Sophos XG Firewall | System | 84
Netflow
Netflow allows you to add, update, or delete Netflow servers. The device offers Netflow, a network protocol, to monitor network bandwidth usage and traffic flow. Netflow records of source, destination and volume of traffic are exported to the Netflow server. The records help you identify the protocols, policies, interfaces and users consuming high bandwidth. Data analyzing tools like Open Source Data Analyzer and PRTG software can generate reports from the Netflow records.
Netflow Configuration
1. Enter the Netflow Server Name.
2. Enter the Netflow Server IP/Domain. You can enter IPv4 or IPv6 addresses.
3. Enter the Netflow Server Port number (UDP port). Records are sent to the Netflow server over the specified port.
Default: 2055
Figure 60: Netflow
Note: Traffic of only those firewall rules that have Log Firewall Traffic enabled is sent to the Netflow server.
Note: You can configure up to five Netflow servers.
Note: Sophos supports Netflow v5. You can export all the parameters of v5.
Messages
Use Messages to notify users and issue administrative alerts.
You can send messages of up to 256 characters to a single user or multiple users simultaneously.
You can edit ( ) the message, save the changes or reset ( ) to the default message.
You can send notifications related to the following events:
• Authentication: Login and logout confirmation, login failure and disconnection
• SMTP: Blocked and received emails
• Administration: Disclaimer for admin login
• SMS Customization: Login information to guest users
Certificates
Certificates allows you to add certificates, certificate authorities and certificate revocation lists.
•
Certificates
•
Certificate Authorities
•
Certificate Revocation Lists
Certificates
Digital certificates provide verification of ownership of a user or computer (example: VPN) or an organization
(example: websites) over the Internet, and are issued by a Certificate Authority (CA). Certificate Signing Requests
Sophos XG Firewall | System | 85
(CSR) enable you to provide the information required for the CA to issue a certificate. CAs issue certificates which can include the owner's public key, the certificate's validity period, owner information and the private key.
Verification is completed through the private key which is held by the owner.
Certificates are revoked when the private key is lost, stolen or updated. CAs maintain a list of valid and revoked certificates. Self-signed certificates that are revoked are automatically added to the Certification Revocation List
(CRL).
The device allows you to:
• generate a self-signed certificate, upload a third-party certificate, or to generate a CSR.
• use the device as the CA or add an external CA.
• revoke a self-signed certificate or upload an external CRL.
Add Certificate
Add Certificate allows you to upload a certificate, generate a self-signed certificate, or to generate a Certificate
Signing Request (CSR).
1. Go to System > Certificates > Certificates and click Add.
2. Select from the following options.
Upload Certificate
Generate self-signed Certificate
Generate Certificate Signing Request
Upload Certificate
1. Enter the Certificate Name.
2. Select the format of certificate file.
PEM (.pem): Base64 encoded form of DER certificate. Certificate and private key are stored in different files.
DER (.der): Binary form of PEM certificate used on Java platform. Certificate and private key are stored in different files.
PEM (.pem): Base64 encoded form of DER certificate. Certificate and private key are stored in different files.
DER (.der): Binary form of PEM certificate used on Java platform. Certificate and private key are stored in different files.
CER (.cer): Binary form. Contains certificate owner information and public and private keys.
PKCS7 (.p7b): ASCII code. Contains the certificate but not the private key.
PKCS12 (.pfx or .p12): Binary form used on Windows platforms. Stores the private key with the public key.
3. Upload certificate and private key.
4. Enter the CA passphrase and re-enter to confirm.
5. Click Save.
Generate Self-Signed Certificate
1. Go to System > Certificates > Certificates and click Add.
2. Set Action to Generate self-signed certificate.
3. Ceritificate Details
a) Enter the Certificate Name.
b) Specify the certificate's validity period.
Default: 1 day c) Select the number of bits used to construct the key from the list.
Note: Larger keys offer greater security, but take longer to encrypt and decrypt data.
Sophos XG Firewall | System | 86
Default: 2048 d) Select to encrypt the key. Enter a passphrase or the pre-shared key and re-confirm e) Specify the certificate ID for one of the following options:
• DNS
• IP Address (IPv4/IPv6 Address)
• Email
• DER ASN1 DN (X.509)
4. Identification Attributes
a) Select the country in which the device is deployed.
b) Enter the state within the country.
c) Enter the locality in which the certificate is to be used.
d) Enter the name of the certificate owner (example: Sophos Group).
e) Enter the name of the department to which the certificate is to be assigned (example: marketing).
f) Enter the common name or FQDN (example: marketing.sophos.com).
g) Enter the contact person's email address.
5.
Generate Certificate Signing Request
The device allows you to generate a Certificate Signing Request (CSR) which can be sent to a CA.
1. Go to System > Certificates and click Add.
2. Set Action to Generate Certificate Signing Request (CSR).
3. Ceritificate Details
a) Enter the Certificate Name.
b) Specify the certificate's validity period.
Default: 1 day c) Select the number of bits used to construct the key from the list.
Note: Larger keys offer greater security, but take longer to encrypt and decrypt data.
Default: 2048 d) Select to encrypt the key. Enter a passphrase or the pre-shared key and re-confirm e) Specify the certificate ID for one of the following options:
• DNS
• IP Address (IPv4/IPv6 Address)
• Email
• DER ASN1 DN (X.509)
4. Identification Attributes
a) Select the country in which the device is deployed.
b) Enter the state within the country.
c) Enter the locality in which the certificate is to be used.
d) Enter the name of the certificate owner (example: Sophos Group).
e) Enter the name of the department to which the certificate is to be assigned (example: marketing).
f) Enter the common name or FQDN (example: marketing.sophos.com).
g) Enter the contact person's email address.
5. Click Save.
Once the certificate is created, you need to download and send this certificate to the remote peer with whom the connection is to be established.
Sophos XG Firewall | System | 87
Download Certificate
The device allows you to download self-signed certificates and certificate signing requests.
1. Go to System > Certificates > Certificates.
2.
Go to the Manage column and click against the certificate. The certificate is downloaded as a .tar.gz file.
Revoke Certificate
1. Go to System > Certificates > Certificates.
2.
Go to the Manage column and click signed certificates.
against the certificate. You can revoke lost, stolen or updated self-
Revoked certificates are automatically added to the Certificate Revocation List (CRL).
Certificate Authorities
Certificate Authorities (CA) are trusted entities which issue digital certificates that verify the ownership of a user, host or organization. Ownership is verified through a public key, owner information and a private key.
The device allows you to generate a local CA or to import external CAs. Among external CAs, it provides Verisign,
Entrust and Microsoft.
The default CA is regenerated automatically when it is updated.
Add Certificate Authority
1. Go to System > Certificates > Certificate Authorities and click Add.
2. Enter the name of the CA.
3. Select the format of the root certificate. The certificate and private key are stored in different files.
4. Upload the certificate and private key.
5. Enter the CA passphrase and re-enter to confirm.
Figure 61: Add Certificate Authority
6. Click Save.
Download CA
You can download local CAs in order to forward these to the remote peer for the verification process.
1. Go to System > Certificates > Certificate Authorities.
2.
Click to download the zip file.
