Administration. Sophos v16.5
Advertisement
Advertisement
Sophos XG Firewall | System | 71
The Add Service Group page allows you to manually enter details and configure a new service group.
1. Go to System > Hosts and Services > Service Group and click Add.
2. Enter Service Group details.
Name
Enter a name to identify the Service Group.
Description
Service Group Description.
Select Service
Service List displays all the services including default services.
Click the checkbox to select the service. All the selected services are moved to the Selected Service list.
Single service can be a member of multiple groups.
Use Search to search a service from the list.
You can create a group containing IPv4 and IPv6 services.
Figure 43: Add Service Group
3. Click Save.
Administration
Administration allows you to manage device licenses and time, administrator access, centralized updates, network bandwidth and device monitoring and user notifications.
You can configure the following:
•
: Synchronization and renewal of device and module subscriptions
•
: Administrator access to device services
•
: Port and login security settings for administrators
•
: Centralized synchronization and signature updates
•
•
: Mail server and email settings to send and receive alerts
•
•
: Network bandwidth monitoring
•
: User notifications and administrator disclaimer
Sophos XG Firewall | System | 72
Licensing
All the modules remain unsubscribed when you deploy the device for the first time. Licensing displays the device registration information and the subscription status. You can activate or evaluate subscription modules.
Cyberoam and UTM 9 customers can migrate their licenses to SF-OS.
Basic Information
The device offers two types of modules:
• Basic module: Firewall, VPN, Wireless.
• Subscription modules:
• Base Firewall - Includes Firewall, VPN, Wireless
• Network Protection - Includes Intrusion Prevention System, RED, Advanced Threat Protection
• Web Protection - Includes Web Categorization, Anti Virus, Application Control
• Email Protection - Includes Anti Spam, Anti Virus, Email Encryption, DLP
• Webserver Protection - Includes WAF, Anti Virus, Reverse Proxy
• Sandstorm - Includes the Sandstorm service and all related settings
• Enhanced Support - 8 x 5
• Enhanced Plus Support - 24 x 7
Once registered, the device can be used for an indefinite time period.
You can subscribe to any of the subscription modules:
• without key for free 30-days trial subscription
• with key
Device Registration Details
Model
Device model number which is registered and its device key.
Company Name
Name of the company under which the device is registered.
Contact Person
Name of the contact person in the company.
Registered Email Address
Email address used for device registration.
Activate Subscription
Individual modules can be subscribed using the license key.
Note: Activate Subscription will be enabled for clicking after the original license of the device will be migrated to SF-OS from CyberoamOS or UTM 9 using Migrate
License under License Upgrade section.
Module Subscription Details
Synchronize
Click to synchronize licenses with your account.
Activate Evaluations
Individual modules can be evaluated for the duration of 30 days.
Note: Activate Evaluations will be enabled for clicking after the original license of the device will be migrated to SF-OS from CyberoamOS or UTM 9 using Migrate
License under License Upgrade section.
Sophos XG Firewall | System | 73
Module
Name of the Module.
Status
Indicates the status of the module.
A module can have the following status
• Subscribed - Module is subscribed.
• Evaluating - Module is subscribed under evaluation.
• Unsubscribed - Module is not subscribed.
• Expired - Subscription is expired.
Expiration Date
Module subscription expiry date.
License Upgrade
You can migrate licenses from CyberoamOS or UTM 9 to Sophos Firewall OS (SF-OS).
Migrate UTM 9 License
Transfers your current UTM 9 license to an equivalent SF-OS installation. The migration is irreversible and you can no longer use this license on UTM 9.
Note: Migrate UTM 9 License is available only if you have migrated from UTM 9 to SF-OS.
Migrate Cyberoam license
This option will provide you with Sophos Firewall OS license of equivalent monetary value as your
Cyberoam license. All the licenses existing in Cyberoam will be migrated to SF-OS.
Note: Migrate Cyberoam License is available only if you have migrated from
Cyberoam to SF-OS.
Note: Available only when device registration is complete.
Activate Subscription
1. Go to System > Administration > Licensing and click Activate Subscription within Device Registration
Details.
2. Enter the license key.
3. Click Verify Key. Subscription is activated if the license key is found valid.
Device Access
Device Access allows you to limit administrative access to certain services from custom and default zones (LAN,
WAN, DMZ, VPN, Wi-Fi).
1. Local Service ACL: The device carries a default ACL (Access Control List) when connected and powered on for the first time. Details of the default services and ports are given below. Click to enable or disable access to the services from the specified zones.
Admin Services
LAN and Wi-Fi Zones: HTTPS (TCP port 4444), Telnet (TCP port 23) and SSH (TCP port 22)
WAN Zone: HTTPS (TCP port 443), Telnet (TCP port 23) and SSH (TCP port 22)
Authentication Services
LAN and Wi-Fi Zones: Client Authentication (UDP port 6060), Captive Portal Authentication (TCP port 8090) and RADIUS SSO.
Network Services
Sophos XG Firewall | System | 74
LAN, WAN, and Wi-Fi Zones: Ping/Ping6 and DNS
Other Services
LAN and Wi-Fi Zones: Wireless Protection, Web Proxy and SMTP relay
LAN, WAN, DMZ and Wi-Fi Zones: SSL VPN (TCP port 8443)
LAN and WAN Zones: User portal and dynamic routing
LAN, DMZ, VPN and Wi-Fi Zones: SNMP
Note: User authentication services are required in order to apply user-based Internet surfing, bandwidth, and data transfer restrictions. These are not required for administrative functions.
2. Local Service ACL Exception Rule: You can allow access to the device's admin services from specified networks/hosts. A list of all the configured rules is displayed.
Note: Once you upgrade SF-OS v15 to v16:
• If HTTP is enabled in SF-OS v15, all HTTP requests are redirected to HTTPS.
• HTTP rules in which the action is set to Drop are deleted.
3. Default Admin Password Settings:
a) Change the default password as soon as you deploy the device.
Note: The device is shipped with a default super admin with the username and password set to admin.
You can access the Admin Console and CLI with these credentials. This administrator is authenticated locally by the device.
b) Click Reset to Default to restore the factory default password.
Figure 44: Default Admin Password Settings
4. Public Key Authentication
a) Turn on Public key authentication for admin to allow access to the Command Line Interface (CLI) using the
SSH Key.
Note: If you are not logged in as the default admin, you must provide the password for authorization.
b) Add the list of Authorized keys for admin. Generate these SSH keys using SSH client tools (example:
PuTTY).
Sophos XG Firewall | System | 75
Figure 45: Public Key Authentication
Related information
Disable Telnet and HTTP behavior
Add Local Service ACL Exception Rule
Use Local Service ACL Exception Rule to allow access to the device's admin services from a specified network/ host.
1. Go to System > Administration > Device Access and click Add under Local Service ACL Exception Rule.
2. Enter a name.
3. Select the Rule Position.
4. Enter a description.
5. Select the IP Family from the following options:
Available Options:
• IPv4
• IPv6
6. Select the Source Zone to which the rule applies.
7. Click Add New Item to select a host or network address to which the rule applies. Click Create New to create a new network/host.
8. Click Add New Item to select the admin Services to which the rule applies.
Available Options:
• HTTPS
• Telnet
• SSH
• Web Proxy
• DNS
• Ping/Ping6
• SSL VPN
• User Portal
• Dynamic Routing
9. Select an Action:
Available Options:
• Accept
• Drop
Sophos XG Firewall | System | 76
Figure 46: Add Local Service ACL Exception Rule
10. Click Save.
Admin Settings
Admin Settings allows you to modify the admin port settings and login parameters. Customize the login parameters to restrict local and remote user access based on time duration.
1. Enter host details a) Enter a name in the form of a Fully Qualified Domain Name (FQDN).
Acceptable Range: 0 to 256 characters
Example: security.sophos.com
Note: When the device is deployed for the first time, the serial ID of the device is saved as the hostname.
b) Enter the description.
Sophos XG Firewall | System | 77
Figure 47: Hostname
2. Configure Admin Port settings a) Displays the HTTP port configured in SF-OS v15 if you have upgraded from SF-OS v15 and enabled HTTP service.
Default: 80
Note: From v16 onwards, the device does not support access of Admin console on this port. Traffic on
HTTP port is automatically redirected to HTTPS port.
b) Enter the port number to configure the HTTPS port for secure Admin Console access.
Default: 4444 c) Enter the port number to configure the HTTPS port for secure User Portal access.
Default: 443 d) Select the Certificate to be used by User Portal, Captive Portal, SPX Registration Portal and SPX Reply
Portal.
Figure 48: Admin Port Settings
3. Set login security for Administrators a) Select the checkbox and configure the duration (in minutes) of inactivity for the administrative session after which the device is locked automatically. This configuration is applicable to Admin and CLI Console, IPsec
Connection Wizard, Network Wizard, Group Import Wizard.
Default: 3 minutes b) Select the checkbox and configure the period (in minutes) of inactivity after which the administrator is logged out automatically.
Default: 10 minutes
Note: The Logout Admin Session After value must be greater than the Lock Admin Session After value.
c) Select the checkbox to block login to the Admin Console and CLI. Enter the maximum number of failed login attempts and the duration (in seconds) within which the attempts can be made from a single IP address. When the failed attempts exceed the number, the administrator is locked. Specify the number of minutes for which the administratorwill not be allowed to login. The administrator account will be locked for the configured minutes if the allowed failed login attempts exceeds.
Sophos XG Firewall | System | 78
Figure 49: Login Security Settings
4. Select the checkbox to enable password complexity settings for Administrators and enforce the required constraints.
Figure 50: Administrator Password Complexity Settings
5. Select Enable Login Disclaimer to set messages for authentication, SMTP, administration and SMS customization, which administrators must agree to before they can log in to the Admin Console and CLI. You can customize and preview messages too.
Figure 51: Login Disclaimer Settings
6. Select Sophos Adaptive Learning to send the following application usage and threat data to Sophos: Unclassified applications (to improve network visibility and enlarge the application control library), Data for IPS alerts, detected virus (including URLs), spam, ATP threats such as threat name, threat URL/IP, source IP, and applications used.
The device sends periodic information to Sophos over HTTPS to improve stability, prioritize feature refinements, and to improve protection effectiveness. No user-specific information or personalized information is collected.
The device sends configuration and usage data by default. This includes device information (example: model, hardware version, vendor), firmware version and license information (does not include owner information), features that are in use (status, on/off, count, HA status, central management status), configured objects (example: count of hosts, policies), product errors, and CPU, memory and disk usage (in percentage).
Sophos XG Firewall | System | 79
Figure 52: Sophos Adaptive Learning
Central Management
Sophos Firewall Manager (Firewall Manager) centrally manages your Sophos Firewall (device). Central Management allows you to configure keep-alive requests and to enable configuration and signature updates of the device through the Firewall Manager.
1. Go to System > Administration > Central Management and select Enable Central Management.
2. Enter the IP Address/Domain of the Firewall Manager.
3. Select Device Management to enable keep-alive requests and configuration updates.
1. Specify the Communication Details. Specify the Heartbeat Protocol and Heartbeat Port to define how keep-alive information is sent to the Firewall Manager.
Note: We recommend that you set Heartbeat Protocol to Syslog.
2. Specify the Configuration Synchronization settings.
a. Select the Synchronization Mode from the following options:
Available Options:
• Central Management will push configuration changes to the device
• Device will fetch configuration changes from Central Management
b. Connection Protocol to send configuration updates is set to HTTPS.
c. Enter the Port over which configuration updates are to be sent.
Default: 443
4. Select Content Distribution to receive signature updates from the Firewall Manager.
1. Enter the Content Distribution Port over which the Firewall Manager pushes signature updates.
Default: 80
Note: Enter the same port number that is configured in Administration Settings of Firewall Manager.
Figure 53: Central Management Settings
Note: Restrictions apply if you are managing SF-OS V16 devices from SFM-OS V15. For details refer to
Appendix F - Compatibility with SFMOS 15.01.0
Sophos XG Firewall | System | 80
Time
You can set the time and date to the device's clock or synchronize the device with a Network Time Protocol (NTP) server.
1. Go to System > Administration > Time.
2. Current Time displays the device time and date.
3. Select the Time Zone based on the location in which the device is deployed.
4. Select from the following options to choose how you set the time and date:
• Use pre-defined NTP server (pool.ntp.org). The device uses NTP version 3 (RFC 1305). Click to Sync Now.
• Use Custom NTP server. Enter the IPv4 address or IPv6 address or domain name. You can configure up to 10
NTP servers. At the time of synchronization, the device queries the configured NTP servers sequentially until it receives a valid reply from a server. Click to Sync Now.
• Select Do not use NTP Server to configure the date and time based on the device’s clock. Set the date and time.
Figure 54: Setting Device's Date and Time
Notification Settings
Notification Settings allows you to configure the mail server IP address, port, and email address to send and receive alert emails.
The device allows you to configure email notifications for system-generated events and reports to inform the administrator about:
• Change in gateway status
• Change in HA (high availability) link status (if HA cluster is configured)
• Change in the state of IPsec tunnels
1. Mail Server Settings
Click to Send Notifications Via:
Built-in Email Server
Select if you want to use the built-in Email Server in the Device to send system-generated emails.
Sophos XG Firewall | System | 81
External Email Server
Select to configure an External Email Server to send system-generated emails.
1. Specify the Mail Server IPv4 Address or FQDN Address and Port Number. Default Port: 25
2. Select Authentication Required to authenticate the user before sending an email. Specify Username and
Password.
3. Select Connection Security mode to be used for establishing a secured connection between an SMTP client and the SMTP server for SMTP mail notification. Available Options:
• None
• STARTTLS
• SSL/TLS
Default: None
4. Select a Certificate to be used for authentication by the SMTP client and the SMTP server.
Default: ApplicanceCertificate
Figure 55: Mail Server Settings
2. Email Settings
Enter the sender and recipient email addresses.
Figure 56: Email Settings
3. Email Notification
Select IPsec Tunnel UP/Down to enable receipt of email notifications if IPsec VPN tunnel connectivity is lost.
Email alerts are sent to the configured email address.
An email is sent only when Host-to-Host and Site-to-Site tunnel connections are disconnected for one of the following reasons:
• A peer is found dead (DPD)
• Failed to re-establish connection after Dead Peer Detection (DPD)
• IPsec Security Association (SA) is expired and is required to be re-established.
• IPsec tunnel comes up without administrator intervention after losing the connectivity.
Note:
• An email is sent for each subnet pair in case of Site-to-Site connections with multiple local/remote networks.
Sophos XG Firewall | System | 82
• An email sent when the IPsec tunnel comes up do not have any reason mentioned within.
• Description of IPsec tunnel connection is included in the email only if the administrator has provided the information.
Figure 57: The email contains the following Notification
4. Test Mail
Click to preview and edit the email address details.
Click Send.
Note: Mail server configuration changes automatically when the changes are made from the Network
Configuration Wizard and vice versa.
SNMP
SNMP (Simple Network Management Protocol) allows you to configure the Sophos Firewall device as an SNMP agent. The device responds to multiple SNMP managers within the predefined communities. You can monitor multiple firewall devices on IP networks for device availability, CPU, memory and disk utilization, availability of critical services and more. The device stores information in a Management Information Base (MIB) and replies to
SNMP Get commands for MIB. Click
here
to download the Sophos MIB file. It also sends SNMP traps (alerts) to the
SNMP manager.
SNMP collects information in two ways:
• SNMP manager polls the agents.
• Agents send traps to the SNMP manager.
SNMP Community consists of a manager and a group of agents. Agents can belong to more than one SNMP community. The community defines where information is sent. An agent does not respond to requests from managers that do not belong to its communities. You must specify a trap version for each community. Each community can support SNMPv1 and SNMPv2c. Sophos Firewall device supports IPv4 and IPv6 addresses.
Agent Configuration allows you to configure the agent details.
Community displays a list of all the communities. You can sort, add, update, or delete communities.
SNMP Agent Configuration
SNMP Agent Configuration allows you to configure the device as an SNMP agent.
1. Go to System > Administration > SNMP.
2. Select to enable the SNMP Agent.
3. Enter a name.
4. Enter the description.
5. Enter the physical location of the device.
6. Enter the contact information of the person responsible for maintaining the device.
7. The Agent Port uses UDP port 161. This port receives GET requests from the SNMP managers.
8. Specify the Manager Port over which the SNMP manager receives alerts/traps from the SNMP agent.
Default: 162
Sophos XG Firewall | System | 83
Figure 58: Agent Configuration
Add Community
You can add an SNMP community.
1. Go to System > Administration > SNMP and click Add.
2. Enter a name.
3. Enter the description.
4. Enter the IP address (IPv4/IPv6) of the SNMP manager.
5. Select the SNMP protocol version. SNMP v1 and v2c-compliant SNMP managers have read-only access to device system information and can receive device traps.
6. Select the version for trap support. Traps are sent only to SNMP managers that support the specified versions.
7. Click Save.
Figure 59: Add SNMP Community
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
