Administration. Sophos v16.5

Sophos XG Firewall | System | 71

The Add Service Group page allows you to manually enter details and configure a new service group.

1. Go to System > Hosts and Services > Service Group and click Add.

2. Enter Service Group details.

Name

Enter a name to identify the Service Group.

Description

Service Group Description.

Select Service

Service List displays all the services including default services.

Click the checkbox to select the service. All the selected services are moved to the Selected Service list.

Single service can be a member of multiple groups.

Use Search to search a service from the list.

You can create a group containing IPv4 and IPv6 services.

Figure 43: Add Service Group

3. Click Save.

Administration

Administration allows you to manage device licenses and time, administrator access, centralized updates, network bandwidth and device monitoring and user notifications.

You can configure the following:

•

Licensing

: Synchronization and renewal of device and module subscriptions

•

Device Access

: Administrator access to device services

•

Admin Settings

: Port and login security settings for administrators

•

Central Management

: Centralized synchronization and signature updates

•

Time

: Time and date of the device

•

Notification Settings

: Mail server and email settings to send and receive alerts

•

SNMP

: Device monitoring

•

Netflow

: Network bandwidth monitoring

•

Messages

: User notifications and administrator disclaimer

Sophos XG Firewall | System | 72

Licensing

All the modules remain unsubscribed when you deploy the device for the first time. Licensing displays the device registration information and the subscription status. You can activate or evaluate subscription modules.

Cyberoam and UTM 9 customers can migrate their licenses to SF-OS.

Basic Information

The device offers two types of modules:

• Basic module: Firewall, VPN, Wireless.

• Subscription modules:

• Base Firewall - Includes Firewall, VPN, Wireless

• Network Protection - Includes Intrusion Prevention System, RED, Advanced Threat Protection

• Web Protection - Includes Web Categorization, Anti Virus, Application Control

• Email Protection - Includes Anti Spam, Anti Virus, Email Encryption, DLP

• Webserver Protection - Includes WAF, Anti Virus, Reverse Proxy

• Sandstorm - Includes the Sandstorm service and all related settings

• Enhanced Support - 8 x 5

• Enhanced Plus Support - 24 x 7

Once registered, the device can be used for an indefinite time period.

You can subscribe to any of the subscription modules:

• without key for free 30-days trial subscription

• with key

Device Registration Details

Model

Device model number which is registered and its device key.

Company Name

Name of the company under which the device is registered.

Contact Person

Name of the contact person in the company.

Registered Email Address

Email address used for device registration.

Activate Subscription

Individual modules can be subscribed using the license key.

Note: Activate Subscription will be enabled for clicking after the original license of the device will be migrated to SF-OS from CyberoamOS or UTM 9 using Migrate

License under License Upgrade section.

Module Subscription Details

Synchronize

Click to synchronize licenses with your account.

Activate Evaluations

Individual modules can be evaluated for the duration of 30 days.

Note: Activate Evaluations will be enabled for clicking after the original license of the device will be migrated to SF-OS from CyberoamOS or UTM 9 using Migrate

License under License Upgrade section.

Sophos XG Firewall | System | 73

Module

Name of the Module.

Status

Indicates the status of the module.

A module can have the following status

• Subscribed - Module is subscribed.

• Evaluating - Module is subscribed under evaluation.

• Unsubscribed - Module is not subscribed.

• Expired - Subscription is expired.

Expiration Date

Module subscription expiry date.

License Upgrade

You can migrate licenses from CyberoamOS or UTM 9 to Sophos Firewall OS (SF-OS).

Migrate UTM 9 License

Transfers your current UTM 9 license to an equivalent SF-OS installation. The migration is irreversible and you can no longer use this license on UTM 9.

Note: Migrate UTM 9 License is available only if you have migrated from UTM 9 to SF-OS.

Migrate Cyberoam license

This option will provide you with Sophos Firewall OS license of equivalent monetary value as your

Cyberoam license. All the licenses existing in Cyberoam will be migrated to SF-OS.

Note: Migrate Cyberoam License is available only if you have migrated from

Cyberoam to SF-OS.

Note: Available only when device registration is complete.

Activate Subscription

1. Go to System > Administration > Licensing and click Activate Subscription within Device Registration

Details.

2. Enter the license key.

3. Click Verify Key. Subscription is activated if the license key is found valid.

Device Access

Device Access allows you to limit administrative access to certain services from custom and default zones (LAN,

WAN, DMZ, VPN, Wi-Fi).

1. Local Service ACL: The device carries a default ACL (Access Control List) when connected and powered on for the first time. Details of the default services and ports are given below. Click to enable or disable access to the services from the specified zones.

Admin Services

LAN and Wi-Fi Zones: HTTPS (TCP port 4444), Telnet (TCP port 23) and SSH (TCP port 22)

WAN Zone: HTTPS (TCP port 443), Telnet (TCP port 23) and SSH (TCP port 22)

Authentication Services

LAN and Wi-Fi Zones: Client Authentication (UDP port 6060), Captive Portal Authentication (TCP port 8090) and RADIUS SSO.

Network Services

Sophos XG Firewall | System | 74

LAN, WAN, and Wi-Fi Zones: Ping/Ping6 and DNS

Other Services

LAN and Wi-Fi Zones: Wireless Protection, Web Proxy and SMTP relay

LAN, WAN, DMZ and Wi-Fi Zones: SSL VPN (TCP port 8443)

LAN and WAN Zones: User portal and dynamic routing

LAN, DMZ, VPN and Wi-Fi Zones: SNMP

Note: User authentication services are required in order to apply user-based Internet surfing, bandwidth, and data transfer restrictions. These are not required for administrative functions.

2. Local Service ACL Exception Rule: You can allow access to the device's admin services from specified networks/hosts. A list of all the configured rules is displayed.

Note: Once you upgrade SF-OS v15 to v16:

• If HTTP is enabled in SF-OS v15, all HTTP requests are redirected to HTTPS.

• HTTP rules in which the action is set to Drop are deleted.

3. Default Admin Password Settings:

a) Change the default password as soon as you deploy the device.

Note: The device is shipped with a default super admin with the username and password set to admin.

You can access the Admin Console and CLI with these credentials. This administrator is authenticated locally by the device.

b) Click Reset to Default to restore the factory default password.

Figure 44: Default Admin Password Settings

4. Public Key Authentication

a) Turn on Public key authentication for admin to allow access to the Command Line Interface (CLI) using the

SSH Key.

Note: If you are not logged in as the default admin, you must provide the password for authorization.

b) Add the list of Authorized keys for admin. Generate these SSH keys using SSH client tools (example:

PuTTY).

Sophos XG Firewall | System | 75

Figure 45: Public Key Authentication

Related information

Disable Telnet and HTTP behavior

Add Local Service ACL Exception Rule

Use Local Service ACL Exception Rule to allow access to the device's admin services from a specified network/ host.

1. Go to System > Administration > Device Access and click Add under Local Service ACL Exception Rule.

2. Enter a name.

3. Select the Rule Position.

4. Enter a description.

5. Select the IP Family from the following options:

Available Options:

• IPv4

• IPv6

6. Select the Source Zone to which the rule applies.

7. Click Add New Item to select a host or network address to which the rule applies. Click Create New to create a new network/host.

8. Click Add New Item to select the admin Services to which the rule applies.

Available Options:

• HTTPS

• Telnet

• SSH

• Web Proxy

• DNS

• Ping/Ping6

• SSL VPN

• User Portal

• Dynamic Routing

9. Select an Action:

Available Options:

• Accept

• Drop

Sophos XG Firewall | System | 76

Figure 46: Add Local Service ACL Exception Rule

10. Click Save.

Admin Settings

Admin Settings allows you to modify the admin port settings and login parameters. Customize the login parameters to restrict local and remote user access based on time duration.

1. Enter host details a) Enter a name in the form of a Fully Qualified Domain Name (FQDN).

Acceptable Range: 0 to 256 characters

Example: security.sophos.com

Note: When the device is deployed for the first time, the serial ID of the device is saved as the hostname.

b) Enter the description.

Sophos XG Firewall | System | 77

Figure 47: Hostname

2. Configure Admin Port settings a) Displays the HTTP port configured in SF-OS v15 if you have upgraded from SF-OS v15 and enabled HTTP service.

Default: 80

Note: From v16 onwards, the device does not support access of Admin console on this port. Traffic on

HTTP port is automatically redirected to HTTPS port.

b) Enter the port number to configure the HTTPS port for secure Admin Console access.

Default: 4444 c) Enter the port number to configure the HTTPS port for secure User Portal access.

Default: 443 d) Select the Certificate to be used by User Portal, Captive Portal, SPX Registration Portal and SPX Reply

Portal.

Figure 48: Admin Port Settings

3. Set login security for Administrators a) Select the checkbox and configure the duration (in minutes) of inactivity for the administrative session after which the device is locked automatically. This configuration is applicable to Admin and CLI Console, IPsec

Connection Wizard, Network Wizard, Group Import Wizard.

Default: 3 minutes b) Select the checkbox and configure the period (in minutes) of inactivity after which the administrator is logged out automatically.

Default: 10 minutes

Note: The Logout Admin Session After value must be greater than the Lock Admin Session After value.

c) Select the checkbox to block login to the Admin Console and CLI. Enter the maximum number of failed login attempts and the duration (in seconds) within which the attempts can be made from a single IP address. When the failed attempts exceed the number, the administrator is locked. Specify the number of minutes for which the administratorwill not be allowed to login. The administrator account will be locked for the configured minutes if the allowed failed login attempts exceeds.

Sophos XG Firewall | System | 78

Figure 49: Login Security Settings

4. Select the checkbox to enable password complexity settings for Administrators and enforce the required constraints.

Figure 50: Administrator Password Complexity Settings

5. Select Enable Login Disclaimer to set messages for authentication, SMTP, administration and SMS customization, which administrators must agree to before they can log in to the Admin Console and CLI. You can customize and preview messages too.

Figure 51: Login Disclaimer Settings

6. Select Sophos Adaptive Learning to send the following application usage and threat data to Sophos: Unclassified applications (to improve network visibility and enlarge the application control library), Data for IPS alerts, detected virus (including URLs), spam, ATP threats such as threat name, threat URL/IP, source IP, and applications used.

The device sends periodic information to Sophos over HTTPS to improve stability, prioritize feature refinements, and to improve protection effectiveness. No user-specific information or personalized information is collected.

The device sends configuration and usage data by default. This includes device information (example: model, hardware version, vendor), firmware version and license information (does not include owner information), features that are in use (status, on/off, count, HA status, central management status), configured objects (example: count of hosts, policies), product errors, and CPU, memory and disk usage (in percentage).

Sophos XG Firewall | System | 79

Figure 52: Sophos Adaptive Learning

Central Management

Sophos Firewall Manager (Firewall Manager) centrally manages your Sophos Firewall (device). Central Management allows you to configure keep-alive requests and to enable configuration and signature updates of the device through the Firewall Manager.

1. Go to System > Administration > Central Management and select Enable Central Management.

2. Enter the IP Address/Domain of the Firewall Manager.

3. Select Device Management to enable keep-alive requests and configuration updates.

1. Specify the Communication Details. Specify the Heartbeat Protocol and Heartbeat Port to define how keep-alive information is sent to the Firewall Manager.

Note: We recommend that you set Heartbeat Protocol to Syslog.

2. Specify the Configuration Synchronization settings.

a. Select the Synchronization Mode from the following options:

Available Options:

• Central Management will push configuration changes to the device

• Device will fetch configuration changes from Central Management

b. Connection Protocol to send configuration updates is set to HTTPS.

c. Enter the Port over which configuration updates are to be sent.

Default: 443

4. Select Content Distribution to receive signature updates from the Firewall Manager.

1. Enter the Content Distribution Port over which the Firewall Manager pushes signature updates.

Default: 80

Note: Enter the same port number that is configured in Administration Settings of Firewall Manager.

Figure 53: Central Management Settings

Note: Restrictions apply if you are managing SF-OS V16 devices from SFM-OS V15. For details refer to

Appendix F - Compatibility with SFMOS 15.01.0

on page 629.

Sophos XG Firewall | System | 80

Time

You can set the time and date to the device's clock or synchronize the device with a Network Time Protocol (NTP) server.

1. Go to System > Administration > Time.

2. Current Time displays the device time and date.

3. Select the Time Zone based on the location in which the device is deployed.

4. Select from the following options to choose how you set the time and date:

• Use pre-defined NTP server (pool.ntp.org). The device uses NTP version 3 (RFC 1305). Click to Sync Now.

• Use Custom NTP server. Enter the IPv4 address or IPv6 address or domain name. You can configure up to 10

NTP servers. At the time of synchronization, the device queries the configured NTP servers sequentially until it receives a valid reply from a server. Click to Sync Now.

• Select Do not use NTP Server to configure the date and time based on the device’s clock. Set the date and time.

Figure 54: Setting Device's Date and Time

Notification Settings

Notification Settings allows you to configure the mail server IP address, port, and email address to send and receive alert emails.

The device allows you to configure email notifications for system-generated events and reports to inform the administrator about:

• Change in gateway status

• Change in HA (high availability) link status (if HA cluster is configured)

• Change in the state of IPsec tunnels

1. Mail Server Settings

Click to Send Notifications Via:

Built-in Email Server

Select if you want to use the built-in Email Server in the Device to send system-generated emails.

Sophos XG Firewall | System | 81

External Email Server

Select to configure an External Email Server to send system-generated emails.

1. Specify the Mail Server IPv4 Address or FQDN Address and Port Number. Default Port: 25

2. Select Authentication Required to authenticate the user before sending an email. Specify Username and

Password.

3. Select Connection Security mode to be used for establishing a secured connection between an SMTP client and the SMTP server for SMTP mail notification. Available Options:

• None

• STARTTLS

• SSL/TLS

Default: None

4. Select a Certificate to be used for authentication by the SMTP client and the SMTP server.

Default: ApplicanceCertificate

Figure 55: Mail Server Settings

2. Email Settings

Enter the sender and recipient email addresses.

Figure 56: Email Settings

3. Email Notification

Select IPsec Tunnel UP/Down to enable receipt of email notifications if IPsec VPN tunnel connectivity is lost.

Email alerts are sent to the configured email address.

An email is sent only when Host-to-Host and Site-to-Site tunnel connections are disconnected for one of the following reasons:

• A peer is found dead (DPD)

• Failed to re-establish connection after Dead Peer Detection (DPD)

• IPsec Security Association (SA) is expired and is required to be re-established.

• IPsec tunnel comes up without administrator intervention after losing the connectivity.

Note:

• An email is sent for each subnet pair in case of Site-to-Site connections with multiple local/remote networks.

Sophos XG Firewall | System | 82

• An email sent when the IPsec tunnel comes up do not have any reason mentioned within.

• Description of IPsec tunnel connection is included in the email only if the administrator has provided the information.

Figure 57: The email contains the following Notification

4. Test Mail

Click to preview and edit the email address details.

Click Send.

Note: Mail server configuration changes automatically when the changes are made from the Network

Configuration Wizard and vice versa.

SNMP

SNMP (Simple Network Management Protocol) allows you to configure the Sophos Firewall device as an SNMP agent. The device responds to multiple SNMP managers within the predefined communities. You can monitor multiple firewall devices on IP networks for device availability, CPU, memory and disk utilization, availability of critical services and more. The device stores information in a Management Information Base (MIB) and replies to

SNMP Get commands for MIB. Click

here

to download the Sophos MIB file. It also sends SNMP traps (alerts) to the

SNMP manager.

SNMP collects information in two ways:

• SNMP manager polls the agents.

• Agents send traps to the SNMP manager.

SNMP Community consists of a manager and a group of agents. Agents can belong to more than one SNMP community. The community defines where information is sent. An agent does not respond to requests from managers that do not belong to its communities. You must specify a trap version for each community. Each community can support SNMPv1 and SNMPv2c. Sophos Firewall device supports IPv4 and IPv6 addresses.

Agent Configuration allows you to configure the agent details.

Community displays a list of all the communities. You can sort, add, update, or delete communities.

SNMP Agent Configuration

SNMP Agent Configuration allows you to configure the device as an SNMP agent.

1. Go to System > Administration > SNMP.

2. Select to enable the SNMP Agent.

3. Enter a name.

4. Enter the description.

5. Enter the physical location of the device.

6. Enter the contact information of the person responsible for maintaining the device.

7. The Agent Port uses UDP port 161. This port receives GET requests from the SNMP managers.

8. Specify the Manager Port over which the SNMP manager receives alerts/traps from the SNMP agent.

Default: 162

Sophos XG Firewall | System | 83

Figure 58: Agent Configuration

Add Community

You can add an SNMP community.

1. Go to System > Administration > SNMP and click Add.

2. Enter a name.

3. Enter the description.

4. Enter the IP address (IPv4/IPv6) of the SNMP manager.

5. Select the SNMP protocol version. SNMP v1 and v2c-compliant SNMP managers have read-only access to device system information and can receive device traps.

6. Select the version for trap support. Traps are sent only to SNMP managers that support the specified versions.

7. Click Save.

Figure 59: Add SNMP Community