XG Firewall | Monitor and Analyze | 12
Control Center provides a single screen snapshot of the state and health of the security system, which is easy to explore and drill.
System Panel
System panel displays the real-time state of device services, VPN connections, WAN links and performance as well as number of days since the device is up and running. Status is displayed as an icon and colored icons are used to differentiate statuses. On clicking the icon, detailed information of the services is displayed.
The icons and their various status are:
Performance Widget
IconStatus
Normal
Load Average of the Device is less than 2 units.
Warning
Load Average is between 2 to 5 units.
Alert
Load Average more than 5 units.
Unknown
On clicking the icon, the Load Average Graph of the device is displayed.
Load Average is a measure of the average number of processes waiting for execution time on a CPU. Any number greater than the number of processor cores in the system indicates that, during the time period being measured (for example, 5 minutes), there was generally more work to do than the system was capable of doing.
Services Widget
IconStatus
Normal
All the services are running.
Warning
One or more services has been explicitly stopped by the administrator. You can restart services from Monitor
& Analyze > System Services > Services.
Alert
One or more services is not running.
You can restart services from Monitor & Analyze > Services.
Unknown
On clicking the icon, the services that are stopped or dead are displayed.
Interfaces Widget
IconStatus
Normal
All the WAN links are UP.
Sophos XG Firewall | Monitor and Analyze | 13
IconStatus
Warning
50% or less WAN links are DOWN.
Alert
50% or more WAN links are DOWN.
Unknown
On clicking the icon, details of WAN Links are displayed.
VPN Connections Widget
IconStatus
Normal
All the VPN tunnels are UP.
Warning
50% or less VPN tunnels are DOWN.
Alert
50% or more VPN tunnels are DOWN.
Unknown
On clicking the icon, details of VPN tunnels are displayed.
CPU Widget
CPU graphs allow administrator to monitor the CPU usage by the Users and System components. Maximum and
Average CPU usage is also displayed when clicked on the widget.
X-axis –Hours/Weeks/Months/Year (depending on the option selected)
Y-axis – % use
Click the widget to view details. Clicking any of the hyperlinks under System Tools and Network Utilities will redirect you to the respective page.
Memory Widget
Memory graphs allow administrator to monitor the memory usage in percentage. Graphs displays the memory used, free memory and total memory available. In addition, shows maximum and average memory usage.
X-axis – selected)
Y-axis – % use
Click the widget to view details. Clicking any of the hyperlinks under System Tools and Network Utilities will redirect you to the respective page.
Bandwidth Widget
Graph displays total data transfer through WAN Zone. In addition, shows maximum and average data transfer.
X axis – Hours/Days/Months/Year (depending on the option selected)
Y-axis – Total data transfer in KBits/Second
Click the widget to view details. Clicking any of the hyperlinks under System Tools and Network Utilities will redirect you to the respective page.
Sophos XG Firewall | Monitor and Analyze | 14
Sessions Widget
Graph displays current sessions of the device. It also displays the maximum and average live connections.
Click the widget to view details. Clicking any of the hyperlinks under System Tools and Network Utilities will redirect you to the respective page.
High Availability (HA) Details
Displays HA mode configured as below:
A-A : When device is configured in Active-Active mode.
A-P (M) : When device is configured in Active-Passive mode and is acting as Primary Device..
A-P (S) : When device is configured in Active-Passive mode and is acting as Auxiliary Device.
Traffic Insight Panel
The section provides statistics related to network traffic processed by your device in the last 24 hours. The at a glance information helps find out who is consuming the most bandwidth, unusual traffic patterns, and most-visited websites and applications.
The statistics is displayed as bar graphs:
• Web Activity - The graph provides the user data transfer information over the last 24 hours, which helps in understanding the web surfing trend. It also displays the maximum and average amount of data transferred, in bytes, over the last 24 hours, which helps you spot unusual traffic patterns, if any. For example, if the graph displays a peak level at a certain point of time, it means the maximum amount of data transfer was done over that time period.
• Allowed App Categories - The graph displays the amount of data transferred, in bytes, for top five application categories. This information provides an administrator at a glance view of the most-used applications in the last 24 hours, which in turn helps you identify which applications consume the most bandwidth. Clicking on the bar of a particular application category in the graph will redirect you to the filtered application report of that category.
• Network Attacks - The graph lists top five hosts that were denied access to the network due to health reasons.
Clicking on the bar of a particular attack category in the graph will redirect you to the filtered report of that category.
• Allowed Web Categories - The graph displays the amount of data transferred, in bytes, for top five web categories.
This information provides an administrator at a glance view of the most-visited websites in the last 24 hours, which in turn helps you identify which websites consume the most bandwidth. Clicking on the bar of a particular web category in the graph will redirect you to the filtered report of that category.
• Blocked App Categories - The graph displays top five denied application categories along with number of hits per category. This way an administrator gets to know about the applications with the most number of failed access attempts. Clicking on the bar of a particular application category in the graph will redirect you to the filtered application report of that category.
User & Device Insights Panel
Security Heartbeat Widget
Security Heartbeat widget provides the health status of all endpoint devices. An endpoint device is an Internet-capable computer hardware device connected to Sophos XG Firewall via Sophos Central. The endpoint sends a heartbeat signal at regular intervals and also informs about potential threats to the Sophos XG Firewall.
If Security Heartbeat is not configured, the Configure button appears on the Control Center.
The health status of endpoint can be red, yellow, or green:
• Red labeled "At risk" - Active malware detected.
• Yellow labeled "Warning" - Inactive malware detected.
• Green (no label) - No malware detected.
Sophos XG Firewall | Monitor and Analyze | 15
• Red labeled "Missing" - Endpoints not sending health status information but causing network traffic.
Once Security Heartbeat is configured, all the endpoints are classified in either of the 4 status. The Security Heartbeat
Widget shows the total number of endpoints in each status.
Click the widget to view the list of all endpoints with information like hostname/IP of the source, user and state changed. You can select to display all or just certain endpoints based on their health status.
Sandstorm Widget
Sophos Sandstorm is a cloud-based service that provides enhanced protection against malware. You can configure the firewall to send suspicious downloads to Sandstorm for analysis. Sandstorm detonates files to check for ransomware and other advanced threats. Because the analysis takes place in the cloud, your system is never exposed to potential threats.
Sandstorm requires a subscription. Click the link to start your free 30-day evaluation.
When Sandstorm is enabled, users will be prevented from downloading files that match the firewall criteria until the analysis is complete.
The Sandstorm widget displays analysis results for web traffic and email. Click the widget to view Sandstorm activity details.
Advanced Threat Protection Widget
•
Advanced Threat Protection widget provides a snapshot of advanced threats detected in your network. ATP can help rapidly detect infected or compromised clients inside the network and raise an alert or drop the respective traffic.
If Security Heartbeat is not configured, the Configure button appears on the Control Center.
Once configured, the widget will have either of the two status:
- Normal - No threats detected.
•
- Alert - It displays number of sources blocked. Clicking on it gives details like hostname/IP of the source, threat and count.
User Threat Quotient Widget
Widget displays the User Threat Quotient (UTQ) status of an organization aggregated for the last 7 days. This helps an administrator to get quick visibility of risky users, if any, who are posing security threats to the organization’s network.
•
Possible UTQ statuses:
- There are no users with risky web surfing behaviour or using infected hosts that are part of botnet.
•
- There are 13 users who are accounting for 80% of overall risk posed to the organization’s network.
Note that the number 13 here is just an example and may vary from case to case. For example, there may be a case where single user is accounting for 80% of overall risk posed to the organization’s network! Click on this icon to view the User Threat Quotient (UTQ) reports for last 7 days.
RED Widget
Widget displays number of RED tunnels established and total number of RED tunnels configured in the form of 4/8.
Click the widget to view list of RED tunnels.
Wireless APs Widget
Sophos XG Firewall | Monitor and Analyze | 16
Widget displays Active APs and total number of APs configured in the form of 2/3. Pending APs, if any will be displayed separately in a bracket in red color. Clicking the widget will redirect you to the Access Points page.
Connected Remote Users Widget
Widget displays total number of users connected remotely through SSL VPN. Clicking the widget, will redirect you to the SSL VPN Users page.
Live Users Widget
Widget displays total live users count. Clicking the widget, will redirect you to the Live Users page.
Active Firewall Rules Panel
Active Firewall Rules panel displays information which can be used by the administrator to visualize and quantify
(in terms of data volume) the firewall rules configured on the device. Using this information, the administrator can fine-tune the deployed firewall rules to troubleshoot or enhance network performance. All active firewall rules will be visible irrespective of the rights pertaining to the logged-on administrator profile.
Firewall Rule Types
Active Firewall Rules widget displays the number of firewall rules which are being used to process the network traffic, based on the following rule types:
• Business - Displays the number of active Business Application Firewall Rules
• User - Displays the number of active User Application Firewall Rules
• Network - Displays the number of active Network Firewall Rules
Total - Displays the total number of active firewall rules.
The chart displays the volume of data (in Bytes) processed by each active firewall rule type, in the last 24 hours.
Hover over the chart area to see the volume of data processed by the active firewall rule type. Firewall Rule type is easily recognisable, based on the following legends:
Business - Represented by Green area on the chart
User - Represented by Red area on the chart
Network - Represented by Blue area on the chart
Use the information in the chart area to determine the network saturation status and identify specific firewall rule type causing this.
Firewall Rule Status
The number of firewall rules, as per their current statuses are also displayed within the same widget. This is mainly for admin housekeeping purposes, also useful, where multiple administrators are working on the same device. The current statuses are based on the following categories or filters:
• Unused - Displays the number of firewall rules which does not process any traffic on the device. The administrator may want to revise unused firewall rules or delete them completely.
• Disabled - Displays the number of firewall rules which are configured on the device, but disabled by the administrator.
• Changed - Displays the number of firewall rules which have been updated recently.
• New - Displays the number of newly created firewall rules.
Clicking any of the Firewall Rule Types or Firewall Rule Status redirects to the Firewall page displaying the relevant firewall rules.
Reports Panel
Not applicable to - CR10iNG, CR10wiNG, CR15i, CR15wi, CR15iNG, CR15wiNG, CR15iNG-LE,
CR15iNG-4P, CR15wiNG-4P, XG85 and XG85w models.
Sophos XG Firewall | Monitor and Analyze | 17
Depending on the Modules subscribed, at most five critical reports from the below mentioned table are displayed:
Report Name
High Risk Applications
Objectionable Websites
Web Users
Intrusion Attacks
Web Server Protection
Email Usage
Email Protection
Traffic Dashboard
Security Dashboard -
Number / Data Displayed
<number of> Risky Apps seen yesterday
<number of> Objectionable websites seen yesterday
<data transfer> (in bytes) used by top
10 users yesterday
<number of> Intrusion attacks yesterday
<number of>Web server attacks yesterday
-
<data transfer> (in bytes) used
<number of> Spam mails yesterday
Subscription Module
Web Protection
Web Protection
Web Protection
Network Protection
Web Server Protection
Email Protection
Email Protection
Either Web Protection or Network
Protection
Either Web Protection or Network
Protection
Prevalent Malware Panel
Applicable to CR15iNG, CR15wiNG, CR15i and CR15wi models only
Displays top five malware identified by the Device, in addition to the number of occurrence per malware.
Messages Panel
Panel displays information which allows administrator to monitor and track the system events of the device. Each message displays the date and time that the event occurred.
Displays following alerts:
1. The default password for the user "admin" has not been changed. We highly recommend you to change the password. – This alert is displayed when default password for super administrator is not changed.
2. The default Admin Console password has not been changed.
3. HTTPS, SSH based management is allowed from the WAN. This is not a secure configuration. We recommend using a good password.
4. HTTP, Telnet based management is allowed from the WAN. This is not a secure configuration. We recommend using a good password.
5. Your Device is not registered.
6. The modules expired.
Symbolic representations are used for easier identification of messages.
: Indicates Alert messages.
: Indicates warnings.
: Indicates firmware download notifications.
