The device is shipped with a number of physical interfaces, that is, ports and a number of virtual interfaces, depending on the model of the device. The Interface page displays a list of physical interfaces, aliases, virtual interfaces, bridge interfaces, interfaces configured as LAG or as TAP as well as interfaces configured for wireless LAN or for cellular

WAN.

Interfaces allows you to configure a range of physical and virtual interfaces. If a virtual interface is configured for a physical interface, it is displayed below the physical interface. Virtual interface configuration can be updated or deleted.

Note: Updating the interface details may affect dependent configurations. Refer

Configurations dependent on

Interfaces

for more details.

The possible configurations are provided below:

•

Alias

– Alias allows you to bind multiple IP addresses to a single physical interface.

•

Bridge

– A bridge enables you to configure transparent subnet gatewaying.

•

LAG

– Link Aggregation Group (LAG) allows multiple network connections to be combined into a single connection. It is also known as trunking, NIC teaming, NIC bonding, or Ether Channel. LAG is mostly used to handle LAN traffic.

•

VLAN

– A virtual LAN is a broadcast domain with each VLAN being configured on a switch to individual ports.

•

Wireless Networks

– A wireless network links devices through a wireless distribution method, connecting them to the Internet through an access point.

If a wireless network is configured with a “Separate Zone” for

Client Traffic

mode under Protect > Wireless >

Wireless Networks, a wlnet interface of the type “Wireless Protection” is automatically created on this page with the configured IP address and zone of the wireless network. In order to use the interface, you need to configure a DHCP server for the interface so that the wireless clients can connect to the device. The interface will automatically be deleted once the wireless network is deleted.

•

Cellular WAN

– A cellular WAN is a wide area network (WAN) for data that is typically provided by cellular carriers to transmit a wireless signal over a range of several miles to a mobile device.

Sophos XG Firewall | Configure | 98

•

TAP

– A TAP interface enables you to deploy the device in Discover Mode. In this mode, the device can monitor all the network traffic without making any changes in the existing network schema. Discover Mode can be configured through the command line interface (CLI).

•

RED

- The Remote Ethernet Device (RED) is used to connect remote branch offices to your head office as if the

branch office is part of your local network. The RED device connects to the main device using a RED interface and can be configured using this interface. On factory default, all the configured RED interfaces are deleted.

Interface status messages can have the following values:

• Disabled - The interface is currently not bound to any zone.

• Connected - The interface is connected, configured and is running.

• Connecting (Displayed only for PPPoE and cellular WAN (WWAN1) interfaces) - Displayed when a new IP address is being leased.

• Disconnected (Displayed only for PPPoE and cellular WAN (WWAN1) interfaces) - Displayed after the IP address has been released.

• Disconnecting (Displayed only for PPPoE and cellular WAN (WWAN1) interfaces) - Displayed during the process of IP release.

• Unplugged - No physical connection.

• Not Available (Applicable for Flexi Ports devices) - If the Flexi Ports module has previously been inserted and

Flexi Ports have been configured, then after removing the Flexi Ports module from the device, the Flexi Ports will carry the status "Not Available".

The following list shows the different icons, representing the different interface types:

Icons Meaning

Ethernet

Wireless

Bridge

VLAN

RED10

RED15

RED50

LAG

WWAN

Note: Configurations dependent on Interfaces

• Updating the interface details may affect dependent configurations, including Interface zone binding,

DNS, gateway, interface-based hosts, VLAN interfaces, and dynamic DNS.

• Deleting the virtual interface will delete the firewall rule defined for the virtual interface.

• Deleting the interface will also remove all its dependent configurations, including interface zone binding,

DHCP server or relay, interface-based firewall rule, ARP (static and proxy), protected servers, protected server-based firewall rules, interface-based hosts and references from host groups as well as unicast and multicast routes.

Sophos XG Firewall | Configure | 99

• Your network connections might get affected for some time after updating/deleting Interfaces. If you face any network issues during this time then please wait for some time and check again.

Physical Interface Configuration

Use this page to edit physical interface configurations.

1. Go to Configure > Network > Interfaces. Identify the physical interface whose settings need to be updated and click the icon on the right side. Click Edit Interface within the box.

2. Enter the details for General Settings.

Physical Interface

Physical interfaces are ports which may be marked in numeric (Port1, Port2, and so on), alphabetic

(PortA, PortB, and so on), alphanumeric (PortA2, PortA3, and so on), or in special alphanumeric form (eth0, eth1, and so on), depending on your device.

Network Zone

Select the zone to which the interface belongs.

Available Options:

• None: Select to unbind the interface.

• LAN

• WAN

• DMZ

• WiFi

Figure 73: General Settings

3. Enter the IPv4 configuration details.

IP Assignment

Select the IP assignment type.

Available Options:

• Static - Click to specify the IP address manually.

• PPPoE - Click to enable the interface to receive the IP address from a PPPoE server.

• DHCP - Click to enable the interface to receive the IP address dynamically from a DHCP server.

IPv4/Netmask

Enter the IPv4 address of the interface. Select the network subnet mask.

Preferred IP (available only if selected IP Assignment is PPPoE)

Many Internet service providers assign a static IP address to PPPoE connections. The device allows you to bind the static IP address to the PPPoE connection.

Note: An IP Address other than the preferred IP Address may be assigned to the

PPPoE connection, depending on the PPPoE Server configuration.

4. Enter the IPv4 gateway details.

Gateway Detail (available only for WAN zone)

• Static IP Assignment - Enter the Gateway Name and the IPv4 address through which traffic is to be routed.

• PPPoE IP Assignment - Enter the Gateway Name through which traffic is to be routed.

• DHCP IP Assignment - Enter the Gateway Name through which traffic is to be routed.

Sophos XG Firewall | Configure | 100

Figure 74: IPv4 Configuration

5. Enter the details for PPPoE IP Assignment.

Username

Enter the PPPoE account username.

Password

Enter the PPPoE account password.

Access Concentrator/Service Name

Enter the access concentrator and service name.

The device initiates only those sessions with the access concentrator that can provide the specified service.

LCP Echo Interval

Enter the time interval at the end of which the system sends an echo request to check whether the link is alive. Once an attempt is made, the device waits for the defined time interval before the next attempt is made.

Default: 20 seconds

LCP Failure

Enter the number of attempts (echo requests) to be made. Once the specified number of attempts are made without receiving a response from the client, the device disconnects the PPPoE connection.

Default: 3

Schedule Time For Reconnect

The IP address assigned to a PPPoE connection, whether dynamic or static (preferred), can have a predefined validity period. Once the validity expires, the PPPoE connection is terminated and is reconnected.

To prevent reconnection during working hours, enable the PPPoE reconnect schedule. You may choose to schedule the PPPoE reconnection on daily or weekly basis at the configured time

(HH:MM).

Default: Disabled

Default schedule when enabled: All days of the week

Note: Even when a Preferred IP address has been configured, if Schedule Time For

Reconnect is enabled and configured, on reconnection, an IP address other than the preferred IP address may be assigned to the PPPoE connection.

Sophos XG Firewall | Configure | 101

Figure 75: PPPoE Configuration

6. Enter the IPv6 configuration details.

IP Assignment

Select the IP assignment type.

Available Options:

• Static

• DHCP

Mode (only for DHCP mode)

Select the DHCP mode.

Select the relevant option to configure the IPv6 addresses through stateful (DHCPv6) or Stateless address assignment methods depending on the Managed (M) Address Configuration and Other (O) configuration flags advertised in the Router Advertisement (RA) message.

Available Options:

Auto - If selected, the IPv6 address will be configured based on the router advertisement packet through Stateless Address Auto-Configuration (SLAAC) or through DHCPv6 depending on the

Managed (M) Address Configuration and Other (O) Configuration flags advertised in the Router

Advertisement (RA) message. Manual - Select the relevant option to configure the IPv6 address either through SLAAC or through DHCPv6.

• DHCP Only - In this manual mode, the client will configure IPv6 Address and other configuration parameters using DHCPv6 Server. Gateway details should be manually specified.

• Stateless - In this manual mode, client will configure IPv6 Address based on advertised RA message through SLAAC.

• Accept Other Configuration from DHCP: Select to configure other parameters using

DHCPv6 Server. By default, it is enabled.

DHCP Rapid Commit

If enabled, the interface will be configured using a 2-message exchange (Solicit and Reply) rather than the 4-message exchange (Solicit, Advertise, Request, and Reply). It allows for quicker client configuration.

Note: Rapid commit should also be enabled on the DHCPv6 server.

IPv6 / Prefix (Only for static IP assignment)

Enter the IPv6 address and the prefix.

Gateway Detail (Only for "WA"N zone)

Sophos XG Firewall | Configure | 102

For Static IP assignment:Enter the gateway name and IPv6 address through which the traffic is to be routed. For DHCP IP assignment:Enter the gateway name, if Stateless manual mode is selected. For DHCP only manual mode, specify the gateway name and IPv6 address.

Figure 76: IPv6 Configuration - DHCP

7. Enter details for the Advanced Settings.

Interface Speed

Select interface speed for synchronization. Interface speed can also be configured through CLI using set network interface-speed command.

Speed mismatch between the device and third-party routers and switches can result in errors or collisions on the interface, disconnection, traffic latency, or slow performance.

Depending on the model deployed, the following options are available:

Auto Negotiation 10 Mbps - Half Duplex 10 Mbps - Full Duplex 100 Mbps - Half Duplex 100

Mbps - Full Duplex 1000 Mbps - Full Duplex

Default - Auto Negotiation

MTU

Enter the MTU (Maximum Transmission Unit) value.

MTU is the largest physical packet size, in bytes, that a network can transmit. This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes.

Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent.

Default - 1500

Acceptable Range (For IPv4 Configuration):576 to 1500

Acceptable Range (For IPv6 Configuration):1280 to 1500

Override MSS

Select to override the default MSS.

MSS defines the amount of data that can be transmitted in a single TCP packet.

Default: 1460

Acceptable Range:536 to 1460

Use Default MAC Address

Click to use the default MAC address for the interface.

Sophos XG Firewall | Configure | 103

By default, the first port that is included as member port becomes the default MAC address.

Override Default MAC Address

Click to override the default MAC address for the interface and enter the new MAC address.

On factory reset, it is set to the default MAC Address.

Figure 77: Advanced settings

8. Click Save.

Advanced Settings for Bridge Interface

Use this page to edit the advanced settings for bridge interface.

1. Go to Configure > Network > Interfaces. Identify the bridge interface whose advanced settings need to be updated and click the icon on the right-hand side. Click Edit Interface within the box.

2. Enter the details for Advanced Settings.

Physical Interface

Displays the physical bridge member interface.

Network Zone

Displays the zone to which the physical interface belongs.

Interface Speed

Select the interface speed for synchronization. Interface speed can also be configured through CLI using the set network interface-speed command.

Speed mismatch between the device and third-party routers and switches can result in errors or collisions on the interface, disconnection, traffic latency, or slow performance.

Depending on the device, the following options are available:

• Auto Negotiation

• 10 Mbps - Half Duplex

• 10 Mbps - Full Duplex

• 100 Mbps - Half Duplex

• 100 Mbps - Full Duplex

• 1000 Mbps - Full Duplex

Default: Auto Negotiation.

MTU

Enter the MTU (Maximum Transmission Unit) value. MTU is the largest physical packet size (in bytes) that a network can transmit.

Default: 1500

Override MSS

Sophos XG Firewall | Configure | 104

Select the checkbox to override the default MSS (Maximum Segment Size). MSS defines the amount of data that can be transmitted in a single TCP packet.

Default: 1460

Use Default MAC Address

Click to use the default MAC address of the interface. The MAC address of the first port to be added as member port becomes the default MAC address.

Override Default MAC Address

Click to override the default MAC address of the interface and enter the new MAC address. On factory reset, it will be set to the default MAC address.

Figure 78: Advanced Settings - Bridge Interface

3. Click Save.

Add Bridge

The device can be deployed in bridge mode.

Use this page to create a bridge interface.

This feature is not supported when the device is deployed on Microsoft Hyper-V hypervisors.

1. Go to Configure > Network > Interfaces, click Add Interface on the right side and click Add Bridge from the drop-down list.

2. Enter the details for General Settings.

Name

Enter a name to identify the bridge.

Description

Enter a description for the bridge.

Enable routing on this bridge pair

Select the checkbox to enable routing on this bridge.

Figure 79: General Settings

3. Enter the details of Member Interfaces.

Interface

Select the interfaces of the bridge. For example, Port A, Port B.

Zone

For each interface, select the zone to which the interface belongs.

Sophos XG Firewall | Configure | 105

Figure 80: Bridge Member Interfaces

4. Enter IPv4 configuration and gateway details.

IPv4 / Netmask

Enter the IPv4 address and select the network subnet mask.

Gateway Name

Enter a name to identify the gateway.

Gateway IP

Enter the IPv4 address for the gateway.

Figure 81: IPv4 Configuration and Gateway Details

5. Enter the IPv6 configuration details.

IPv6 / Prefix

Enter the IPv6 address and the prefix.

Gateway Name

Enter a name to identify the gateway.

IP Address

Enter the IPv6 address for the gateway.

Figure 82: IPv6 Configuration

6. Enter the details for Advanced Settings.

MTU

Enter the MTU (Maximum Transmission Unit) value.

Sophos XG Firewall | Configure | 106

MTU is the largest physical packet size (in bytes) that a network can transmit. Problem arises when networks with differing MTU sizes are interconnected. In such a scenario, packets larger than the specified MTU value are divided (fragmented) into smaller packets before they are sent.

Default: 1500

Acceptable Range (For IPv4 Configuration):576 to 1500

Acceptable Range (For IPv6 Configuration):1280 to 1500

Override MSS

Select the checkbox to override the default MSS (Maximum Segment Size).

MSS defines the amount of data that can be transmitted in a single TCP packet.

Default: 1460

Acceptable Range: 536 to 1460

Figure 83: Advanced Settings

Note:

• A single WAN interface is supported in a bridge.

• A single interface cannot be part of multiple bridges.

7. Click Save.

Add Alias

Use this page to bind multiple IP addresses to a single interface.

1. Go to Configure > Network > Interfaces, click Add Interface on the right side and click Add Alias from the drop-down list.

2. Enter the interface details.

Physical Interface

Select the interface to which an Alias must be bound.

IP Family

Select the IP family for the Alias.

Available Options:

IPv4 (Only for physical interfaces with IPv4 configuration)

IPv6 (Only for physical interfaces with IPv6 configuration)

IPv4/Netmask (Available only if IP Family selected is IPv4)

Enter the IPv4 address and select the network subnet mask.

IPv6/Prefix (Available only if IP Family selected is IPv6)

Enter the IPv6 address and the prefix.

Default: 64

Sophos XG Firewall | Configure | 107

Figure 84: Add Alias

3. Click Save.

Configure Cellular WAN Settings

The device allows you to configure Cellular WAN interface.

Use this page to configure celluar WAN settings.

Enable Cellular WAN from Configure > Network > Cellular WAN.

1. Go to Configure > Network > Interfaces. Identify the cellular WAN (WWAN1) interface whose settings need to be updated and click the icon on the right side. Click Edit Interface within the box.

2. Enter the details for General Settings.

Interface Name

Enter a name for the interface.

IP Assignment

Select the IP assignment method from the available options:

Available Options:Dial-up (PPP)Network Adapter (DHCP)

Show Recommended Configuration

Click to view the modem details and the recommended configuration. The recommended configuration is displayed in two sections:

Information Section:

• Modem Name

• Vendor ID

• Product ID

• SIM PIN Enabled – Yes/No

Configuration Section:

Available IP Assignment Methods:

Possible Values

• Dial-up (PPP)

• Network Adapter (DHCP)

• Dial-up (PPP) & Network Adapter (DHCP)

Modem Port:

Possible Values

• Not Available

• Serial n (n= 0, 1, …9)

Secondary Modem Ports:

Possible Values

• Not Available

• Serial n (n = 0, 1, …9)

Note: This parameter displays the next available modem port. This port must be used as the Modem Port, if the recommended modem port fails.

Sophos XG Firewall | Configure | 108

APN (Access Point Name):

Possible Values

• Not Available

• <name>

DHCP Connect Command:

Possible Values

• Not Required

• Required but not available

• <AT command>

DHCP Disconnect Command:

Possible Values

• Not Required

• Required but not available

• <AT command >

Click Load Recommended Configuration to load the recommended configuration onto the page.

This action removes previous configurations, if any, and replaces them with the recommended configuration.

Note: When you click Load Recommended Configuration, values of the secondary modem ports are not loaded.

Connect

Select the mode to establish a cellular WAN connection.

Available Options:AutoManual

Reconnect Tries

Select the number of attempts to be made when reconnecting to an access point.

Available Options:Always123Default: Always

Modem Port (Available only if IP Assignment selected is Dial-up (PPP))

Enter the serial interface on which the modem will establish a connection.

Available Options:Serial 0 to 9

Phone Number (Available only if IP Assignment selected is Dial-up (PPP))

Enter the phone number to be used in order to establish the connection or select one from the dropdown list.

Username

Enter a username for the connection.

Password

Enter a password.

SIM Card PIN Code

Enter the PIN code in order to unlock the PIN-enabled SIM card.

Many operators lock their SIM card to prevent the use of another operator's SIM card. Such modems can be unlocked using the PIN code in order to establish a connection.

APN

Enter the Access Point Name (APN).

The APN is a configurable network identifier based on which the device identifies the Packet Data

Network (PDN) or the GSM carrier with which the user wants to communicate.

Sophos XG Firewall | Configure | 109

DHCP Connect Command (Available only if IP Assignment selected is Network Adapter (DHCP))

Enter a DHCP command to connect to the cellular WAN.

DHCP Disconnect Command (Available only if IP Assignment selected is Network Adapter (DHCP))

Enter a DHCP command to disconnect from the cellular WAN.

Initialization String

Enter an initialization string for the specific wireless modem. In case of multiple strings, the strings must be entered in the order of their priority.

Figure 85: General Settings - Dial-up

3. Enter the details for Gateway Settings.

Gateway Name

Enter a name to identify the gateway.

Gateway IP

Enter the IP address of the gateway.

Figure 86: Gateway Settings

4. Enter the details for Advanced Settings.

MTU

Enter the MTU (Maximum Transmission Unit) value.

Default: 1500

Acceptable Range: 576 to 1500

Sophos XG Firewall | Configure | 110

MSS

Enter the MSS (Maximum Segment Size).

MSS is the amount of data that can be transmitted in a single TCP packet.

Default: 1460

Acceptable Range: 536 to 146

MAC Address (Available only if IP Assignment selected is Network Adapter (DHCP))

Select the method of providing a MAC address to the modem:

Available Options:Use Default MAC AddressOverride Default MAC Address (If you select this option, provide the MAC address.)

Figure 87: Other Settings

5. Click Save.

Virtual LAN (VLAN)

VLANs are virtual LANs in which work devices on one or more LANs are logically segregated into independent broadcast domains. The logical segregation allows devices from multiple LANs across different floors or geographical regions to communicate as if they are physically connected. At the same time, a single LAN can be separated into multiple VLANs based on roles, work groups, services, or any other logical parameter.

Although routers are generally used to create broadcast domains in LANs, switches create the VLAN broadcast domains. You can assign each VLAN to one or more ports on a single switch. In case of distributed VLANs, you can assign them across multiple switches. Communication within a VLAN happens through the switch, while communication across different VLANs requires a layer 3 device – a router, a layer 3 switch, or a firewall.

You can implement VLAN technology between a Sophos Firewall (SF) device and 802.1Q-compliant switches and routers. Tag-based LAN multiplexing technology simulates multiple LANs within a single physical LAN and traffic from each broadcast domain is given a different VLAN tag. VLAN IDs/tags are 4-byte frame extensions that contain a VLAN identifier and information specific to your configuration.

SF recognizes VLAN IDs, allowing you to apply firewall rules specific to each VLAN, including authentication and other relevant policies of your network. You can also apply firewall rules to secure the network between broadcast domains.

Advantages

• Increase in the number of ports

• Logical segmentation of network regardless of physical location

• Granular firewall rules specific to workgroups

• Improved network throughput due to the creation of smaller broadcast domains

Add VLAN Interface

1. Go to Configure > Network > Interfaces, click Add Interface on the right side and select Add VLAN from the drop-down list.

2. Enter the VLAN details.

Physical Interface

Select a parent interface for the virtual sub-interface. The virtual sub-interface becomes a member of the selected physical interface.

Sophos XG Firewall | Configure | 111

Zone

Select a zone to assign to the virtual sub-interface. The virtual sub-interface becomes a member of the selected zone which can be LAN, DMZ, WAN, WiFi or a custom zone.

VLAN ID

Enter the VLAN ID. The interface VLAN ID can be any number between 2 and 4094. The VLAN

ID of each virtual sub-interface must match the VLAN ID of the packet. If the IDs do not match, the virtual sub-interface will not receive the VLAN-tagged traffic.

Note: When added to the same physical interface, more than one virtual sub-interface cannot carry the same VLAN ID. However, virtual sub-interfaces carrying the same

VLAN ID can be added to different physical interfaces.

Figure 88: VLAN Details

3. Enter the IPv4 configuration details (Only for physical interfaces with IPv4 configuration).

IP Assignment

Select the IP assignment type.

Available Options:

• Static

• PPPoE

• DHCP

IPv4/Netmask

Enter the IPv4 address for the interface and select the network subnet mask.

Preferred IP (Only available if IP Assignment selected is PPPoE )

Many Internet service providers assign a static IP address to PPPoE connections. The device allows you to bind the static IP address to the PPPoE connection.

Enter the preferred IP address for the PPPoE connection.

Gateway Detail (For "WA"N zone)

• Static IP Assignment: Specify the Gateway Name and the IPv4 address through which the traffic is to be routed.

• PPPoE IP Assignment: Specify the Gateway Name through which the traffic is to be routed.

• DHCP IP Assignment: Specify the Gateway Name through which the traffic is to be routed.

Figure 89: IPv4 Configuration

Sophos XG Firewall | Configure | 112

4. Enter the details for PPPoE IP Assignment.

Username

Enter the PPPoE account username.

Password

Enter the PPPoE account password.

Access Concentrator/Service Name

Enter the access concentrator and service name.

The device initiates only those sessions with the access concentrator that can provide the specified service.

LCP Echo Interval

Enter the length of time that the system must wait before it sends an echo request to check whether the link is alive. Once an attempt is made, the device waits for the defined time interval before the next attempt is made.

Default: 20 seconds

LCP Failure

Enter the number of attempts (echo requests) to be made. Once the specified number of attempts are made without receiving a response from the client, the device disconnects the PPPoE connection.

Default: 3

Schedule Time For Reconnect

To prevent reconnection during working hours, enable the PPPoE reconnect schedule. You may choose to schedule the PPPoE reconnection on daily or weekly basis at the configured time

(HH:MM).

Default: Disabled

Default schedule when enabled: All days of week

Note: Even when a Preferred IP address has been configured, if Schedule Time For

Reconnect is enabled and configured, on reconnection, an IP address other than the preferred IP address may be assigned to the PPPoE connection.

Figure 90: PPPoE Configuration

5. Enter the IPv6 configuration details (Only for physical interfaces with IPv6 configuration)

IP Assignment

Sophos XG Firewall | Configure | 113

Select the IP assignment type.

Available Options:

• Static

• DHCP

Mode (available only if IP Assignment selected is DHCP)

Select DHCP mode.

Administrator can select to configure IPv6 address through Stateful (DHCPv6) or StateLess address assignment methods depending on the Managed (M) Address Configuration and Other (O)

Configuration flags advertised in the Router Advertisement (RA) message .

Available Options:

Auto:If selected, IPv6 address will be configured based on the Router Advertisement packet through Stateless Address Auto-Configuration (SLAAC) or DHCPv6 depending on the

Managed (M) Address Configuration and Other (O) Configuration flags advertised in the Router

Advertisement (RA) message. Manual:Administrator can select to configure IPv6 address either through SLAAC or DHCPv6.

• DHCP Only:In this manual mode, client will configure IPv6 Address and other configuration parameters using DHCPv6 Server. Gateway details should be manually specified.

• Stateless:In this manual mode, client will configure IPv6 Address based on advertised RA message through SLAAC.

• Accept Other Configuration from DHCP: Select to configure other parameters using

DHCPv6 Server. By default, it is enabled.

DHCP Rapid Commit

If enabled, the interface will be configured using a 2-message exchange (Solicit and Reply) rather than the 4-message exchange (Solicit, Advertise, Request, and Reply). It enables quicker client configuration.

Note: Rapid commit should also be enabled on the DHCPv6 server.

IPv6 / Prefix (Only for static IP assignment)

Enter the IPv6 address and the prefix.

Gateway Detail (Only for "WA"N zone)

• For "Static" IP assignment:Specify the gateway name and IPv6 address through which the traffic is to be routed.

• For “DHCP” IP assignment:Specify the gateway name, if Stateless manual mode is selected.

For DHCP only manual mode, specify the gateway name and the IPv6 address.

Sophos XG Firewall | Configure | 114

Figure 91: IPv6 Configuration

6. Click Save.

Link Aggregation Group

LAG is not supported in Sophos virtual security devices.

Link Aggregation Group (LAG) combines multiple physical links into a single logical link, connecting the SF device to another network device (switch). Also known as trunking, NIC teaming, NIC bonding or Ether Channel, LAG provides redundancy – when one interface fails, the remaining interfaces continue to carry the LAN traffic, ensuring continuity within the network.

LACP

Link Aggregation Control Protocol (LACP) is part of the IEEE specification 802.3ad and provides additional LAG functionality. You can assign load sharing across links based on the algorithm applied in the xmit hash policy. Link aggregation increases the bandwidth available without the need to deploy additional hardware.

The SF device supports the following LAG modes:

• Active Backup: This mode provides automatic link failover. One link (member of the LAG) remains active while the other remains in standby mode. When the active link fails, the standby link becomes active.

• LACP (802.3ad): This mode provides load balancing and automatic failover. In this mode, all the links are used to forward traffic.

Prerequisites for LACP (802.3ad) mode

• For LACP to be functional, it must be enabled at both ends of the link.

• All the member interfaces (ports) in the LAG must be of the same type and have the same interface speed.

• All the links must be full-duplex.

Limitations

• Only unbound static physical interfaces can be members of the LAG.

• PPPoE, 3G, 4G, Cellular WAN, WLAN and Transport mode are not supported in LAG.

• A maximum of 4 ports can be configured on a single LAG interface.

Add Link Aggregation Group (LAG)

1. Go to Configure > Network > Interfaces, click Add Interfaceon the right-hand side and click Add LAG from the drop-down list.

LAG interface properties can be configured or edited from the command line, but a LAG interface cannot be added from CLI.

Sophos XG Firewall | Configure | 115

2. Enter the details for Global Settings.

Interface Name

Enter a name for the LAG interface.

Member Interface

Click Add New Item. The drop-down list displays all unbound ports.

Select the checkbox to select the port(s).

Note:

• At least 2 member ports are required to create a LAG interface.

• A maximum of 4 ports can be configured on a single LAG interface.

• Interfaces that have been configured for PPPoE, Cellular WAN or WLAN cannot participate in LAG.

Mode

Select the mode of LAG.

Available Options:

Active-Backup:Select the Active-Backup mode to provide failover. 802.3ad (LACP):Select the

802.3ad (LACP) mode to load balance the traffic in addition to providing failover.

Network Zone

Select the network zone for the interface.

Available Options:

LAN WAN DMZ WiFi

Figure 92: Global Settings

3. Enter the IPv4 configuration details.

IP Assignment

Select the type of IP assignment.

Available Options:StaticDHCP

IPv4/Netmask

Enter the IPv4 address for the interface and select the network subnet mask.

4. Enter the IPv4 gateway details (Available only if Network Zone selected is WAN)

Gateway Name

Enter the gateway name.

IPv4 Address

Enter the gateway IPv4 address.

Sophos XG Firewall | Configure | 116

Figure 93: IPv4 Configuration - Static

5. Enter the IPv6 configuration details.

IPv6/Prefix

Enter the IPv6 address and the prefix.

6. Enter the IPv6 gateway details (Available only if Network Zone selected is WAN).

Gateway Name

Enter the gateway name.

IPv6 Address

Enter the gateway IPv6 address.

Figure 94: IPv6 Configuration

7. Enter the details for Advanced Settings.

Interface Speed

Select the interface speed for synchronization. Interface speed can also be configured through CLI using the set network interface-speed command.

Speed mismatch between the device and third-party routers and switches can result in errors or collisions on the interface, disconnection, traffic latency, or slow performance.

Default: Auto Negotiation

MTU

Enter the MTU (Maximum Transmission Unit) value.

Default: 1500

Acceptable Range (For IPv4 Configuration): 576 to 1500

Acceptable Range (For IPv6 Configuration): 1280 to 1500

Override MSS

Select the checkbox to override the default MSS (Maximum Segment Size).

MSS defines the amount of data that can be transmitted in a single TCP packet.

Default: 1460

Sophos XG Firewall | Configure | 117

Acceptable Range: 536 to 1460

Xmit Hash Policy (Available only if Mode selected is LACP (802.3ad))

Select the Xmit hash policy to be applied to the member interfaces from the available options in the drop-down list:

Available Options:

Layer2:Select to generate the hash value using MAC Addresses. Layer2+3:Select to generate the hash value using a combination of Layer 2 (MAC Address) and Layer 3 (IP Address) protocol information. Layer3+4:Select to generate the hash value using Transport layer protocol information.

Primary Interface (Available only if Mode selected is Active-Backup )

Select an interface to be the primary interface. This interface remains active as long as it is available.

Default: Auto

The interfaces included in the member interface list are listed here. If you set the Primary Interface to Auto, the device selects any interface from the member interface list as the primary interface.

Use Default MAC Address

Click to use the default MAC address of the interface.

Override Default MAC Address

Click to override the default MAC address of the interface and enter the new MAC address.

On factory reset, it will be set to the default MAC address.

Figure 95: Advanced Settings

8. Click Save.

Add RED

This page allows you to configure a Remote Ethernet Device (RED) at a remote office.

1. Ensure that RED is activated. This can be done from Configure > System Services > RED.

2. Go to Configure > Network, click Add Interface on the upper right and select Add RED from the drop-down list.

3. Enter the RED Settings details.

Branch Name

Enter the name for the remote location in which the RED is to be set up.

Type

Select the RED device to be connected from the drop-down list.

Sophos XG Firewall | Configure | 118

• RED 10

• RED 15

• RED 15w

• RED 50

• Firewall RED Server

• Firewall RED Client

• Firewall RED Server Legacy

• Firewall RED Client Legacy

Note: RED device Firewall RED Server Legacy and Firewall RED Client Legacy are able to connect Sophos XG Firewall with Sophos UTM via RED Site2Site. For more information, see

RED Site-to-Site between Sophos XG Firewall and Sophos

UTM

on page 124.

RED ID (not available for Type Firewall RED Server, Firewall RED Server Legacy, Firewall RED Client

and Firewall RED Client Legacy)

Enter the RED ID.

The RED ID is a 15-character string printed on the sticker which is stuck to the bottom of the RED device as well as on the front of the carton.

Tunnel ID (not available if Type is Firewall RED Client and Firewall RED Client Legacy)

Select the Tunnel ID from the drop-down list.

By default, Automatic is selected. Tunnels are numbered consecutively. Select a unique tunnel ID and make sure that it is the same for both the devices - RED and Sophos XG Firewall.

Note: If the type is Firewall RED Server Legacy or Firewall RED Server Legacy make sure that the tunnel ID is available on the appliance that should be connected.

Unlock Code

Enter the unlock code. (Do not fill this field if this RED is being deployed for the first time.)

The unlock code is an 8-character string that is generated when a RED is added to a Sophos XG

Firewall. If this RED has been deployed before, you must enter the unlock code here. The unlock code is generated during the deployment of a RED device, and is emailed instantly to the address you provided by activating RED. This is a security feature, which ensures that a RED device cannot simply be removed and installed elsewhere.

For manual deployment through USB stick and for automatic deployment through Provisioning

Service (see

Device Deployment

below), two separate unlock codes are generated. If you switch a

RED device from one deployment method to the other, make sure that you use the corresponding unlock code: For manual deployment, provide the unlock code of the previous manual deployment; for automatic deployment, provide the unlock code of the previous automatic deployment.

Firewall IP/Hostname (not available for Type Firewall RED Server and Firewall RED Server Legacy)

Enter the hostname of the Sophos XG Firewall.

The hostname must be a publicly resolvable DNS name or IP address for the Sophos XG Firewall.

The RED will use this name or the IP address to connect back to the Sophos XG Firewall.

2nd Firewall IP/Hostname (not available if client Type is RED 10)

Specify the hostname of the second Sophos XG Firewall.

Use 2nd IP/Hostname for (not available if client Type is RED 10)

Select from the following options:

• Failover: Ensures that the secondary Sophos XG Firewall takes over when the primary Sophos

XG Firewall fails. The secondary host takes over automatically without loss of connection.

• Load Balancing: Distributes traffic equally between, the primary and the secondary Sophos XG

Firewall.

Sophos XG Firewall | Configure | 119

Provisioning File (available only if Type is Firewall RED Client or Firewall RED Client Legacy)

To provide the configuration data to the remote client device. Upload the provisioning file using the

Browse button and transfer the file to the remote device.

Description

Enter a description for the RED interface.

Device deployment

Select the deployment method:

• Automatically via Provisioning Service

• Manually via USB Stick

Note: If you select manual deployment, it is extremely important to retain the unlock code, which is sent by email. If you lose the unlock code, you can never connect the RED device again to another Sophos XG Firewall and you have to contact the Sophos Support.

By default, Sophos XG Firewall provides the RED's configuration data automatically via Sophos'

RED Provisioning Service. In this case, the RED device receives its configuration via Internet.

If the RED does not have an Internet connection, you can provide the configuration manually, via USB stick. If you deploy a RED device manually, you have to ensure that the Sophos XG

Firewall is acting as NTP server. Activate the NTP on the Sophos XG Firewall under System >

Administration > Time and allow the correct network or the IP address of the RED.

Figure 96: Add RED Interface

4. Enter the details for Uplink Settings.

Uplink Connection

Select the connection type for the uplink:

• DHCP: The RED pulls an IP address from a DHCP server.

• Static: Enter an IP address, the corresponding netmask, a gateway and a DNS server IP address.

2nd Uplink Connection (available only if client Type is RED 50 is selected)

Select the connection type for the uplink:

• DHCP: The RED pulls an IP address from a DHCP server.

• Static: Enter an IP address, a corresponding netmask, gateway and DNS server IP address.

2nd Uplink Mode (available only if client Type is RED 50)

Sophos XG Firewall | Configure | 120

Select an uplink mode for the 2nd host.

• Failover

• Load Balancing

3G/UMTS Failover (not available if Operation Mode is Transparent/Split)

Select to enable the 3G/UMTS failover function. Clear the check box to disable the function.

Note: Plug in a 3G/UMTS USB stick into the RED's USB port. The stick can provide

Internet uplink failover in case of WAN interface failure. For the necessary settings refer to your Internet provider's data sheet.

• Mobile Network: Select the mobile network type from the drop-down list.

• GSM

• CDMA

• Username/Password (available only if CDMA is selected): If required, specify a username and password for the mobile network.

• PIN (available only if GSM is selected): Specify the PIN of the SIM card if a PIN is configured.

Note: If you specify a wrong PIN, the connection cannot be established through

3G/UMTS in case of WAN interface failure. Instead, the 3G/UMTS Failover checkbox of the RED device is automatically cleared. Thus, the wrong PIN is used only once. When the WAN interface comes up again, the RED device displays a warning: A wrong PIN was entered for 3G/UMTS failover uplink. Please change

the login data.. When you open the Edit RED dialog box, a message is displayed which tells you that the 3G/UMTS failover was automatically unselected. Enter the correct PIN and select the checkbox. After making three connection attempts with a wrong PIN, the SIM card is locked. It cannot be unlocking through the RED device or Sophos XG Firewall and you have to contact the Sophos support.

• APN (available only if GSM is selected): Enter your provider's access point name information.

• Dial String : If your provider uses a different dial string, enter it here.

Default for GSM: *99#

Default for CDMA: #777

Figure 97: RED Uplink Settings

5. Specify the RED Network Settings details.

RED Operation Mode

Select to define how the remote network is to be integrated into your local network:

• Standard/Unified: All the remote network traffic is routed through the Sophos XG Firewall which serves as the DHCP server and as the default gateway too. Sophos XG Firewall has complete control over the network traffic of the remote network. It can apply firewall rules to traffic between the local and remote LANs as well as filter web traffic and applications of the remote network.

Note: Handle VLAN traffic through this mode if VLAN is deployed behind the

RED.

• Standard/Split: Only traffic to select local networks is routed through the Sophos XG Firewall.

Select the local networks from the drop-down list in the Split Network box or create new networks which can be accessed by the RED. Sophos XG Firewall controls the traffic to these

Sophos XG Firewall | Configure | 121 networks from the remote network. It also serves as the DHCP server and as the default gateway.

All other remote network traffic is sent directly out through the local Internet connection.

Note: VLAN tagged frames cannot be handled in this operation mode. To use a

VLAN behind your RED device, select the Standard/Unified operation mode.

• Transparent/Split (not available if 3G/UMTS Failover is selected): Sophos XG Firewall does not control network traffic of the remote network, nor does it serve as the DHCP server nor as the default gateway. On the contrary, it pulls an IP address of the remote network from the DHCP server to become part of that network. However, you can enable access to the local network for remote clients. Define split networks that can be accessed by the remote network.

Additionally, you can define one or more split domains to be accessible. If your local domains are not publicly resolvable, define a Split DNS Server, which can be queried by the remote clients.

Note: VLAN tagged frames cannot be handled in this operation mode. To use a VLAN behind your RED device, select the Standard/Unified operation mode instead.

RED IP (not available if Transparent/Split is selected)

Enter the IP address of the RED device.

RED Netmask (not available if Transparent/Split is selected)

Select the netmask from the drop-down list.

Zone

Select the zone from the drop-down list:

• LAN

• DMZ

• VPN

• WiFi

Configure DHCP

Enable to configure a DHCP range for RED.

RED DHCP Range (available only if Configure DHCP is selected)

Enter the DHCP range which the RED is allowed to use.

Split DNS Server (available only if Transparent/Split is selected)

If your local domains are not publicly resolvable, you need to define a Split DNS Server, which can be queried by remote clients.

Split Network (not available if Standard/Unified is selected)

Select the split networks from the drop-down list or add more networks.

Note: Traffic to the networks listed in the Split Network box is redirected to your

Sophos XG Firewall. The remaining traffic is directly routed to the Internet.

To check traffic from the branch office to the main office intranet for viruses, route it through the Sophos XG Firewall. Or use the Sophos XG Firewall as an HTTP proxy.

Split Domains (not available if Transparent/Split is selected)

Add one or more split domains.

Note: Since Sophos XG Firewall is only a client of the remote network, it is not possible to route traffic to the split networks the way it is done with the other modes.

Therefore, the RED device intercepts all traffic: Traffic targeting to a network listed in the Split Network box or going to a domain listed in the Split Domain box is redirected to the Sophos XG Firewall interface. This is accomplished by replacing the default gateway's MAC address in the respective data packets with the MAC address of Sophos XG Firewall.

Sophos XG Firewall | Configure | 122

Example: A partner or service provider requires access to your intranet or a certain server in your local network. Using a RED device the partner's network remains completely independent of your network, but they can access a defined part of your network for certain purposes, as if they were connected via LAN.

MAC Filtering Type

To restrict the MAC addresses allowed to connect to the RED device select Blacklist or Whitelist.

Whitelist: Only MAC addresses listed in the MAC Address list are allowed.

Blacklist, MAC addresses listed in the MAC address list are not allowed.

MAC Address: The list of MAC addresses used to allow or restrict access to the RED device. MAC address lists can be created on the System > Hosts and Services > MAC Host page.

Note: MAC filtering only works for RED rev. 2 or newer. For RED 10, a maximum of 200 MAC addresses is allowed, whereas for RED 50, the list may contain up to 400

MAC addresses.

Tunnel Compression

Select to compress all traffic sent through the RED tunnel. Data compression can increase the throughput of the RED device deployed in regions with very slow Internet connection such as

1-2 MBps. However, performance increase depends on the data's potential to be compressed (for example, data that is already compressed such as HTTPS or SSH cannot be compressed further). In some circumstances enabling data compression can actually reduce throughput of the RED device.

In such case, disable data compression.

Note: Tunnel compression is not available for RED 10 rev.1.

Figure 98: RED Network Settings

6. Enter the details of Switch Settings (available only if client Type is RED 50).

Switchport Mode

RED 50 offers four LAN ports that can be configured either as simple switches or for intelligent

VLAN usage. When set to Switch, all the traffic is sent to all ports. When set to VLAN, traffic can be filtered according to the Ethernet frames' VLAN tag, thus allowing the tunneling of more than one network into the RED tunnel.

Select the switchport mode for the switch settings

• Switch: RED 50 uses the switch by default.

Sophos XG Firewall | Configure | 123

• VLAN: Select the LAN port(s) and enter the LAN VID(s).

When using the VLAN switch port configuration, you can configure each LAN port separately. For each LAN port, the following options are available:

• Untagged (Hybrid Port): Ethernet frames with the VLAN IDs specified in the LAN VID(s) field below will be sent to this port. The frames are sent without tags, thus the end devices do not have to support VLAN. This port allows just one VLAN ID.

• Untagged, drop tagged (Access port): Ethernet frames with the VLAN IDs specified in the

LAN VID(s) field below will not be sent to this port. The frames are sent without tags, thus the end devices do not have to support VLAN.

• Tagged (Trunk Port): Ethernet frames with the VLAN IDs specified in the LAN VID(s) field below will be sent to this port. The frames are sent with tags, and the end devices have to support VLAN. Frames without VLAN IDs will not be sent to this port. This port allows up to

64 different VLAN ID(s) separated by comma.

• Disabled: This port is closed. No frames with or without VLAN IDs specified in the LAN

VID(s) will be sent to this port.

7. Click Save.

Note: If the message "Registering with RED service failed. Please make sure that this device can connect to the Internet on port 3400" appears, a network problem has occurred. Check if you can reach red.astaro.com through port 3400 (via console command telnet red.astaro.com 3400). If you can, the error could be due to high network load. Retry to connect later.

Related tasks

Configure RED

on page 301

This page describes how to configure RED.

Related information

RED Supported 3G/4G/LTE USB Dongles

Manage RED Interface

This chapter describes the functions of the icon of RED interfaces on the Configure > Network > Interfaces page.

The following options are available:

Activate/deactivate

The toggle switch next to the branch name shows the status of the interface. Click it to turn it on/off.

Note: The RED interface is deactivated and can not be edited if the RED device is bound to another system.

Download Provisioning file

This option is only available if the RED interface is in offline provisioning mode (if Device Deployment is set to

Manually via USB Stick).

Clicking on the link will download the provisioning file for the RED device. Save the file to the root directory of a USB stick. Then plug the USB stick into the RED appliance before turning it on. The RED will fetch its configuration from the USB stick. After that the connection between your appliance and the RED appliance is going to be established.

Note: It is crucial that you keep the unlock code, which is emailed instantly to the address provided on the

RED Configuration page as soon as the RED appliance receives its configuration. (In case of switching between manual and automatic deployment, make sure to keep both unlock codes.) You need the unlock code when you want to use the RED appliance with another Sophos XG Firewall. If you then do not have the unlock code ready, the only way to unlock the RED appliance is to contact the Sophos Support. The Support

Sophos XG Firewall | Configure | 124 however can only help you if you deployed the configuration automatically, via the RED Provisioning

Service.

3G/UMTS Failover

Displays if the 3G/UMTS Failover function is enabled or disabled.

Configure RED Site-to-Site Tunnel

This page describes how to set up a RED Site-to-Site Tunnel.

For such a connection, you need a RED server and a RED client. RED Site-toSite connection is also possible between

Sophos XG Firewall and Sophos UTM using the RED server legacy and RED client legacy. For more information,

see

RED Site-to-Site between Sophos XG Firewall and Sophos UTM

on page 124.

1. Configure the Firewall RED Server on the server machine.

How to configure RED is described in chapter

Configure RED

on page 301.

2. Add a RED interface on the Interfaces page.

How to add a RED interface is described in chapter

Add RED

on page 117.

3. Go to Configure > Network > Interfaces.

On the required RED interface, click the icon towards the right and select Download Provisioning File.

5. Configure the Firewall RED Client on the client machine and upload the provisioning file you downloaded from the server machine.

The RED Site-to-Site tunnel has been established and is active. You can control the RED connection status on both machines in the Network Security Control Center in the section User Threat Quotient.

RED Site-to-Site between Sophos XG Firewall and Sophos UTM

RED Site-toSite connection is also possible between Sophos XG Firewall and Sophos UTM. Select interface type

RED Server Legacy if you want to use Sophos XG Firewall as a RED firewall server for a Sophos UTM client. The provisioning file needs to be uploaded in the Sophos UTM client management. When you use Sophos UTM as RED firewall you need to upload the provisioning file from the Sophos UTM in a Sophos XG Firewall interface with type

RED Client Legacy.

Sophos XG Firewall as RED Firewall server

This page describes how to set up a RED Site-to-Site Tunnel between Sophos XG Firewall as RED firewall server legacy and Sophos UTM as RED client.

1. Ensure that RED on Sophos XG Firewall is activated. This can be done from Configure > System Services >

RED.

2. Go to Configure > Network, click Add Interface on the upper right and select Add RED from the drop-down list.

3. Create a RED interface with type RED Firewall Server Legacy.

How to create a RED interface is described in chapter

Add RED

on page 117.

4. Download the provisioning file.

5. Log in to Sophos UTM.

6. Ensure that RED on Sophos UTM is activated. This can be done from RED Management > Global Settings.

7. Go to RED Management > [Client] Tunnel Management, click New Tunnel.

8. Create a tunnel and upload the provisioning file from Sophos XG Firewall.

How to create a tunnel is described in

Sophos UTM Administration Guide

(Chapter 15.5 Tunnel Management).

9. Go to Interface & Routing > Interfaces, click New Interface.

10. Create a interface with the RED tunnel.

How to create a RED interface is described in

Sophos UTM Administration Guide

(Chapter 6.1 Interfaces).

The Site-to-Site connection between Sophos XG Firewall and Sophos UTM is now activated and can be seen in SF-

OS under Configure > Network > Interfaces and in the Control Center.

Sophos XG Firewall | Configure | 125

Sophos UTM as RED Firewall Server

This page describes how to set up a RED Site-to-Site Tunnel between Sophos UTM as RED firewall server and

Sophos XG Firewall as RED client legacy.

1. Ensure that RED on Sophos UTM is activated. This can be done from RED Management > Global Settings.

2. Go to RED Management > [Server] Client Management, click New RED.

3. Create a RED.

How to create a RED is described in

Sophos UTM Administration Guide

(Chapter 15.3 Client Management).

4. Download the provisioning file.

5. Go to Interface & Routing > Interfaces, click New Interface.

6. Create an interface with the RED server.

How to create a RED interface in Sophos UTM is described in

Sophos UTM Administration Guide

(Chapter 6.1

Interfaces).

7. Ensure that RED on Sophos XG Firewall is activated. This can be done from Configure > System Services >

RED.

8. Go to Configure > Network, click Add Interface on the upper right and select Add RED from the drop-down list.

9. Create a RED interface with type RED Firewall Client Legacy and upload the provisioning file from Sophos

UTM.

How to create a RED interface is described in chapter

Add RED

on page 117.

The Site-to-Site connection is between Sophos XG Firewall and Sophos UTM is now activated and can be seen in SF-

OS under Configure > Network > Interfaces and in the Control Center.

Tap

The device provides seamless proof of concept through the Discover Mode, allowing you to evaluate its security performance prior to purchase. Through the Tap interface, Discover Mode enables you to monitor network traffic without making any change in the current network schema.

Connect the device to a switch through which all the network traffic passes. Configure the switch to forward a copy of every packet passing through it to the device. The device monitors the traffic passively and generates a Security

Assessment Report (SAR) from the gathered data. SAR provides visibility into potential risks within the network, including application and web risks, risky users, intrusion risks, and more.

Note:

• When deployed in Discover Mode, the device functions in listening mode. Hence, no firewall rule is applied.

• Only unbound physical interfaces can be configured in Discover mode.

• For interfaces configured in Discover Mode, the Interfaces page displays the zone name as Discover.

• The Tap interface cannot be updated or deleted.

• Subscription to Network Protection and Web Protection modules is required for the analysis of IPS, Web

Filter and Application Filter policies.

• Pre-requisites for Discover Mode:

• The device must be connected to the Internet for web classification, IPS updates and SAR generation in the cloud.

• The device must be integrated with external authentication servers, such as Active Directory,

RADIUS, LDAP etc., for the SAR to provide user-specific data.

Enable Discover Mode

This page allows you to enable the Discover Mode through the Tap interface.

1. Access the CLI console by clicking admin on the upper right-hand corner of the Admin Console screen.

2. Select the option Console.

Sophos XG Firewall | Configure | 126

3. Provide the admin password.

4. Select the option 4. Device Console.

5. Execute the following command to enable discover mode: console> system discover-mode tap add

<Port>

Figure 99: Enable Discover Mode

The message "Discover Interface added successfully" is displayed on the CLI. Additionally, the interface configured in Discover Mode displays the message "Discover, Physical (Tap)" on the Interfaces page.

Zones

This page displays a list of all the zones including system zones and lets you manage the zones.

A zone is a logical grouping of ports/physical interfaces and/or virtual sub-interfaces if defined.

Zones provide a flexible layer of security for the firewall. With the zone-based security, the administrator can group similar ports and apply the same policies to them instead of writing the same policy for each interface.

Next to the Name of the zone type, the list displays the Members belonging to the specific zone, the zone Type, the kind of Device Access and, optionally, a Description.

Default Zone Types

• LAN - Depending on the device in use and network design, you can group one to six physical ports in this zone.

Group multiple interfaces with different network subnets to manage them as a single entity. Group all the LAN networks under this zone.

• By default the traffic to and from this zone is blocked and hence, it is the most secured zone. However, traffic between ports belonging to same zone with different networks will be allowed if the policy is applied for LAN to

LAN.

• DMZ (DeMilitarized Zone) – This zone is normally used for publicly accessible servers. Depending on the device in use and network design, you can group multiple physical ports in this zone.

• WAN - This zone is used for Internet services. It can also be referred to as Internet zone.

• VPN – This zone is used for simplifying secure, remote connectivity. It is the only zone that does not have an assigned physical port/interface. Whenever the VPN connection is established, the port/interface used by the connection is automatically added to this zone and on disconnection; the port is automatically removed from the zone. Like all other default zones, scanning and access policies can be applied on the traffic for this zone.

• WiFi - This zone is used for wireless Internet services.

The device is shipped with a single zone for LAN, WAN, DMZ, VPN and WiFi. These zones are called system zones.

Additionally, you can define LAN and DMZ zone types.

Add Zone

Use the Add Zone page to create a new zone.

1. Go to Configure > Network > Zonesand click Add.

2. Enter the zone details.

Name

Enter a name to identify the zone.

Description

Enter the description for the zone.

Type

Sophos XG Firewall | Configure | 127

Select the type of zone from the available options. LAN - Depending on the device in use and network design, you can group one to six physical ports in this zone. Group multiple interfaces with different network subnets to manage them as a single entity. Group all the LAN networks under this zone.

By default the traffic to and from this zone is blocked and hence, it is the highest secured zone.

However, traffic between ports belonging to the same zone will be allowed.

DMZ (DeMilitarized Zone) - This zone is normally used for publicly accessible servers.

Depending on the device in use and network design, you can group one to five physical ports in this zone.

Note: By default, the entire traffic will be blocked except LAN to Local zone services like administration, authentication, and network.

Members

Displays all the member ports.

Click the checkbox to select the ports. All the selected ports are moved to the 'Selected port' list.

Device Access

Device access defines the type of administrative access permitted to a zone.

Admin Services - Enable administrative services that should be allowed through this zone:

• HTTPS - Allow secure HTTPS connection to the admin console through this zone

• Telnet – Allow Telnet connection to CLI through this zone

• SSH – Allow SSH connection to CLI through this zone

Authentication Services – Enable authentication services that should be allowed through this zone:

• Client Authentication

• Captive Portal

• NTLM

• Radius SSO

Network Services - Enable network services that should be allowed through this zone:

• DNS – Allow this zone to respond to DNS requests

• Ping/Ping6 – Allow this zone to respond to pings

Other Services - Enable other services that should be allowed through this zone:

• Web Proxy

• SSL VPN Tunnel

• Wireless Protection

• User Portal

• Dynamic Routing

• SNMP

• SMTP Relay

Sophos XG Firewall | Configure | 128

Figure 100: Add Zone

3. Click Save.

Note:

• If DMZ uses a private IP address, use NATing to make them publicly accessible.

• Local and VPN zones cannot be updated or deleted.

The new zone has been created and appears on the Zones page.

WAN Link Manager

A gateway routes traffic between the networks, and if the gateway fails, communication with an external network is not possible.

By default, the device supports only one gateway. However, to cope with gateway failure problems, the device provides an option to configure multiple gateways. But simply adding one more gateway is not an end to the problem.

Optimal utilization of all the gateways is also necessary. The device's WAN Link Manager provides link failure protection by detecting the dead gateway and switching over to an active link. It also offers a mechanism to balance traffic between various links.

At the time of deployment, you have configured the IP address for a default gateway through the Network

Configuration Wizard. You can change this configuration any time and configure additional gateways. You can use the WAN Link Manger to configure multiple gateways for load balancing and failover.

By default, all the gateways defined through the Network Configuration Wizard will be defined as “Active” gateway.

The device provides a powerful solution for routing and managing traffic across multiple Internet connections.

Designed to provide business continuity for an organization of any size, the WAN Link Manager optimizes the use of multiple Internet links, such as T1s, T3s, DSL and cable connections from one or multiple Internet service providers.

Capable of automatic failover in the event of link failure, it helps to assure that your network is always connected to the Internet.

It also gives you an option to configure multiple WAN interfaces to allow connecting your device to more than one

Internet service provider (ISP).

Sophos XG Firewall | Configure | 129

When you configure multiple external interfaces, you even have an option to control which interface an outgoing packet uses.

Load Balancing

Load balancing is a mechanism that permits to balance traffic between various links. It distributes traffic among various links, optimizing utilization of all the links to accelerate performance and cut operating costs. The device employs weighted round robin algorithm for load balancing to reach maximum utilization of the capacities across the various links.

Using link load balancing gives organizations the possibility to achieve:

• Traffic distribution that does not overburden any link

• Automatic ISP failover

• Improved user performance because of no downtime

• Increased bandwidth scalability

To achieve outbound traffic load balancing between multiple links:

• Configure links in active-active setup, defining gateways as Active

• Assign an appropriate weight to each gateway. Traffic is distributed across the links in proportion to the ratio of weights assigned to individual links.

How it works

Load balancing is determined by the load metric. The load metric is weight. Each link is assigned a relative weight and the device distributes traffic across links in proportion to the ratio of weights assigned to individual links. This weight determines how much traffic will pass through a particular link in relation to the other link(s).

The administrator can set the weight and define how the traffic will be directed to providers to best utilize their bandwidth investments. Weight can be selected based on:

• Link capacity (for links with different bandwidths)

• Link/Bandwidth cost (for links with varying costs)

A weighted load balancing feature enables network managers to optimize network traffic and balance the load between multiple links/interfaces.

Gateway failover

Gateway failover provides link failure protection so that when one link goes down; the traffic is switched over to the active link. This safeguard helps to provide uninterrupted, continuous Internet connectivity to users. The transition is seamless and transparent to the end user with no disruption in service and without downtime.

To achieve WAN failover between multiple links:

• Configure links in active-backup setup

• Define Active gateway/interface

• Define backup gateway/interface – Traffic through this link is routed only when the active interface is down

• Define failover rule

In the event of Internet link failure, the WAN Link Manager automatically sends traffic to available Internet connections without administrator intervention. If more than one link is configured as backup link, traffic is distributed among the links in the ratio of the weights assigned to them. On failover, the backup gateway can inherit the parent gateway’s (active gateway) weight or can be configured.

The transition from the dead link to the active link is based on the failover rule defined for the link. The failover rule specifies:

• how to check whether the link is active or dead

• what action to take when a link is not active

Sophos XG Firewall | Configure | 130

The failover rule has the form:

IF Condition 1 AND/OR Condition 2 then Action

Depending on the outcome of the condition, traffic is shifted to any other available gateway.

A ping rule is automatically created for every gateway. The device periodically sends the ping request to check health of the link and if link does not respond, traffic is automatically sent through another available link. The selection of the gateway and how much traffic is to be routed through each gateway depends on the number of configured active and backup gateways.

Gateway Failback

During a link failure, the device regularly checks the health of a given connection, assuring a fast reconnection as soon as the Internet service is restored. When the connection is restored and the gateway is up again, without the administrator’s intervention, traffic is again routed through the active gateway. In other words, the backup gateway fails back on the active gateway.

WAN Link Manager

The WAN Link Manager page displays a list of configured IPv4 and IPv6 gateways. The page also displays the status

Active or Deactive for each gateway and failover rule in case multiple gateways are configured. You can change the gateway parameters, change the gateway status, add or remove the failover rule, and view the data transfer passed through the gateway.

For the backup gateway, the weight is NA while for the active gateway, the configured weight is displayed.

Click the data transfer icon under the Manage column of the corresponding gateway to view the total data transferred through the gateway in graphical as well as in tabular form.

Gateway Failover Timeout Configuration

Gateway Failover Timeout

Configure the gateway failover timeout in seconds.

This is the time period the device waits before the gateway failover occurs.

Default: 60 seconds

Acceptable Range: 1 to 65535

Figure 101: Gateway Failover Timeout Configuration

Update Gateway Configuration

You can update the gateway configuration from this page.

1. Go to Configure > Network > WAN Link Manager, click the gateway's Name hyperlink or click the edit icon under the Manage column to edit its settings.

2. Enter the gateway details.

Name

Enter the name of the gateway.

IP Address

Enter the IP address assigned to the gateway.

Sophos XG Firewall | Configure | 131

Interface

Specify the IP address of the interface.

Type

Specify the type of the gateway.

Available Options: Active - Traffic will route through the active gateway(s). If more than one active gateway is configured then the traffic will be load balanced between these gateways depending on the weight assigned to the each gateway.Backup – A gateway used in an active/ passive setup, where traffic is routed through the backup gateway only when the active gateway is down.

Weight

Depending on the weight, the gateway is selected for load balancing. The device distributes traffic across links in proportion to the ratio of weights assigned to individual links.

This weight determines how much traffic will pass through a particular link relative to the other link(s).

Gateways can be assigned a weight from 1 to100.

Note: When multiple gateways are configured and one gateway goes down, the traffic is switched over to the available gateways according to the ratio of the weights assigned to the available gateways.

Default NAT Policy

Select the NAT policy to be used as default for a particular gateway.

By default, the MASQ NAT policy is configured.

Select None, if NAT should not be applied on that particular gateway.

Figure 102: Update Active Gateway Configuration

3. Enter the backup gateway details (Only available, if the type is Backup)

Activate This Gateway

Select gateway activation condition: automatically or manually.

Automatic failover

For automatic failover, activate the option If ... Active gateway fails.

From the dropdown list, specify when the backup gateway should take over from the active gateway. This takeover process will not require the administrator’s intervention.

Available Options:

Sophos XG Firewall | Configure | 132

• Specific Gateway - The dropdown list displays all configured gateways. The backup gateway will take over and traffic will be routed through the backup gateway only when the selected gateway fails.

• ANY – The backup gateway will take over and traffic will be routed through the backup gateway when any of the active gateway fails.

• ALL – The backup gateway will take over and traffic will be routed through the backup gateway when all the configured active gateways fail.

Manual failover

If you select Manually, the administrator will have to change the gateway manually when the active gateway fails.

Action on Activation

Configure weight for the backup gateway. The device distributes traffic across links in proportion to the ratio of weights assigned to individual link. This weight determines how much traffic will pass through a particular link relative to the other link.

Inherit weight of the failed active gateway

If this option is selected, the backup gateway will inherit the parent gateway’s (active gateway) weight

Use configured weight

If this option is selected, the weight specified in the Weight field will be used for the backup gateway.

Figure 103: Backup Gateway Details

4. Click Save.

The gateway details have been updated.

5. Configure the Failover Rules.

IF Then Condition

From the dropdown list, select the communication protocol, such as TCP or PING (ICMP). Select the protocol depending on the service to be tested on the host.

Port: For TCP communication, specify the port number for communication.

on IP Address: Specify the IP address of the computer or the network device which is permanently running or most reliable.

Condition

• AND - All the conditions must be satisfied before the specified action is taken

• OR - At least one condition must be satisfied before the specified action is taken.

A request is sent to an IP address. If the IP address does not respond to the request, the device considers the IP address as unreachable.

Sophos XG Firewall | Configure | 133

Figure 104: Configure Failover Rules

6. Click Save.

The failover rule has been updated.

Add Failover Rule

You can add failover rule from this page.

1. Go to Configure > Network > WAN Link Manager, click the gateway's Name hyperlink or click the edit icon under the Manage column and click Add under the Failover Rules section.

2. Configure the failover rules.

IF Then Condition

From the dropdown list, select the communication protocol, such as TCP or PING (ICMP). Select the protocol depending on the service to be tested on the host.

Port: For TCP communication, specify the port number for communication.

on IP Address: Specify the IP address of the computer or the network device which is permanently running or most reliable.

Condition

• AND - All the conditions must be satisfied before the specified action is taken

• OR - At least one condition must be satisfied before the specified action is taken.

A request is sent to an IP address. If the IP address does not respond to the request, the device considers the IP address as unreachable.

Figure 105: Configure Failover Rules

3. Click Save.

The failover rule has been added.

Network Traffic Report for Default Gateway

Click the data transfer icon under the Manage column of the corresponding gateway to view the total data transferred through the gateway in graphical as well as in tabular form.

Network Traffic Report for Default Gateway

Period

From the available options, select the period for the report of the network traffic that passed through the gateway.

Available Options:

• Weekly

Sophos XG Firewall | Configure | 134

• Monthly

• Custom

The graph displays the upload, download and total data transfer through the gateway.

• X-axis: Date (depending on the period selected)

• Y-axis: KB/MB/GB used

Legend

• Orange Color – Upload Network Traffic (MB)

• Purple Color – Download Network Traffic (MB)

• Green Color – Total Network Traffic (MB)

Note: When the selected period is Custom, then the user can select to view data of not more than the last six (06) months. At one time, only thirty (30) days data will be displayed.

Figure 106: Network Transfer Report

DNS

Use this page to configure the DNS settings of the device.

The DNS server is configured at the time of installation. You can add additional DNS servers to which the device can connect for name resolution. If multiple DNS are defined, they are queried in the order as they are entered.

Note: You can also view and manage the DNS server status on the Monitor & Analyze > Diagnostics >

Services page.

Sophos XG Firewall supports static DNS host entry where the device acts as a DNS Name Server that provides the requesting client with 'A' records to resolve their requested URL.

You can manually add static DNS host entries for a particular domain name. Sophos XG Firewall checks DNS host entries for the requested domain name. If the domain name requested by the user matches the DNS host entry then the device performs DNS resolution and replies to the client with the IP address found in the static DNS host entry. DNS requests do not need to be redirected to the Local/Authoritative DNS server any longer. This facilitates faster data

Sophos XG Firewall | Configure | 135 transfer and avoids multiple DNS resolution cycles for every client request. You can also add multiple IP addresses for a single website hosted behind Sophos XG Firewall.

When you want external domains names to be resolved through internal DNS servers in your network, you can add

DNS request routes to such servers. This will decrease the Internet traffic over the network and speed up DNS client requests as queries will not be forwarded outside the network. Also, DNS information would be less exposed on the

Internet thus enhancing security.

IPv4

Obtain DNS from DHCP

Click to override the device DNS with the DNS address received from the DHCP server.

The option is available if enabled from the Network Configuration Wizard or if a DHCP interface is configured.

Obtain DNS from PPPoE

Click to override the device DNS with the DNS address received from the PPPoE server.

The option is available if enabled from the Network Configuration Wizard or if a DHCP interface is configured.

Static DNS

Select to provide a static IPv4 DNS server address.

A maximum of three static DNS IPv4 addresses can be provided.

Figure 107: IPv4 DNS Settings

IPv6

Obtain DNS from DHCP

Click to override the device DNS with the DNS address received from the DHCP server.

The option is available if enabled from the Network Configuration Wizard or if a DHCP interface is configured.

Static DNS

Select to provide a static IPv6 DNS server address.

A maximum of three static DNS IPv6 addresses can be provided.

Sophos XG Firewall | Configure | 136

Figure 108: IPv6 DNS Settings

DNS Query Configuration

Choose server based on incoming requests record type

Select to choose the DNS server to be used for resolving the domain name on the basis of the incoming requests record type. Incoming request can be of A or AAAA type.

Choose IPv6 DNS server over IPv4

Select to first choose the IPv6 DNS server for resolving the DNS and then the IPv4 DNS server.

If both IPv6 and IPv4 DNS servers are configured, then it first selects the IPv6 DNS server for all requests followed by the IPv4 DNS server.

Choose IPv4 DNS server over IPv6

Select to first choose the IPv4 DNS server for resolving the DNS and then the IPv6 DNS server.

If both IPv6 and IPv4 DNS servers are configured, then it first selects the IPv4 DNS server for all requests followed by the IPv6 DNS server.

Choose IPv6 if request originator address is IPv6, else IPv4

Select to choose the IPv6 DNS server if a request is received from an IPv6 source or choose the

IPv4 DNS server, if a request is received from an IPv4 source.

Apply

Click to save the configuration.

Test Name Lookup

Click and provide an IP address or host name for testing the connectivity with the DNS server.

Figure 109: DNS Query Configuration

Sophos XG Firewall | Configure | 137

DNS Host Entry

The DNS Host Entry section displays the list of all the configured host entries. You can filter the list based on the host/domain name. This section provides the option to add, update, or delete entries.

DNS Request Route

This section displays a list of all the configured DNS request routes. You can filter the list based on the name or the target. Additionally, you can add, update and delete routes.

Add DNS Host Entry

The Add DNS Host Enry page allows you to create and manage DNS host entries.

1. Go to Configure > Network > DNS and click Add under DNS Host Entry section.

2. Enter the host entry details.

Host/Domain Name

Provide a fully qualified domain name (FQDN) for the host/domain.

Address

Enter the address details for the host entry.

Entry Type

Select the DNS host entry type.

Available Options:

• Manual – Enter the IP address for the host manually

• Interface IP – Configure an interface as host

IP Address

Specify the IP address of the host/domain or select an interface IP depending on the option selected for the entry type.

Maximum entries per host: 8

Time to Live (seconds)

Specify the TTL in seconds.

Default: 60 seconds

Weight

Specify the weight for load balancing the traffic. The device distributes traffic across the links in proportion to the ratio of weights assigned to individual links.

This weight determines how much traffic will pass through a particular link relative to the other link(s).

Default: 1

Publish on WAN

Enable to publish the DNS host entry on WAN.

Default: Disabled

Reverse DNS Lookup

Reverse DNS lookup is the resolution of an IP address to its designated domain name. Enable to allow reverse DNS lookup.

Note: If there are multiple hosts resolving to the same IP address then Reverse DNS

Lookup can only be configured for one of the IP addresses.

• Only A, AAAA, and PTR type of DNS records are supported.

• Address (A) record points a hostname to an IP address and returns a 32-bit IPv4 address.

Sophos XG Firewall | Configure | 138

• AAAA record points a hostname to an IP address and returns a 128-bit IPv6 address.

• Pointer records (PTR) are just the reverse of A records and are used for reverse lookups. They map the IP address to a hostname.

• Maximum DNS entries supported: 1024

• If the device interface is used as a DNS in the client system then a query is sent to the configured DNS servers prior to querying the ROOT severs.

Figure 110: DNS Host Entry

3. Click Save.

The DNS host entry has been created and appears on the DNS page.

Add DNS Request Route

This page allows you to configure DNS Request routes to internal DNS servers.

1. Go to Configure > Network > DNS and click Add under DNS Request Route section.

2. Enter DNS request route details.

Host/Domain Name

Specify the domain for which you want to use the internal DNS server.

Target Servers

Select a DNS server(s) to resolve the domain specified above.

You can also add IP address to the DNS from this page by entering it in the entry field. Up to eight

IP addresses can be added.

Figure 111: Add DNS Request Route

Sophos XG Firewall | Configure | 139

3. Click Save.

The DNS request route has been created and appears on the DNS page.

DHCP

The DHCP section allows you to configure DHCP for your network.

On a network, the dynamic host configuration protocol (DHCP) automatically assigns IP addresses to the hosts on a network, thus reducing the administrator’s configuration task. Instead of requiring administrators to assign, track and change (when necessary) IP addresses for every host on a network, DHCP settles it automatically. Furthermore,

DHCP ensures that duplicate addresses are not used.

The DHCP section covers the following topics:

Server

The device acts as a DHCP server: it assigns a unique IP address to a host and releases the address when the host leaves and re-joins the network. Each time, when the host connects to the network, it can have another IP address. In other words, the device provides a mechanism for allocating the IP address dynamically so that addresses can be reused.

An interface having static IP assignment can also act as a DHCP server. You can disable or change this DHCP server configuration. You can configure IPv4 and IPv6 DHCP servers.

Using the Server section, you can configure and manage DHCP servers on the device. It displays a list of all configured DHCP servers, and you can filter the list based on the IP family.

Note:

• The device cannot act as DHCPv6 server and DHCPv6 relay agent simultaneously.

• DHCPv4 Server and DHCPv4 Relay cannot be configured using the same Interface.

Relay

Deploying DHCP in a single segment network is easy. All DHCP messages are IP broadcast messages, and therefore all the computers on the segment can listen and respond to these broadcasts. But things get complicated when there is more than one subnet on the network. The reason is that the DHCP broadcast messages do not cross the router interfaces by default. The DHCP relay agent makes it possible to place DHCP clients and DHCP servers on different networks. The relay agent allows DHCP broadcast messages to be sent over routers that do not support forwarding of these types of messages. The DHCP relay agent enables DHCP clients to obtain IP addresses from a DHCP server on a remote subnet, or from a server which is not located on the local subnet. If the DHCP relay agent is not configured, clients would only be able to obtain IP addresses from the DHCP server which is on the same subnet.

Using the Relay section, you can configure and manage DHCP relay agents on the device. It displays a list of all interfaces configured as a relay agent, and you can filter the list based on the relay agent name and the IP family.

Lease

The device acting as a DHCP server assigns or leases an IP address from an address pool to a host DHCP client. The

IP address is leased for a determined period of time or until the client relinquishes the address. The IPv4/IPv6 Lease section displays a list of all IPv4 and IPv6 addresses leased dynamically, and you can filter the lists based on the leased IP, or the client's physical address.

IPv4 Lease

For each IPv4 address, the list displays the following:

• Leased IP address

• Leased start and end time

• Client physical address

• Client host name

Sophos XG Firewall | Configure | 140

• Lease type

IPv6 Lease

For each leased IPv6 address the list displays the following:

• Leased IP address

• Leased start and end time

• Client physical address

• DUID

Related information

Configure DHCP Options

Configure Interface as DHCPv4 Server

This page describes how to configure an interface as DHCP server for IPv4.

1. Go to Configure > Network > DHCP, click Add in the Server section and select IPv4 using the default filter.

2. Specify the General Settings details.

Name

Enter a name to identify the DHCPv4 server uniquely.

Interface

Select an interface to set it as DHCPv4 server. DHCP service can be configured on a virtual interface but not on an interface alias.

Note: DHCPv4 Server and DHCPv4 Relay cannot be configured using the same

Interface.

Dynamic IP Lease

Specify the range of IP addresses from which the DHCP server must assign an IP address to the clients and set a subnet mask for the IP address range. You can configure multiple IP ranges for the same interface. Furthermore, you can provide multiple IP ranges for the DHCP server.

Click and to add or delete a range.

Static IP MAC Mapping

If you want to assign specific IP addresses to some or all clients permanently, you can define static

MAC address-to-IP address mappings. To define a MAC-IP mapping, you should know the MAC address of the client’s network card. The MAC address is usually specified in hexadecimal digits separated by colons (for example, 00:08:76:16:BC:21). Specify the host name, the MAC address and the IP address. You can provide multiple MAC-IP mappings for the DHCP server.

Use and to add or delete a MAC-IP mapping.

Subnet Mask

Select a subnet mask for the server.

Domain Name

Specify the domain name that the DHCP server will assign to the DHCP clients.

Gateway

Use this option to apply an interface IP as gateway.

Specify the IP address to be used as default gateway or select Use Interface IP as Gateway to use the IP address entered for Interface

Default Lease Time

Specify the default lease time.

Acceptable range: 1 to 43200 minutes (30 days)

Sophos XG Firewall | Configure | 141

Default: 1440 minutes

Max Lease Time

Specify the maximum lease time. The DHCP client must ask the DHCP server for new settings after the specified maximum lease time has expired.

Acceptable range: 1 to 43200 minutes (30 days)

Default: 2880 minutes

Conflict Detection

Enable IP conflict detection to check the IP address before leasing. If enabled, the already leased IP address will not be leased again.

Figure 112: General Settings

3. Specify the DNS Server details.

Use Device’s DNS Settings

Click to use the device's DNS server. In this case, the first two configured DNS will be used.

If not enabled, provide a primary and secondary DNS to be used.

Primary DNS (only available if Use Device' DNS Settings is disabled)

Specify the IP address of the primary DNS server.

Secondary DNS (only available if Use Device' DNS Settings is disabled)

Specify the IP address of the secondary DNS server.

Sophos XG Firewall | Configure | 142

Figure 113: DNS Server details

4. Specify WINS Server details.

Primary WINS Server

Specify the IP address of the primary WINS server.

Secondary WINS Server

Specify the IP address of the secondary WINS server.

Figure 114: WINS Server details

5. Click Save.

Related information

Configure DHCP Options

Configure Interface as DHCPv6 Server

This page describes how to configure an interface as DHCP server for IPv6.

1. Go to Configure > Network > DHCP, click Add in the Server section and select IPv6 using the default filter.

2. Specify the General Settings details.

Name

Enter a name to identify the DHCPv6 server uniquely.

Interface

Select an interface to set it as DHCPv6 server. DHCP service can be configured on a virtual interface but not on an interface alias.

Dynamic IP Lease

Specify the range of IPv6 addresses from which the DHCP server must assign an IP address to the clients and set a subnet mask for the IPv6 address range. You can configure multiple IPv6 range for the same interface.

Furthermore, you can provide multiple IP ranged for the DHCP server.

Click and to add and delete a range.

Static IP DUID Mapping

If you want to assign specific IP addresses to some or all clients permanently, you can define static

DUID address-to-IP address mappings. To define DUID-IP mapping, you should know the DHCP

Unique Identifier (DUID) of the client. The DUID address is usually specified in groups of two hexadecimal digits separated by colons.

Sophos XG Firewall | Configure | 143

*Each DHCP client and server has a DUID. DHCP servers use DUIDs to identify clients for the selection of configuration parameters. DHCP clients use DUIDs to identify a server in messages where a server needs to be identified.

Specify the host name, DUID and the IP address. You can provide multiple DUID-IP mappings for the DHCP server.

Click and to add or delete a DUID-IP mapping.

Preferred Time

Specify the preferred time.

Acceptable range: 1 to 43200 minutes (30 days)

Default: 540 minutes

Note: Preferred time should be less than valid time.

Valid Time

Specify the valid time.

Acceptable range: 1 to 43200 minutes (30 days)

Default: 720 minutes

Figure 115: General Settings

3. Specify the DNS Server details.

Use Device’s DNS Settings

Click to use the device's DNS server. In this case, the first two configured DNS will be used.

If not enabled, provide a primary and secondary DNS to be used.

Primary DNS (only available if Use Device' DNS Settings is disabled)

Specify the IPv6 address of the primary DNS server.

Secondary DNS (only available if Use Device' DNS Settings is disabled)

Specify the IPv6 address of the secondary DNS server.

Sophos XG Firewall | Configure | 144

Figure 116: DNS Server details

4. Click Save.

Related information

Configure DHCP Options

* RFC 3315 (Dynamic Host Configuration Protocol for IPv6 (DHCPv6)

Add DHCP Relay Configuration

This page describes how to configure an interface as DHCP relay agent.

1. Go to Configure > Network > DHCP and click Add in the Relay section.

2. Enter the DHCP relay configuration details.

Name

Provide a name to identify the DHCP relay agent.

IP Family

Select the IP family for the DHCP relay agent.

Available Options:

• IPv4

• IPv6

Interface

Select an interface on which your client network is configured. Device listens for DHCP queries on this interface and is used to forward packets between client and server.

Interfaces having a static IP assignment can act as a DHCP relay agent.

The DHCP relay agent can be configured on a virtual interface but not on an interface alias.

Note:

• The device cannot act as DHCPv6 server and DHCPv6 relay agent simultaneously.

• DHCPv4 Server and DHCPv4 Relay cannot be configured using the same

Interface.

DHCP Server IP

Specify the DHCP server IP address. You can also configure multiple DHCP servers. This facilitates deploying DHCP servers in high availability environment. The DHCP relay will forward packets to all configured DHCP servers, and the active server will serve the request. In case the active server goes down, the backup server serves the request. The DHCP server takes care of leasing the IP address to a client.

Maximum DHCP servers configurable per DHCP relay: 8

Relay through IPSec (Only availabe if IP family is IPv4)

Select to relay DHCP messages through an IPSec VPN tunnel.

Sophos XG Firewall | Configure | 145

Figure 117: Add DHCP Relay Configuration

3. Click Save.

The DHCP relay agent has been created and appears on the DHCP page.

IPv6 Router Advertisement

Address Assignment for IPv6 Devices

IPv6 clients are assigned an IP address through:

• DHCP for IPv6

• Stateless address auto configuration (SLAAC)

DHCP for IPv6

Similar to IPv4, IPv6 can use DHCP to assign IP addresses to any clients. The device can be configured to be a stateful DHCP server. The DHCP server is responsible for assigning the IP address to the client and for keeping a record of all clients and the IPv6 addresses assigned to them.

Stateless Address Auto Configuration

The IPv6 protocol supports address auto configuration for stateless addresses. IPv6 devices automatically create unique link-local addresses for IPv6 enabled interfaces, and clients use router advertisement messages to configure their own IP address automatically.

Router Advertisement

The device acting as a router has the ability to participate in stateless auto configuration (SLAAC) and by default provides a IPv6 address and a default gateway to the client.

When the device interface is connected to a network and enabled, the host may send out an ICMPv6 (type 135)

Router Solicitation (RS) message that requests the device to generate Router Advertisement (RA) immediately instead of waiting until their next scheduled time. On receiving the RS message, the device immediately sends an ICMPv6

(type 134) router advertisement (RA) message announcing the state of its availability. Router advertisements include information about which method to be used for address assignment, prefixes used for on-link determination and/or address configuration, hop limit value, several flag status, etc. The critical parameters can be administered centrally and if necessary, can be propagated automatically to all hosts on the network. The device advertises information about various interfaces and Internet parameters either periodically or in response to the RS message, informing all the nodes on the network about any modification regarding addressing information. Thus, Router advertisement (along

Sophos XG Firewall | Configure | 146 with prefix flags) permits simple stateless auto configuration and guides a host in generating an address using autoconfiguration.

Note: You can also view and manage the router advertisement service status on the Monitor & Analyze >

Diagnostics > Services page.

Configure IPv6 Router Advertisement settings

You can configure the router advertisement settings for an interface from this page.

1. Go to Configure > Network > IPv6 Router Advertisement and click Add.

2. Enter details for the General Settings.

Interface

Select an interface for router advertisement.

All IPv6 enabled physical interfaces, LAG, VLAN and bridge interfaces can be selected.

Description

Enter a description for the interface to be selected for router advertisement.

Min Advertisement Interval

Specify the minimum time interval in seconds between two consecutive unsolicited router advertisement messages sent to the clients.

Acceptable range: 3 to 1350 seconds

Default: 198 seconds

If the Max Advertisement Interval is 9 seconds or above, then the Min Advertisement Interval must be: 0.75 * maximum advertisement interval.

Max Advertisement Interval

Specify the maximum time interval in seconds between two consecutive unsolicited router advertisement messages sent to the clients.

Acceptable Range: 4 to 1800 seconds

Default: 600 seconds

Managed Flag

Select to set the managed flag. When this flag is set, IPv6 addresses are obtained from the DHCPv6 server.

By default, this flag is not selected.

Note: The option must be selected only if a DHCPv6 Server is available else IPv6 clients would not get IPv6 addresses

Other Flag

Select to set the other flag. When this flag is set, the DHCPv6 client obtains other network parameters such as DNS server, domain name, NIS, NISP, SIP, SNTP, and BCMS servers from the

DHCPv6 server.

Note: This option must be selected only if a DHCPv6 server is available.

Default Gateway

Select to use the device as default gateway for communication with the client.

Life Time

Specify the time in seconds to be used for router advertisement as a default gateway at the client end.

The value specified should be between the value specified for Max Advertisement Interval and

9000 seconds.

Sophos XG Firewall | Configure | 147

Default: 1800 seconds

Prefix Advertisement Configuration

Prefix Advertisement includes zero or more prefix options containing information that the default gateway advertises. This information is used by stateless address auto configuration to auto-generate a global IPv6 address. Prefix advertisement has its own list of attributes:

Prefix / 64

Provide the first 64 bits of the IPv6 address.

The interface uses this prefix information from the router advertisement message to determine the last 64 bits (interface identifier) of its 128-bit IPv6 address.

The first 64 bits (higher order bits) of the IPv6 address so provided, specify the network, while the remaining specify a particular address in the network. Hence, IPv6 addresses in one network have the same first 64 bits and are called “prefix”.

On-link

Select to set the prefix to be “On-link”. With the attribute On-link set, the devices with IPv6 addresses that are within this prefix are reachable on the subnet without a need of a router.

By default, this flag is set.

Autonomous

Select to set the prefix attribute Autonomous. On being set, the global IPv6 address is automatically generated by appending the 64 bit interface identifier to the prefix (prefix /64) advertised in the prefix information.

Only those prefixes that has the Autonomous flag set gets a stateless address auto configuration

(SLAAC) IPv6 address.

By default, the flag is set.

Preferred Life Time

Specify the time in minutes for a valid address to remain in the preferred state. The use of the preferred address is unlimited.

On expiry of the valid life time, the preferred address becomes deprecated. The use of the deprecated address must be avoided, however, it is not forbidden and can be continued to be used as source address for an existing communication.

The IPv6 address will continue to remain in the preferred state as long as it is refreshed by prefixes in the router advertisement or by any other means or are renewed by DHCPv6.

Acceptable values: 0 to 71582789 minutes

Default: 240 minutes

Specify the attribute value as “-1” for an infinite preferred life time.

Valid Life Time

Specify the time in minutes for an address to remain in the valid state.

This value determines the time for an address to be in the valid state. Until the time expires, the prefix is considered to be on-link and auto-configured addresses using the prefix can be used.

On expiry of the valid life time, the IPv6 address becomes invalid and cannot be used to send or receive traffic.

Acceptable range: 0 to 71582789 minutes

Default: 1440 minutes

Specify the attribute value as “-1” for an infinite valid life time.

Use the and icons to add or remove a prefix.

Sophos XG Firewall | Configure | 148

Note: The value of attribute Valid Life Time must be greater than or equal to value of Preferred Life Time.

Figure 118: General Settings

3. Enter the details for the Advanced Settings

Using the network discovery protocol (NDP) devices on the same interface discover the presence of each other and the respective link-layer addresses, find gateway routers and maintain the reachability information about the active paths to the peers.

Link MTU

Specify the Maximum Transmission Unit (MTU) in bytes for the packets sent on this interface.

Default: 0

Acceptable range: 1280 to 1500 bytes

If Link MTU is set to zero, the information will not be advertised by the interface.

Reachable Time

Specify the reachable time in seconds that the client will use to assume a neighbor is reachable after having received a reachability confirmation message.

Default: 0

Acceptable range: 0 to 3600 seconds

Retransmit Time

Specify the retransmission time in seconds that the client will use to determine how long it should wait before retransmitting neighbor solicitation messages.

Default: 0

Acceptable range: 0 to 4294968 seconds

Hop Limit

Specify the hop limit value.

This value determines the number of hops that a packet is limited to. The hop value is decremented by each router along the route. On reaching zero, the packet is destroyed.

Default: 64

Acceptable range: 0 to 255 seconds

Sophos XG Firewall | Configure | 149

Figure 119: Advanced Settings

4. Click Save.

The IPv6 router advertisement settings have been updated.

Cellular WAN

This feature is not supported in Sophos Virtual Security Devices.

Cellular WAN is a wide area network (WAN) for data that is typically provided by the cellular carriers to transmit a wireless signal over a range of several miles to a mobile device. Cellular WAN connectivity allows a user with a laptop and a Cellular WAN support to use the web, or connect to a VPN from anywhere within the regional boundaries of a cellular service.

Cellular WAN are popularly known as "wireless broadband".

To configure Cellular WAN:

1. Enable Cellular WAN. You can also enable from CLI with the command: system cellular_wan enable.

2. Re-login to the Admin console.

3. Edit the Cellular WAN (WWAN1) interface and configure the Cellular WAN initialization string and gateway from Configure > Network > Interfaces page.

To configure Cellular WAN settings, please refer :

Configure Cellular WAN Settings

on page 107

Once Cellular WAN is enabled, an interface named WWAN1 is created and it is the member of the WAN zone.

As Cellular WAN interface is a member of WAN zone:

• All the services enabled for the WAN zone from the Device Access page are automatically applicable on WWAN1 connection too.

• All the firewall rules applied on WAN zone will be applied on Cellular WAN (WWAN1) interface.

• A default host named ##WWAN1 is created and firewall rules and VPN policies can be created for the default host.

• WWAN1 gateway is added as backup gateway

• When the Cellular WAN is disabled from CLI in the Cellular WAN menu, default host ##WWAN1and Cellular

WAN gateway options will be removed from the Admin Console.

Note:

• Cellular WAN is not supported in bridge mode.

• DHCP server configuration is not supported for the Cellular WAN (WWAN1) interface.

• If backup of a device is taken on which Cellular WAN is enabled and restored on a device where it is not enabled, Cellular WAN configuration would still be visible.

Sophos XG Firewall | Configure | 150

Status

The Cellular WAN page displays the status of the Cellular WAN connection. Along with details of the Cellular WAN connection, the page also provides the facility to connect and disconnect the Cellular WAN connection. Below are the screen elements with their description:

Cellular WAN

Enable/Disable Cellular WAN.

Default - Disabled

Connect/Disconnect Button

Click to connect or disconnect the Cellular WAN connection. This process may take some time.

Status

Displays the status of the connection. Status messages can be of the following types:

Possible Status:

• Modem not supported

• No Modem plugged-in

• Connecting…

• Reconnecting

• Connected

• Disconnected

Modem Name

Name of the modem.

IP Address

IP address assigned to the device.

Gateway IP

IP address assigned as the gateway.

Bytes Uploaded

Number of bytes uploaded (in KB).

Bytes Downloaded

Number of bytes downloaded (in KB).

Time Duration

Time period since Cellular WAN is connected.

Format: HH:MM::SS

Sophos XG Firewall | Configure | 151

Figure 120: Status of the cellular WAN Connection

IP Tunnels

An IP tunnel is an Internet protocol network communications path between two networks. It is used to encapsulate one network protocol as a carrier for another network protocol. It is often used by two separate networks having a router with different network addresses for communication. The device supports IPv6 tunneling. Hence, IPv6 packets can be encapsulated in IPv4 headers using the IP Tunnel feature.

This page provides a list of all configured IP tunnels. The administrator can create and manage IP tunnels from this page.

Add IP Tunnel

The Add IP Tunnel page allows you to create or edit an existing 6in4, 6to4, 6rd or 4in6 IP tunnel.

1. Go to Configure > Network > IP Tunnels and click Add.

2. Enter the tunnel details.

Tunnel Name

Enter a unique name to identify the tunnel.

Tunnel Type

Select the tunnel type from the available options.

Available Options:

• 6in4 – 6in4 uses tunneling to encapsulate IPv6 traffic over IPv4 links. This is used when IPv6 packets have to travel over IPv4 links with IPv6 networks at both endpoints..

• 6to4 – 6to4 allows encapsulation of an IPv6 packet in an IPv4 header to send it to an IPv4 destination. This is used when the local endpoint is an IPv6 host while the remote endpoint is an

IPv4 host.

• 6rd – 6rd is similar in implementation to the 6to4 tunnel. However, unlike 6to4, 6rd allows the administrator to use a native IPv6 prefix.

• 4in6 – 4in6 uses tunneling to encapsulate IPv4 traffic over configured IPv6 tunnels. This is used when IPv4 traffic is to be used in a pure IPv6 network.

6rd Prefix (Only available if the tunnel type 6rd is selected)

Specify the native IPv6 prefix to be used for the tunnel.

Zone

Select the zone to create the tunnel for.

Sophos XG Firewall | Configure | 152

The tunnel is used for the traffic of the selected zone.

Available Options:

• LAN

• WAN

• DMZ

• WiFi

Local Endpoint

Specify the IP address of the local endpoint of the tunnel.

For:

• 6in4: Specify the IPv6 address of the local endpoint.

• 6to4: Specify the IPv6 address of the local endpoint.

• 6rd: Specify the IPv6 address of the local endpoint.

• 4in6: Specify the IPv4 address of the local endpoint.

Remote Endpoint (Only available if the tunnel types 6in4 or 4in6 are selected)

Specify the IP address of the remote endpoint of the tunnel.

For

• 6in4: Specify the IPv4 address of the remote endpoint.

• 4in6: Specify the IPv6 address of the remote endpoint.

3. Enter the Advanced Settings.

TTL

Specify the time to live (TTL) life time for the data.

The attribute TTL defines a limit regarding the number of attempts to transmit an IP packet before discarding it.

Default: 0

Acceptable Range: 0 to 255

TOS

Specify the type of service (TOS) for the data.

The attribute TOS provides the value for an IP packet depending on the service which is provided.

The service mainly defines the packet priority, the type of route (latency, throughput, or reliable service).

Default: 0

Acceptable Range: 0 to 99

Sophos XG Firewall | Configure | 153

Figure 121: IP Tunnel

4. Click Save.

The IP tunnel has been created or updated and appears on the IP Tunnel page.

Neighbors (ARP-NDP)

From this page, view the IPv4 and IPv6 ARP-NDP neighbors, create static neighbors and flush existing neighbors.

ARP-NDP

TCP/IP uses ARP (Address Resolution Protocol) protocol to translate an IPv4 address into a MAC address (physical network address). In other words, it maps layer 3 (IPv4 addresses) to layer 2 (physical or MAC addresses) to enable communications between hosts residing on the same subnet. Similarly to translate IPv6 addresses, NDP (Neighbor

Discovery Protocol) is used.

ARP is used by hosts that are directly connected on a local network and uses either or both unicast and broadcast transmissions directly to each other. The host finds the physical address of another host on its network by sending an ARP query packet that includes the IP address of the receiver. As a broadcast protocol, it can create excessive amounts of network traffic on your network. To minimize the broadcast traffic, an ARP cache is maintained to store and reuse previously learned ARP information.

NDP in IPv6 is similar to ARP in IPv4. The main purpose of both protocols is to enable a host (node) to determine the link layer address (MAC address) of the node it wants to communicate with, in the local network and to find out the link layer address of the router through which it can access a node in an external network. Thus, the actual exchange of messages can take place between the two nodes. Apart from neighbor discovery, NDP functionality includes router discovery, neighbor presence, redirects, network options (as in DHCP options) and stateless auto-configuration.

Similar to ARP, NDP is also susceptible to flooding and poisoning attacks.

NDP has neighbor solicitations analogous to ARP request and neighbor advertisements analogous to ARP replies.

Unsolicited neighbor advertisements in IPv6 correspond to gratuitous ARP replies in IPv4. Static neighbor configuration protects the neighbor cache from trusted or vulnerable nodes in the network. Static neighbor discovery helps -to prevent solicit requests for configured entries and ignores any incoming solicit or advertised ND for configured entries.

Neighbors

ARP and NDP traffic is a vital communication on a network and is enabled on the Device interfaces by default.

A static neighbor entry allows binding the MAC address to the designated IP address and port. Once the MAC address is bound to a port and IP address, the Device will not update its neighbor table dynamically and will not respond to that IP-MAC pair on any other port. It will also remove any dynamically cached references to that IP address that might be present, and will not allow additional static mappings of that IP address.

Sophos XG Firewall | Configure | 154

These entries will be stored in the Static Neighbor Table, the IPv4 Neighbor Cache and the IPv6 Neighbor Cache.

The Device performs the neighbor lookup in the static neighbor table when it receives the request on a particular port.

If there is any mismatch in an IP address or MAC address, the Device considers it as a neighbor poisoning attempt and does not update its neighbor cache. If an entry is not available in the table, the Device will lookup in the IPv4 or

IPv6 neighbor cache and adds the MAC address to the neighbor cache if required.

Consider an example when IP1 is mapped to MAC1 and the IP1-MAC1 pair is bound to Port A. Similarly, IP2 is mapped to MAC1 and the IP2-MAC1 pair is bound to Port A

Table 1: Illustration for Neighbor Poisoning

IP Address

IP1

IP3

IP2

MAC Address

MAC1

MAC2

MAC1

Port

Any other port than A

No static ARP

Any other port than A

Neighbor Poisoning Attempt

Yes

Neighbors (ARP-NDP)

The device maintains three types of table for neighbor entries: Static Neighbor Table, IPv4 Neighbor Cache and IPv6

Neighbor Cache.

IPv4/IPv6 Neighbor Cache table

The IPv4/IPv6 neighbor cache table stores static and dynamic neighbor entries. Static neighbor entries are defined by administrators and are permanent while dynamic neighbor entries are learned entries and are updated dynamically.

Such dynamic entries can be flushed by clicking Flush.

Go to Configure > Network > Neighbors (ARP-NDP) and select IPv4 Neighbor Cache or IPv6 Neighbor Cache to view the large number of neighbor entries. This page allows navigating and managing the neighbor entries in all three tables. Select the table type from the drop-down list to view the neighbor entries in the respective table. It lists IP address, MAC address, interface and type of the entry. Entry type can be static or dynamic. If everything is working properly with the neighbor, the dynamic neighbor entry will be displayed as “Complete, Dynamic”.

“Complete, Dynamic” means both MAC and IP values are there in the table while “Incomplete, Dynamic” means that the neighbor request was sent but no reply has yet been received.

Neighbor Configuration

Neighbor cache entry timeout

Specify time interval after which the entries in the cache should be flushed.

Default: 2 minutes

Input range: 1 to 500 minutes

Flush the IPv4/IPv6 neighbor cache whenever the host IP address on the network changes. As the

IP address is linked to a physical address, it can change but can still be associated with the physical address in the IPv4/IPv6 Neighbor Cache. Flushing the IPv4/IPv6 Neighbor Cache allows new information to be gathered and stored in the IPv4/IPv6 Neighbor Cache.

Log Possible Neighbor Poisoning Attempts

Enable to log the poisoning attempts.

Sophos XG Firewall | Configure | 155

Figure 122: Neighbor Configuration

Flushing Neighbor Table and Cache

The neighbors page displays a list of all the IP address-and-MAC address mappings and you can filter the list based on the IP address or the MAC address.

Select Static Neighbor Table or the required cache and click the Flush button to empty the cache or click Add to add a new entry.

Figure 123: Neighbors

Add Static Neighbor

The Add Static Neighbor page allows you to add an IPv4 or IPv6 neighbor.

1. Go to Configure > Network > Neighbors (ARP-NDP). In Show section select Static Neighbor Table and click

Add.

2. Specify the details.

IP Family

Sophos XG Firewall | Configure | 156

Select the IP Family for the static neighbor.

Available Options:

• IPv4

• IPv6

IPv4/IPv6 Address

Specify a IPv4/IPv6 address of the host outside the firewall.

MAC Address

Specify a MAC address of the host.

Interface

Select the physical interface on which the binding is to be done.

Add as a Trusted MAC Address to prevent a spoofing attempt

On enabling this option, the IP-MAC pair is added to the Trusted MAC list. If disabled, the IP-MAC pair will not be included in the Trusted MAC list.

By default, this option is enabled.

Figure 124: Static Neighbor

3. Click Save.

The static neighbor is created and appears in the Static Neighbor Table on the Neighbors (ARP-NDP) page.

Dynamic DNS

This section allows you to configure Dynamic DNS settings for your device.

Dynamic DNS (Domain Name Service) is a method of keeping a static domain/host name linked to a dynamically assigned IP address allowing your server to be more easily accessible from various locations on the Internet.

Powered by Dynamic Domain Name System (DDNS), you can access your device by the domain name, not the dynamic IP address. DDNS will tie a domain name (for example, mydevice.com, or mycompany.mydevice.com) to your dynamic IP address.

The device supports the following Dynamic DNS providers:

1. DynDNS

2. ZoneEdit

3. EasyDNS

4. DynAccess

5. Sophos

Sophos XG Firewall | Configure | 157

The page displays a list of all the configured DDNS, along with their names, interfaces, service providers, the last updated IP, status and time as well as the reason for failure. In addition it provides the option to add, update or delete a configuration.

Add Dynamic DNS

This page describes how to either add details of a third-party DDNS provider or to configure the device itself to act as a DDNS.

Dynamic DNS cannot be configured from Sophos Firewall Manager (SFM).

1. Go to Configure > Network > Dynamic DNS and click Add.

2. Specify the DDNS parameter details.

Note: For configuring a third-party service provider, you need a registered account with any of the supported Dynamic DNS service providers:

1. DynDNS

2. ZoneEdit

3. EasyDNS

4. DynAccess

5. Sophos

Hostname

Specify a name to identify the host that you want to use on the DDNS server. It is the domain name that you registered with your DDNS service provider, for example sophos.com.

In case you are configuring DynAccess as a service provider, provide the host name in the following format: <accountname>.dynaccess.com.

In case you are configuring Sophos as a service provider, provide the host name in the following format:

<host name>.myfirewall.co.

Note: You cannot add DDNS provider as <host>.ddns.cyberoam.com.

Interface

Select the external interface. The IP address of the selected interface will be bound to the specified hostname.

IPv4 Address

Select the IPv4 address source.

Available Options:

• Use Port IP: Select to use the IP address of the selected port or interface.

• NATed Public IP: Select to use the public IP address assigned to the selected port.

IP Edit Checking Interval

Specify the time interval after which the device should check and edit the IP address of your server, if changed.

Acceptable range: 4 - 60 minutes

Default: 20 minutes

For example, if the time interval is set to 10 minutes, after every 10 minutes, the device will check for any changes in your server IP address.

Configure

Network

Interfaces

Zones

WAN Link Manager

DNS

DHCP

IPv6 Router Advertisement

Cellular WAN

IP Tunnels

Neighbors (ARP-NDP)

Dynamic DNS

Пов''язані

Sophos XG Firewall User Guide

Swisscom Huawei Router B593s-22 Instructions

Sophos Endpoint Security Manual: AI Chat & PDF

Sophos XG Firewall v16.5 User Guide

Cyberoam Web Filter Policy Manual: AI Chat & PDF

Sophos XG Firewall XG v15.01.0 Administrator Guide

Sophos Email Appliance User Manual | AI Chat & PDF Access

Sophos Endpoint Security Guide: AI Chat & PDF Download

Kramer Panels User Manual + AI Chat & PDF Download

Kramer Panels User Manual: AI Chat & PDF Access

Vodafone Email Client User Manual: AI Chat & PDF Access

Sophos Group Level Web Interface Guide