Profiles. Sophos v16.5

Sophos XG Firewall | System | 48

4. Click Apply to update the settings.

5. Click OK.

Sophos XG Firewall establishes a secure control connection to APU (Access Proxy for UTM) and negotiates a unique access ID.

6. Communicate the Access ID to the support.

The support uses this access ID to login to your Device. The control connection remains established until the specified time, which is displayed next to Access Until.

You can disable the connection manually any time by clicking the toggle switch and confirming the disable message with OK.

System

Profiles

This section covers the following topics:

•

Schedule

- Schedule defines a time schedule for applying Firewall Rule or Web & Application Filter policy. This page displays a list of schedules and also provides various options to manage it.

•

Access Time

- Schedule Internet access for individual users by defining Access Time policy. This page displays list of all the default as well as custom policies.

•

Surfing Quota

- Control individual user surfing time by defining Surfing Quota policy. This page displays the list of all policies and also provides option to add, update or delete surfing quota policies.

•

Network Traffic Quota

- Limit total as well as individual upload and/or download data transfer by defining

Network Traffic Quota. This page displays default as well as custom policies. The page also provides option to manage these policies.

•

Network Address Translation

- The Network Address Translation page displays list of all the NAT policies

and you can sort the list based on policy name.The page also provides option to add a new policy, update the parameters of the existing policy, or delete a policy.

•

Traffic Shaping

- Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user and

controls the web and network traffic. This page displays list of predefined and custom policies and also provides various options to manage it.

•

Device Access

- This page shows the default and custom profiles and also provides options to manage these profiles.

Schedule

Schedules allow you to control the time period for which firewall rules and web and application filter policies are in effect. Create schedules for specific time periods and days of the week. You can then apply these schedules to the rules and policies. A schedule also controls the system-triggered Rogue AP Scan.

Predefined and custom schedules can be applied to rules and policies. The device is shipped with the following predefined schedules:

• Work hours (5 Day week)

• Work hours (6 Day week)

• All Time on Weekdays

• All Time on Weekends

• All Time on Sunday

• All Days 10:00 to 19:00

Types of Schedules

• Recurring:Policy recurs during the specified time periods on specified days of the week.

Sophos XG Firewall | System | 49

• One-time:Policy is effective once during the specified days and time period. You can apply one-time schedules to control policies related to one-time events like conferences and guest user access. One-time schedules cannot be applied to web and application policies. Hence, they are not visible on these pages.

The schedule page displays the full list of predefined and custom policies.

• You cannot delete a schedule that is currently applied to a policy. To do so, you must apply a different schedule to the policy or delete the policy itself.

• To view the policies to which a schedule is attached, to apply a schedule to a policy or to change the applied schedule, go to the corresponding policy page.

• For details of policies and rules to which the schedule can be applied, view the following diagram.

Add a New Schedule

The device allows you to add a custom schedule. This can be applied to firewall rules and web and application filter policies to specify the time period and days of the week during which they are effective.

The Add Schedule page allows you to add a new schedule.

Sophos XG Firewall | System | 50

1. Go to System > Profiles > Schedule and click Add on the upper right side.

2. Enter the details.

Name

Enter a unique name to identify the schedule.

Description

Enter a description for the schedule.

Recurrence

Click to choose the type of recurrence.

Available Options:Recurring: Makes the policy recur during the specified time periods on specified days of the week. Select the days of the week. Specify the start time and stop time of the schedule. Stop time cannot be earlier than the start time.One Time: Makes the policy effective once during the specified days and time period. You can apply it to a policy on the Policies page. Click on +Add Firewall Rule and select User / Network Rule. One time schedules cannot be applied to web and application policies. Hence, they are not visible on these pages.Start Date & End Date:

(Available only if Recurrence selected is One Time) Select both date and time in the corresponding calendars.To specify a different start and stop time for a particular day within the range, select the day of the week from the drop-down list. Specify the start time and stop time. Stop time cannot be earlier than the start time.

Figure 27: Add Schedule

3. Click Save.

Access Time

Access time enables you to Allow or Deny Internet access during a predefined time period and days of the week.

While

Schedule

allows you to define the time period and the days of the week for a firewall rule or web and

application filter policies, access time allows you to apply an Allow or Deny policy to the selected schedule.

Two Access Time options are available:

Allow: Allows access during the selected schedule

Deny: Denies access during the selected schedule

The device is shipped with the following predefined Access Time policies:

• Allowed all the time

• Denied all the time

• Allowed only during work hours (5 day week)

• Denied during work hours (5 day week)

Sophos XG Firewall | System | 51

You can create custom access time policies to define differing levels of Internet access for different users and groups based on existing schedules. The access time page displays the full list of predefined and custom policies.

Note:

1. You can alter only the description and schedule of an existing policy. To change the schedule of an access time policy, it is recommended that you create a new policy to ensure that the selected schedule matches the Name of the policy.

2. Access time policies can be applied only to recurring schedules. Hence, one time schedules do not appear in the drop-down list.

3. Users generally belong to a group. If the access time policy applied to the user differs from the one applied to the user’s group, the user’s policy takes priority.

4. For details of policies and rules to which the schedule can be applied, view the following diagram.

Sophos XG Firewall | System | 52

Add a New Access Time Policy

To allow or deny Internet access to users or a group of users during specific time periods and days of the week, you can create access time policies. These policies are applied to existing schedules (Profiles > Schedule), users

(Authentication > Users) and groups (Authentication > Groups). You can create custom schedules on Profiles >

Schedule.

The Add Access Time Policy page allows you to add an access time policy.

Sophos XG Firewall | System | 53

1. Go to Objects > Policies > Access Time and click Add on the upper right side.

2. Enter the details.

Name

Enter a unique name to identify the policy.

Description

Enter the policy description.

Action

Click to choose the action to apply to the scheduled time period.

Available Options:Allow: Allows Internet access during the scheduled time period.Deny: Denies

Internet access during the scheduled time period.

Schedule

Select a schedule from the available options. You can apply access time policies only to recurring schedules. Hence, one time schedules do not appear in the drop-down list.

Available Options:All the TimeWork hours (5 Day Week)Work hours (6 Day Week)All time on

WeekdaysAll time on WeekendsAll time on Sunday

Based on the chosen action, Internet access is allowed or denied during the scheduled time period.

Note: Changes made in the access time policy become effective the instant you click Save.

Figure 28: Add Access Time Policy

3. Click Save.

Surfing Quotas

Surfing quota policy allows you to assign the duration of Internet surfing time to users and groups.

• Duration of Internet access can be cyclic or non-cyclic.

• You can apply the surfing quota policy to users.

The device is shipped with the following predefined policies. Predefined policies can be applied straight away to users and groups.

• Unlimited Internet Access

• 1 Month Unlimited Access

• 1 Month 100 hours

• Monthly 100 hours Cyclic

• Daily 1 hour Cyclic

• Weekly 7 hours Cyclic

Note:

Sophos XG Firewall | System | 54

1. Users generally belong to a group. If the surfing quota policy applied to the user differs from the one applied to the user’s group, the user’s policy takes priority.

2. For details of policies and rules to which the surfing quota policy can be applied, view the following diagram.

Add Surfing Quota

To assign the duration of Internet surfing time to users and groups, you can create surfing quota policies. These policies are then applied to users (Configure > Authentication > Users) and groups (Configure > Authentication >

Groups).

The Add Surfing Quota Policy page allows you to create a surfing quota policy.

1. Go to Protect > Web > Surfing Quotas or System > Profiles > Surfing Quotas and click Add on the upper right side.

Note: Surfing Quota policies can also be created when applying the policy to users or groups from the respective pages. The Surfing Quota page displays the full list of predefined and custom policies.

Sophos XG Firewall | System | 55

2. Enter the details.

Name

Enter a unique name to identify the policy.

Description

Enter a description for the surfing quota policy.

Cycle Type

Select the cycle type.

Available Options:Cyclic: Duration of Internet access recurs for each cycle.Non-Cyclic: When the specified time limit ends, the user is disconnected.

Cycle Hours (available only if Cycle Type is Cyclic)

Specify the cycle hours in hours and minutes. Select the cycle from the drop-down list. Cycle hours define the upper limit of surfing hours for daily, weekly, monthly or yearly cycles.

At the end of each cycle, cycle hours are reset to zero.

Example: If cycle hours specified are 7 hours 30 minutes for a daily cycle, they are reset to zero at the end of each day whether cycle hours are fully or partially used or remain unused.

Validity

Select Unlimited if you do not want to restrict the validity period. Clear the check box to specify the validity period of Internet access.

Maximum Hours

Select Unlimited if you do not want to restrict the maximum allowed surfing duration. Clear the check box to specify the maximum duration (in hours and minutes) of surfing time allowed across the validity period.

Example: Cyclic Policy

Cycle Hours: 5 hours per day

Validity: 5 days

Maximum Hours: 20 hours

If the user accesses Internet for 5 hours each day, the user will have used 20 hours of Internet access by the end of the fourth day and hence will be disconnected.

Example: Non-Cyclic Policy

Validity: 10 days

Maximum Hours: 10 hours

The user is disconnected at the end of 10 hours even if the validity period does not expire.

Sophos XG Firewall | System | 56

Figure 29: Add Surfing Quota Policy

3. Click Save.

Network Traffic Quota

The device offers two types of controls to limit bandwidth usage:

• Network Traffic Quota allows you to specify the data transfer limit. Example: User X is limited to 10 GB data transfer in a week.

• Traffic Shaping Policy (Configure > System Services > Traffic Shaping) allows you to control the speed of data transfer. Example: User X receives guaranteed 1 Mbps bandwidth during work hours.

Use the network traffic quota policy to specify differing types and levels of data transfer controls. Data transfer limits can be cyclic or non-cyclic. These can be based on:

• Total Data transfer (Upload + Download)

• Individual limits for Upload and Download

The device is shipped with the following predefined policies:

• 100 MB Total Data Transfer policy

• Daily 10 MB

Predefined policies are available for immediate use. You can create custom policies to specify differing data transfer limits to different users and groups.

For the policy to take effect, you must apply the network traffic quota policy to users (Configure > Authentication >

Users) or groups (Configure > Authentication > Groups) . Users generally belong to a group. If the network traffic quota policy applied to the user differs from the one applied to the user’s group, the user’s policy takes priority.

Create a New Network Traffic Quota Policy

To control data transfer by users and groups, you can create network traffic quota policies. For the policy to take effect, you must then apply it to users (Configure > Authentication > Users) and groups (Configure >

Authentication > Groups).

You can create the following types of policies:

•

Total Network Traffic - Cyclic Policy

•

Total Network Traffic - Non-Cyclic Policy

•

Individual Network Traffic - Cyclic Policy

•

Individual Network Traffic - Non-Cyclic Policy

Sophos XG Firewall | System | 57

1. Go to System > Profiles > Network Traffic Quota and click Add on the upper right side.

2. Enter the details.

Name

Enter a unique name to identify the policy.

Description

Enter a description for the network traffic quota policy.

Restriction Based On

Click to select the restriction based on the following options:

Available Options:Total Network Traffic: Specifies a single limit for data upload and download.

Individual Network Traffic (Upload and Download): Specifies different limits for data upload and download.

Cycle Type

Click to select the cycle type.

Available Options:Cyclic: Data transfer quota resets to zero at the beginning of each cycle. The user receives the full quota for each cycle. Unused quota is not carried forward to the next cycle.

Non-Cyclic: When data transfer reaches the specified limit, the policy expires and the user is disconnected.

Note: To restart the user's Internet access, go to Configure > Authentication >

Users and

Reset User Accounting

.

3. Based on the selection made in Restriction based on and Cycle Type, you can create any one of the following four types of policies: a) Policy 1: Total Network Traffic - Cyclic Policy

Cycle Period

Select the cycle period from the drop-down list. Cycle period specifies the duration of cyclic policies, that is, day, week, month and year.

Cycle Network Traffic

Specify the network traffic limit (in MB) per cycle. It specifies the data transfer allowed during each cycle to the user. When data transfer reaches the limit, the user is disconnected.

Maximum Network Traffic

By default, the check box is selected to Unlimited and no restriction is placed on the maximum data transfer for the duration of the policy. Clear the check box to specify the maximum data transfer (in

MB) allowed by the policy. When total data transfer reaches this limit, the user is disconnected.

Example: Cycle Period: Week

Cycle Network Traffic: 5 MB (5 MB data transfer is allocated to the user each week. The user is disconnected when this limit is reached during the week.)

Maximum Network Traffic: 10 MB (10 MB data transfer is allocated to the user for the duration of the policy. The user is disconnected when this limit is reached.)

Sophos XG Firewall | System | 58

Figure 30: Total Network Traffic - Cyclic Policy

b) Policy 2: Total Network Traffic - Non-Cyclic Policy

Maximum Network Traffic

By default, the check box is selected to Unlimited and no restriction is placed on the maximum data transfer for the duration of the policy. Clear the check box to specify the maximum data transfer (in

MB) allowed by the policy. When total data transfer reaches this limit, the user is disconnected.

Figure 31: Total Network Traffic - Non-Cyclic Policy

c) Policy 3: Individual Network Traffic - Cyclic Policy

Cycle Period

Select the cycle period from the drop-down list. Cycle period specifies the duration of cyclic policies, that is, day, week, month and year.

Cycle Upload Network Traffic

By default, the check box is selected to Unlimited and no restriction is placed on data upload during the cycle period. Clear the check box to specify the data upload limit (in MB) per cycle. The user cannot upload data once the cycle upload network traffic reaches the limit.

Cycle Download Network Traffic

Sophos XG Firewall | System | 59

By default, the check box is selected to Unlimited and no restriction is placed on data download during the cycle period. Clear the check box to specify the data download limit (in MB) per cycle.

The user cannot download data once the cycle download network traffic limit is reached.

Maximum Upload Network Traffic

By default, the check box is selected to Unlimited and no restriction is placed on data upload for the duration of the policy. Clear the check box to specify the maximum data upload allowed by the policy. The user cannot upload data once the upload network traffic limit is reached.

Example: Cycle Period: Week

Cycle Upload Network Traffic: 5 MB (5 MB data upload is allocated to the user each week. The user cannot upload data when this limit is reached during the week.)

Maximum Upload Network Traffic: 10 MB (10 MB data upload is allocated to the user for the duration of the policy. The user cannot upload data when this limit is reached.)

Maximum Download Network Traffic

By default, the check box is selected to Unlimited and no restriction is placed on data download for the duration of the policy. Clear the check box to specify the maximum data download allowed by the policy. The user cannot download data once the download network traffic limit is reached.

Example: Cycle Period: Week

Cycle Download Network Traffic: 5 MB (5 MB data download is allocated to the user each week.

The user cannot download data when this limit is reached during the week.)

Maximum Download Network Traffic: 10 MB (10 MB data download is allocated to the user for the duration of the policy. The user cannot download data when this limit is reached.)

Figure 32: Individual Network Traffic - Cyclic Policy

d) Policy 4: Individual Network Traffic - Non-Cyclic Policy

Maximum Upload Network Traffic

By default, the check box is selected to Unlimited and no restriction is placed on data upload for the duration of the policy. Clear the check box to specify the maximum data upload allowed by the policy. The user cannot upload data once the upload network traffic limit is reached.

Maximum Download Network Traffic

Sophos XG Firewall | System | 60

By default, the check box is selected to Unlimited and no restriction is placed on data download for the duration of the policy. Clear the check box to specify the maximum data download allowed by the policy. The user cannot download data once the download network traffic limit is reached.

Figure 33: Individual Network Traffic - Non-Cyclic Policy

4. Click Save.

Note: Cycle Network Traffic limit cannot be greater than Maximum Network Traffic limit.

Network Address Translation

Network Address Translation (NAT) enables multiple hosts within your network to access Internet through a single public IP address. In doing so, NAT not only conserves the pool of public IP addresses, it also conceals the addressing scheme of your network.

When a client within the network sends a request to the Internet, the router forwards the request to the device. NAT translates the sender’s address to the device’s public IP address before forwarding the request to the Internet. When a response is received from an external source, NAT translates the public IP address into the client’s private IP address before forwarding the packet to the client.

The device is shipped with a predefined NAT policy named MASQ . The MASQ policy automatically masquerades traffic using the IP address that is bound to the device’s WAN port. The predefined MASQ policy cannot be modified or deleted.

For it to take effect, the NAT policy must be applied to a Firewall Rule (Protect > Firewall). For further details, go to

User / Network Rule

.

Related tasks

Add NAT Policy

on page 61

To enable internal hosts to access the Internet through a public IP address, create a Network Address Translation

(NAT) policy. The policy specifies the public IP addresses through which NATing can take place. The NAT policy must then be applied to a Firewall Rule (Protect > Firewall).

Sophos XG Firewall | System | 61

Add NAT Policy

To enable internal hosts to access the Internet through a public IP address, create a Network Address Translation

(NAT) policy. The policy specifies the public IP addresses through which NATing can take place. The NAT policy must then be applied to a Firewall Rule (Protect > Firewall).

This page describes how to create a NAT policy.

1. Go to System > Profiles > Network Address Translation and click Add on the upper right side.

2. Enter the details.

Name

Enter a name to identify the NAT Policy.

IP Address

Select to configure the public IP address.

Available Options:IP Address: Replaces the source IP Address with the configured public IP

Address. IP Range: Replaces the source IP Address with any one of the public IP Addresses from the specified range.

You can search for a specific IP Address based on the host name. To add a new IP address or IP range, click Create New. Alternately, you can add it from System > Hosts and Services > IP Host.

Note: MASQ is the default NAT policy and cannot be modified or deleted.

Figure 34: Add NAT Policy

3. Click Save.

Device Access

The device allows you to create role-based administrator privileges which offer granular access control. It allows you to assign some of the super administrator's capabilities to others through Device Access Profiles. You can create profiles for special-purpose administrators based on their work role. Example: Policy administration, network administration, administration of logs.

The Profiles allow three categories of access control:

• None

• Read-Only

• Read-Write

The device is shipped with the following default profiles:

• Administrator: Super administrator with full privileges. Administrator can create custom administrators and assign restricted or full privileges to them. Custom administrators with restricted privileges can update only their email address and password.

• Audit Admin: Read-write privileges only to Logs & Reports.

• Crypto Admin: Read-write privileges only for configuration of security certificate.

• HAProfile: Read-only privileges. If High Availability (HA) is configured, administrators accessing the Admin

Console of the auxiliary device have the privileges that are defined in the HA Profile.

• Security Admin: Read-write privileges to all features, not including Profiles and Logs & Reports.

Note:

Sophos XG Firewall | System | 62

• You cannot modify or delete the default profiles.

• You cannot delete a profile that is currently assigned to an administrator.

Add Profile

The device allows you to create multiple administrator profiles with differing levels of access control.

1. Go to System > Profiles > Device Access and click Add.

2. Enter the profile details.

Profile Name

Enter a unique name to identify the profile.

Configuration

Click to select the level of access to be given to a profile. You can select from the following levels of access:

Available Options:

None: No access to any page Read-Only: View the pages Read-Write: Modify the details

To set a common access level for all the menus, select the options at the top (None, Read-Only or

Read-Write). To set different access levels, select the option against the menu.

Click on the left side of a menu to view the sub-menu. To set differing access levels for submenus, select the option against the sub-menu.

Example: If you set the access level to Read-Only against Licensing, the profile user can view the

Licensing page but cannot make any modifications. To allow modifications, set the access level to

Read-Write.

Note:

Access Denied page

When an administrator tries to access a page or perform an operation that is not allowed by the assigned profile, the Access Denied page is displayed.