System Services. Sophos v16.5
Διαφήμιση
Διαφήμιση
Sophos XG Firewall | Configure | 291
You can select V1 or V2 or both, V1 and V2. The selection overrides the version selected in the
Global Configuration settings.
The default setting is V2.
Receive
Select the RIP version to be used for receiving the routing updates.
You can select V1 or V2 or both, V1 and V2. The selection overrides the version selected in the
Global Configuration settings.
The default setting is V2 and V2.
Split Horizon
Enable to prevent the routing loops.
The default setting is disabled.
Poisoned Reverse (only applicable when Split Horizon is enabled)
Enable to prevent the device from sending packets through the route that has become invalid.
The default setting is disabled.
Authentication
Click to enable authentication of RIP packets.
If enabled, provide a password to authenticate the RIP packets.
Passive Mode
Enable to prevent the interface from sending RIP advertisements.
The default setting is disabled.
Figure 238: Override Interface Configuration
3. Click Save.
System Services
System Services allows configuration of device components along with the associated services.
Available configurations:
Sophos XG Firewall | Configure | 292
•
- High Availability allows a second system to be used for redundancy or scalability.
•
- QoS traffic shaping allows network bandwidth to be limited or guaranteed.
•
•
- Configure Syslog servers and enable/disable logs to be sent.
•
- Enable Data Anonymization and set Authorizers.
•
- Displays list of predefined and custom policies and provides option to create a new traffic
shaping policy.
•
- View the current status and manage all the configured services.
High Availability
Hardware failure such as a failure of the power supply, hard disk, or processor is the main reason behind the failure of a Internet security system and/or a device. To provide reliable and continuous connection to the Internet and to provide security services such as firewall, VPN, intrusion detection and prevention, virus scanning, web filtering, and spam filtering services, two devices can be configured to function as a single device and provide high availability.
Clustering technology is used to ensure high availability. In a cluster, devices are grouped together and instructed to work as a single entity.
Note: This feature is not available in models: CR15i, CR 15wi, CR25wi, CR35wi, CR15wiNG,
CR25wiNG/6P and CR35wiNG/6P and on all WiFi models of SG Series devices.
How a Cluster works
The device offers high availability by using virtual MAC address shared between a primary device and an auxiliary device linked together as a “cluster”.
Devices - primary and auxiliary device, are physically connected over a dedicated HA link port.
Typically, traffic enters your network by passing through a network switch. In an HA solution, one of the devices in the cluster has a virtual MAC address and traffic is forwarded to the cluster device which has the virtual MAC address. The device which has virtual MAC address is the primary device and the other peer is the auxiliary device.
Primary device acts as a load balancer and forwards the traffic to the auxiliary device for processing. Auxiliary device can process traffic only if cluster is operating in the Active-Active mode.
If configured in Active-Passive mode, the primary device processes the entire traffic. Auxiliary device waits in a ready mode to operate as primary device, in case the primary device or any of the monitored links fail.
Auxiliary device monitors the primary device through the dedicated HA link and if it does not receive any communication within the pre-configured time, the primary device is considered to have failed. In this case, the auxiliary device takes ownership of the virtual MAC address from the primary device, and becomes the primary device temporarily. Primary device automatically takes over from the auxiliary device once it starts functioning.
HA terminology
1. HA Cluster
Group of two devices instructed to work as a single entity. Every HA cluster has one primary device and one auxiliary device. The primary device controls how the cluster operates. The roles that the primary and auxiliary devices play in the cluster depend on the configuration mode.
2. HA Configuration Modes
Active-Active
A configuration of HA cluster consists of a primary
Device and an auxiliary device. In this mode, both primary device and auxiliary device process traffic while the primary unit is in charge of balancing the traffic. Decision of load balancing is taken by the primary device. The auxiliary device can take over only in case of a primary unit failure.
Sophos XG Firewall | Configure | 293
Active-Passive
A configuration of HA cluster which consists of a primary device and an auxiliary device. In this mode, only the primary device processes traffic while the auxiliary device remains in stand-by mode, ready to take over if a primary device failure occurs.
3. Primary Device
The primary device also tracks the status of all cluster devices. In an Active-Active cluster, the primary device receives the entire network traffic and acts as load balancer to redirect traffic to the auxiliary device. In an Active-
Passive cluster, the primary device processes the network traffic while the auxiliary device does not process any traffic but remains ready to take over if the primary device fails.
4. Auxiliary Device
Auxiliary device always waits to become the primary device.
In an Active-Active cluster, the auxiliary device processes the network traffic assigned to it by the primary device.
In case the primary device fails, the auxiliary device becomes the primary device. In an Active-Passive cluster, the auxiliary device does not process network traffic and is in stand-by. It becomes active only when the primary device is not available to process the traffic.
5. Dedicated HA Link Port
Dedicated HA link is a direct physical link between the devices participating in HA cluster.
6. Load Balancing
The ability of HA cluster of balancing the traffic between nodes in the HA cluster.
7. Monitored Interface
Set of interfaces that are selected to be monitored. Each device monitors its own selected interface(s) and if any of them goes down, the device removes itself from the cluster and a failover occurs.
8. Virtual MAC
It is a MAC address associated with the HA cluster. This address is sent in response when any of the machines make an ARP request to HA cluster. It is not the actual MAC address and is not assigned to any interface of any unit in the cluster.
The primary device owns the MAC address and is used for routing network traffic. All external clients use this address to communicate with the HA cluster. In case of failover, the new primary device will have the same MAC address as the failed primary device. The cluster device which has a virtual MAC address acts as a primary device.
9. Primary State
In Active-Active mode, the device that is in charge of receiving all the traffic and load balancing is said to be in
"primary" state. A device can be in "primary" state only when the other device is in "auxiliary" state.
In Active-Passive mode, the device in charge of processing all the traffic is said to be in the "primary" state. A device can be in "primary" state only when the other device is in "auxiliary" state.
10. Auxiliary State
In Active-Active mode, the device that receives the traffic to be processed by it from the primary device is called to be in "auxiliary" state. A device can be in "auxiliary" state only when the other device is in "primary" state
In Active-Passive mode, the device which is not processing the traffic is called to be in "auxiliary" state. A device can be in "auxiliary" state only when the other device is in "primary" state.
11. Standalone State
A device is called to be in standalone state when it can still process network traffic and when the other device is not in position to process network traffic (i.e. in "fault" state or shut down).
12. Fault State
A device is in fault state when it cannot process network traffic if a device or link fails.
13. Peer
Sophos XG Firewall | Configure | 294
Once the HA cluster is configured, cluster devices are termed as peers i.e. for the primary device, the auxiliary device is its peer device and vice versa.
14. Synchronization
The process of sharing the various cluster configuration, between cluster devices (HA peers). Reports generated are not synchronized.
15. Device failover
If an device does not receive any communication within the predetermined period of time from the HA peer, the peer device is considered to have failed. This process is termed as device failover as when this occurs, the peer device is taken over.
16. Link failover
Both the device in an HA cluster continuously monitor the dedicated HA link and the interfaces configured to be monitored. If any of them fails it is called link failure.
17. Session failover
Whether it is a device or link failover, session failover occurs for forwarded TCP traffic except for the virus scanned sessions that are in progress, VPN sessions, UDP, ICMP, multicast, and broadcast sessions and proxy traffic.
Device normally maintains session information for TCP traffic which is not passing through proxy service. Hence, in case of failover, the device which takes over will take care of all the sessions (TCP session not passing through proxy application). The entire process is transparent for the end users.
Configure HA
Points to be noted
• WWAN, WLAN - High Availability (HA) cluster cannot be configured if WWAN or WLAN is configured.
• DHCP, PPPoE - High Availability (HA) cluster cannot be configured in Active-Active mode if any of the interfaces are dynamically configured using DHCP or PPPoE protocols.
• You cannot configure interfaces using DHCP/PPPoE protocols when HA cluster is configured in Active-Active mode.
• Masqueraded Connections - In case of the manual synchronization events from any of the HA cluster devices, all the masqueraded connections will be dropped.
• HA can be disabled from either of the devices. If disabled from the primary device, HA will be disabled on both the devices. If disabled from the auxiliary device, HA will not be disabled on the primary device and will act as stand-alone device.
• After disabling HA, primary device IP schema will not change.
• After disabling HA, for the auxiliary device, all the ports except the dedicated HA link port and peer administration port will be disabled. The peer HA link IP will be the assigned IP address assigned to the dedicated
HA link port while the peer administration IP will be the assigned IP address assigned to the peer administration port.
• If HA is disabled from a stand-alone machine, IP schema will not change.
• Super Administrator privileges are required to access the auxiliary device Admin console and therefore it can be accessed by “admin” user only and Live users/DHCP leases/IPsec live connections pages will not be displayed.
• After disabling HA, for the auxiliary device, for LAN zone all the administrative service – HTTPS, Telnet, SSH are allowed while for DMZ zone only HTTPS and SSH are allowed.
• For the auxiliary device, Deployment Wizard will not be accessible.
• Dedicated HA link port should be from any of the DMZ zone interface only. Make sure that the IP address of the
HA link port of primary and auxiliary devices are in the same subnet.
• After enabling HA if backup without HA configuration is restored then HA will be disabled and the primary device will be accessible as per the backup configuration while auxiliary device will be accessible with the
Auxiliary Admin IP Address.
• In Active-Active mode, mails will be quarantined separately on both the devices as SMTP proxy traffic is load balanced in round robin manner.
Sophos XG Firewall | Configure | 295
• In Active-Passive mode, mails will be quarantined on the primary device only.
• If quarantine digest is configured, both the devices in the cluster will send quarantine digests.
• Administrator can release quarantined mails of all the users from both the devices.
• User can release quarantined mails from the User Portal. The User Portal displays mails quarantined only on the primary device. Also, the user can release them from the quarantine digest mailed from the primary device.
Note:
• Not available in models CR15i, CR15wi, CR25wi, CR35wi, CR15wiNG, CR25wiNG/6P, CR25wiNG/6P and on all WiFi models of SG series devices.
• HA will get disabled if you run the Deployment Wizard.
• You must register the device to configure HA.
Session failover
• Session failover is possible for Forwarded TCP traffic under Route Mode, Bridge Mode, Mixed Mode and
Multiport Bridge Mode.
• Session Failover is not possible for the following types of traffic under Route Mode, Bridge Mode, Mixed Mode and Multiport Bridge Mode:
• Proxy Subsystem (Transparent/Direct/Parent proxy)
• VPN Traffic
• IPv4 and IPv6 forwarded traffic like UDP, ICMP, multicast, broadcast etc.
• System generated traffic
• AV Scanned sessions
• Parent proxy traffic
Load Balancing
• Active-Active HA Cluster will successfully balance the load of following types of traffic under Route Mode,
Bridge Mode, Mixed Mode and Multiport Bridge Mode:
• TCP traffic passing through the proxy subsystem (Transparent/Direct/Parent)
• Forwarded TCP Traffic
• NATed (SNAT and Virtual Host) forwarded TCP traffic
• HTTPS connection
• VLAN traffic
• Active-Active HA Cluster does not load balance the following types of traffic under Route Mode, Bridge Mode,
Mixed Mode and Multiport Bridge Mode:
• VPN sessions
• Traffic other than TCP (UDP, ICMP, multicast, broadcast etc.)
• System generated traffic
• Scanned FTP Traffic
• Traffic coming through wireless RED devices and Access Points.
• TCP Traffic for User Portal, Admin Console or Telnet Console
• H323 Traffic sessions
• Control traffic for all modules
Before configuring HA
Before attempting to configure two devices as an HA pair for Hardware failover, check the following requirements:
• Both devices in the HA cluster i.e. primary and auxiliary device must be registered and have the same number of interfaces. Both member devices should be of the same model.
• Both devices in the HA cluster must have the same firmware version installed on it.
• Active-Active: Two separate licenses are required, one for the primary device and other for the auxiliary device.
On both the devices, the same subscription modules should be enabled.
• Active-Passive: One license is required for the primary device. No license is needed for the auxiliary device.
Sophos XG Firewall | Configure | 296
• Cables to all the monitored ports on both the devices must be connected. Connect dedicated HA link port of both the devices with crossover cable.
• Dedicated HA link port should be from the DMZ zone interface only and must have a unique IP address on both the devices. SSH should be enabled for both the devices on the DMZ zone.
• WWAN and WLAN configuration must be disabled before HA configuration.
• DHCP/PPPoE configuration must be disabled before configuring HA in Active-Active mode.
Before enabling HA
Before enabling HA, you need to provide the Passphrase and Dedicated HA Link Port details on the auxiliary device by selecting Auxiliary for Initial HA Device State. If the details are not configured on the auxiliary device then the primary device will not be able to connect to the auxiliary device.
Pocket Guides
•
Configure Active-Active Cluster
•
Configure Active-Passive Cluster
•
Disable HA
Configure Primary Device
1. Go to Configure > System Services > High Availability.
2. Enter High Availability details.
Serial Number
Displays serial number.
Peer Serial Number
Displays peer’s serial number.
For the primary device, it displays the auxiliary device's serial number.
For the auxiliary device, it displays the primary device's serial number.
HA Configuration Mode
Select HA configuration mode for the cluster.
Active-Active
Active-Passive
Select to configure a cluster for load balancing and failover HA. In Active-Active mode both, the primary device and the auxiliary device processes the traffic and monitors the status of the other cluster device. The primary device controls load balancing among both the cluster devices.
Select to configure a cluster for failover HA.
In Active-Passive mode the primary device processes all connections. The auxiliary device passively monitors the cluster status and remains synchronized with the primary device.
Initial HA Device State
Select to set initial device state from the available options.
Available Options:
Primary Auxiliary
Passphrase
Passphrase - Specify a passphrase for communication.
Confirm Passphrase - Confirm the specified passphrase.
Sophos XG Firewall | Configure | 297
Note: To configure HA, both devices in the cluster must have the same passphrase.
Dedicated HA Link Port
Specify HA link port.
HA peers are physically connected using a crossover cable through this port. The same port must also be used as an HA link port on the peer device.
For example, if port E is configured as HA link port on the primary device then use port E only as HA link port on the auxiliary device. Make sure that the IP address of the HA link port for both, the primary device and auxiliary devices are in same subnet. Cluster devices use this link to communicate cluster information and to synchronize with each other.
before attempting to configure two devices as an HA pair.
Peer HA link IPv4
Specify the IP address configured on the HA link port of the peer device.
Peer Administration Port
Specify an administration port for the auxiliary device. This port can be used for administration purpose.
Peer Administration IP
Specify an administration IPv4/IPv6 address for the auxiliary device.
With this IP address, the Admin console of the auxiliary device can be accessed. Any user accessing the Admin console of the auxiliary device will be logged -in with an HA profile and have read-only rights.
Select Ports to be Monitored
Select the ports to be monitored.
Both devices will monitor their own ports and if any of the monitored port goes down, the device will leave the cluster and failover will occur.
Note: This feature is not supported in virtual security devices.
Sophos XG Firewall | Configure | 298
Figure 239: Configure HA
3. Click Enable HA to enable HA.
Note: The device from which HA is enabled, acts as a Primary Device while the peer device acts as
Auxiliary Device.
If everything is cabled and configured properly and HA is enabled successfully:
• Both devices will have the same configuration except the HA link port IP address.
• Additional options will be made available:
Primary Device
• Put on Standby (for Active-Passive mode)
•
• Sync Auxiliary (used to synchronize auxiliary device and primary device configurations)
Auxiliary Device
•
• Sync with Primary (used to synchronize auxiliary device and primary device configurations)
• By default, both the devices will synchronize automatically.
• As soon as Active-Active is configured, traffic load balancing is enabled. If required, it can be disabled from CLI console using the “system ha load-balancing on/off” command.
Disable HA
This page allows you to disable HA.
Go to Configure > System Services > High Availability and click Disable HA.
Sophos XG Firewall | Configure | 299
Note:
• HA can be disabled from either of the devices. If disabled from the primary device, HA will be disabled on both the devices. If disabled from the auxiliary device, HA will not be disabled on the primary device and will act as stand-alone device.
• After disabling HA, the primary device IP schema will not change.
• If HA is disabled from a stand-alone machine, the IP schema will not change.
After disabling HA, the auxiliary device will reboot, all the ports except the dedicated HA link port and peer administration port will be disabled. The dedicated HA link port will be assigned to the peer HA link IP address and the peer administration port will be assigned to the peer administration IP address.
Switch Device to Standby Mode
Standby mode for the device can be configured only if the cluster is operating in Active-Passive mode. The auxiliary device takes over as primary device.
Synchronize HA Peers
Under normal conditions, the auxiliary device is always synchronized with the primary device. However, if required, the auxiliary device can also be forcefully synchronized with the primary device.
Manual synchronization process can be initiated from either of the peers. If synchronized from the primary device, the primary device will push updates and if synchronized from the auxiliary device, the auxiliary device will pull the updates from the primary device.
Go to Configure > System Services > High Availability and click Sync Auxiliary to manually synchronize the auxiliary device with the primary device.
The matrix illustrates the HA state transitions from which synchronization is possible between HA peers. For example, synchronization is possible when the device in Primary state goes in Fault state but not when it goes in
Auxiliary state.
From/To
Standalone
Primary
Auxiliary**
Fault
Standalone
No
Yes
Yes
No
Primary
Yes
No
No
No
Auxiliary**
Yes*
No
No
Yes
Fault
No
Yes
Yes
No
*Possible when dedicated link goes down and comes back again
**When device transits into Backup mode, it will soft boot
Manual synchronization gets the data and configuration updates except reports from the primary device.
Services Support
All the services except below listed services will not running on auxiliary device.
• Routing service
• VPN service
• Network service
• Logon server
Traffic Shaping Settings
This page allows you to configure default Traffic Shaping settings. All the bandwidth-related data are displayed only in KBps (1000 bytes per second).
The settings are as follows:
Total Available WAN Bandwidth
Sophos XG Firewall | Configure | 300
Specify maximum bandwidth limit in KBps. It is generally a sum of all WAN links' maximum limits.
Default: 100000 KBps
Acceptable Range (KBps): 1 to 2560000
Optimize for Real-Time (VoIP)
Enable to give priority to real-time traffic like VOIP over all other traffic.
If disabled, priority will be applicable only for excess bandwidth i.e. bandwidth remaining after guaranteed bandwidth allocation.
Enforce Guaranteed Bandwidth
The Administrator can enforce the handling of all internet-bound traffic by any Traffic Shaping
Policy applied to it. If there is no policy applied to the traffic, it will be handled by the Default
Policy.
Enable to enforce bandwidth restriction on the traffic to which the Traffic Shaping Policy is not applied.
Disable if you do not want to enforce bandwidth restriction on the traffic to which the Traffic
Shaping Policy is not applied. It will only handle traffic on which the Traffic Shaping Policy is applied.
Default Policy
The Default Policy will be applicable to the traffic which does not have any Traffic Shaping Policy applied.
Guarantee
Specify bandwidth which is the minimum guaranteed bandwidth that the user can use.
Default: 1 KBps
Acceptable Range (KBps): 1 to 2560000
Limit
Priority
Specify bandwidth which is the maximum bandwidth that the user can use, if available.
Default: 100000 KBps
Acceptable Range (KBps): 1 to 2560000
Set the bandwidth priority. Priority can be set from 1 (highest) to 7 (lowest) depending on the traffic required to be shaped.
Available Options:
1 – Business Critical2 to 5 – Normal6 – Bulky -
FTP7 – Best Effort – e.g. P2P
Show Bandwidth Usage
Click to view Bandwidth Usage.
Sophos XG Firewall | Configure | 301
Figure 240: Traffic Shaping Settings
Related information
How to setup application filter
RED
This page describes how to enable RED.
RED is short for Remote Ethernet Device and is a means to connect remote branch offices and the like to your main office as if the branch office is part of your local network.
The setup consists of the Sophos XG Firewall in your main office and a Remote Ethernet Device (RED) in your remote office. Establishing a connection between the two is utmost easy as the RED device itself does not need to be configured at all. As soon as the RED device is connected to your device it behaves like any other Ethernet device on your device. All traffic of your branch office is safely routed via your device which means that your branch office is as secure as your local network.
These types of RED devices are currently available:
• RED 10: RED solution for small remote offices
• RED 15: RED solution for medium remote offices
• RED 15w: RED solution for small remote offices, including WiFi.
• RED 50: RED solution for bigger remote offices which comes with two uplink interfaces.
Additionally, you have the choice to establish a RED Site-to-Site tunnel between two SF devices which are connected through the RED technology on Layer 2. One device acts as server while the other is the client. For more information,
Configure RED Site-to-Site Tunnel
.
Each RED device or SF device that is configured here is able to establish a connection to your SF device.
Note: For RED devices to be able to connect, you need to enable RED support on the Configure > System
Services > RED page first.
RED setup example
Related tasks
This page allows you to configure a Remote Ethernet Device (RED) at a remote office.
Configure RED
This page describes how to configure RED.
1. Go to Configure > System Services > RED and enable RED.
2. Specify the following:
Organization Name
Specify the name of the organization.
City
Specify the city where the organization is located.
Country
Select the country where the organization is located.
Specify an email address.
Sophos XG Firewall | Configure | 302
Figure 241: Enable RED
3. Click Apply.
Note: If the message "Registering with RED service failed. Please make sure that this device can connect to the Internet on port 3400" appears, some kind of network problem is indicated. You should first check if you can reach red.astaro.com through port 3400 (via console command telnet red.astaro.com 3400). If so, the error might be due to a high network load. Retry to connect later.
The RED status is now activated. Sophos XG Firewall is now registered at the RED Provisioning Service (RPS) of
Sophos to act as a RED hub. You can now continue by adding one or more RED devices at System > Network >
Interfaces.
You can enable the Automatic Device Deauthorization.
Related tasks
This page allows you to configure a Remote Ethernet Device (RED) at a remote office.
Force TLS 1.2
This page describes how to force TLS 1.2.
For security reasons it is recommended to force the RED device to use only TLS 1.2. This option is disabled by default to ensure that new RED devices can connect to the Firewall and first have a firmware updgrade to support
TLS 1.2.
Note: If you want to add new RED devices, first disable TLS to ensure that the RED devices are able to connect to the Firewall.
1. Ensure that RED is enabled.
2. In the Force TLS 1.2 area select Enable.
3. Click Apply.
Automatic Device Deauthorization
This page describes how to deauthorize a RED device.
Sophos XG Firewall | Configure | 303
When RED is enabled, you can specify if disconnected RED devices should automatically be deauthorized after a certain time span. With this feature, you can prevent stolen RED devices from connecting to Sophos XG Firewall.
Note: The Automatic Device Deauthorization does not work for a RED tunnel between 2 Sophos XG
Firewall devices.
1. Ensure that RED is activated.
2. Select Enable next to Automatic Device Deauthorization.
3. Enter a time span for Deauthorize After.
4. Click Apply.
Automatic Device Deauthorization will now be successfully configured.
When a RED device reconnects after being disconnected for a time span longer than the defined time span, it will automatically be disabled.
Disable RED
This page describes how to disable RED.
Disabling RED will not cause the deletion of the REDs. If you disable the RED functionality, RED devices will be deactivated and lose their connection. If you re-enable the RED functionality, the REDs will be activated again.
1. Click the toggle switch of the RED Status.
2. Confirm deactivation by clicking on the Confirm removal of RED configuration button.
RED is now deactivated. All RED devices will be disconnected.
Log Settings
Device provides extensive logging capabilities for traffic, system and network protection functions. Detailed log information and reports provide historical as well as current analysis of network activity to help identify security issues and reduce network abuse. To view logs, relevant modules must be subscribed.
Device can log many different network activities and traffic including:
• Firewall Rules log
• Anti Virus infection and blocking
• Web filtering, URL and HTTP content blocking
• Signature and anomaly attack and prevention
• Spam filtering
• Administrator logs
• User Authentication logs
• SSL VPN logs
• Web Server Protection logs
• Advanced Threat Protection logs
• Heartbeat logs
Device can either store logs locally or send logs to external syslog servers for storage and archival purposes. Traffic
Discovery logs can be stored locally only.
Syslog is an industry standard protocol/method for collecting and forwarding Logs from devices to a server running a syslog daemon usually via UDP Port 514. Logging to a central syslog server helps in aggregation of logs and alerts.
If configured, device sends a detailed log to an external syslog server in addition to the standard event log. Device
Syslog support requires an external server running a syslog daemon on any of the UDP Port. When configuring logging to a syslog server, one needs to configure the facility, severity and log file format. One can also specify logging location if multiple syslog servers are defined.
Device logs all activity and includes every connection source and destination IP Address (IPv4 / IPv6), IP service, and number of bytes transferred.
Sophos XG Firewall | Configure | 304
A Syslog service simply accepts messages, and store them in files or prints. This form of logging is the best as it provides a central logging facility and a protected long-term storage for logs. This is useful both in routine troubleshooting and in incident handling.
Use this page to configure below settings:
• Syslog Servers - Configure Syslog server for logs storage and archival purposes.
• Log Settings - Configure logs to be sent to the Syslog server.
Syslog Servers
The Syslog Servers section displays list of configured syslog servers. You can sort the list based on server name. The page also provides option to add, update, or delete the server.
Log Settings
After configuring syslog server, configure logs to be sent to the syslog server by selecting checkbox against the log under Syslog. If multiple syslog servers are configured, you can send various logs on different servers.
To record logs you must enable the respective log and specify logging location. Administrator can choose between
On-Device (local) logging or Syslog logging. Administrator can also disable logging temporarily. Below are the different log types with their description:
Firewall
Firewall Log records following events:
• Firewall Rules
Log records the entire traffic for Firewall.
• Invalid Traffic
Log records the dropped traffic that does not follow the protocol standards, invalid fragmented traffic and the traffic whose packets or device is not able to relate to any connection.
• Local ACLs
Log records the entire (allowed and dropped) incoming traffic.
• DoS Attack
The DoS Attack Log records attacks detected and prevented by the device i.e. dropped TCP, UDP and ICMP packets.
To generate logs, go to System > System Services > DoS & Spoof Protection and click Apply Flag against SYN
Flood, UDP Flood, TCP Flood, and ICMP/ICMPv6 Flood individually.
• Dropped ICMP Redirected Packet
Log records all the dropped ICMP redirect packets.
To generate log, go to System > System Services > DoS & Spoof Protection and click Apply Flag against
Disable ICMP/ICMPv6 Redirect Packet.
• Dropped Source Routed Packet
Log records all the dropped source routed packets.
To generate log, go to System > System Services > DoS & Spoof Protection and click Apply Flag against Drop
Source Routed Packets.
• Dropped Fragmented Traffic
Log records the dropped fragmented traffic.
• MAC Filtering
Log records the dropped packets when filtering is enabled from Spoof prevention.
• IP-MAC Pair Filtering
Sophos XG Firewall | Configure | 305
Log records the dropped packets when filtering is enabled from Spoof prevention.
• IP Spoof Prevention
Log records the dropped packets when filtering is enabled from Spoof prevention.
• SSL VPN Tunnel
Log records of SSL VPN traffic.
• Protected Application Server
Log records of protected application server traffic.
• Heartbeat
Log records of Heartbeat traffic.
• ICMP Error Message
Log records of ICMP error messages such as network/host/port unreachable, destination network/host unknown and so on.
Figure 242: Firewall Rule
IPS
Records detected and dropped attacks based on unknown or suspicious patterns (anomaly) and signatures.
Figure 243: IPS
Anti Virus
Virus detected in HTTP, SMTP, FTP, POP3, IMAP4, HTTPS, SMTPS, IMAPS and POPS traffic.
Sophos XG Firewall | Configure | 306
Figure 244: Anti-Virus
Anti Spam
SMTP, POP3, IMAP4, SMTPS, POPS, IMAPS spam and probable spam mails.
Figure 245: Anti-Spam
Content Filtering
Web filtering and Application Filtering logs.
Log records of the name of applications/URLs accessed and their categories.
Note:
To view the logs:
• Web Filter and Application Filter Policies should be applied in Firewall Rule.
• Log Firewall Traffic under Firewall page should be enabled.
Figure 246: Content Filtering
Events
Admin Events: Log records of configurations done through Admin Console.
Authentication Events: Log records of all authentication related events.
System Events: Log records of all system related events like Gateway Up/Down, Anti Virus updates etc.
Sophos XG Firewall | Configure | 307
Figure 247: Events
Web Server Protection
Web Server Protection Events.
Note: Web Server Protection logs are not available in CR10iNG, CR15i, CR15wi, CR15iNG, CR15wiNG,
CR25ia, CR25wi, CR35ia and CR35wi Sophos Devices.
Figure 248: Web Server Protection
Advanced Threat Protection
ATP Events: Log records of drop or alert event.
Figure 249: Advanced Threat Protection
Wireless
Access Points & SSID: Log records of the connected APs and SSID.
Figure 250: Wireless
Heartbeat
Endpoint Status: Log records of the health status of the endpoint.
Figure 251: Heartbeat
System Health
Usage: Log records of CPU usage, memory usage, no. of live users, interface and disk partition information.
Figure 252: System Health
Sandstorm
Sandstorm Event: Log records of all Sandstorm events.
Figure 253: Sandstorm
Add Syslog Server
This page describes how to add a syslog server.
Sophos XG Firewall | Configure | 308
1. Go to Configure > System Services > Log Settingsand click Add under the Syslog Servers section.
2. Enter server details.
Name
Enter a unique name for the syslog server.
IP Address / Domain
Specify the IP address (IPv4 / IPv6) or domain name of the syslog server. Logs from the device will be sent to the server.
Port
Specify the port number for communication with the syslog server. The device will send logs using the configured port.
Facility
Select syslog facility for logs to be sent to the syslog server.
Facility indicates to the syslog server the source of a log such as operating system, the process or an application. It is defined by the syslog protocol.
The device supports several syslog facilities for received log.
Available Options:DAEMON
Daemon logs (information of services running in device as daemon).
KERNEL
Kernel log
LOCAL0 - LOCAL7
Log level information.
USER
Logging based on users who are connected to the server.
Severity Level
Specify severity levels of logs.
Severity level is the severity of the log that has been generated.
The device logs all the messages at and above the logging severity level you select. For example, select ERROR to log all messages tagged as ERROR, as well as any messages tagged with
CRITICAL, ALERT and EMERGENCY and select DEBUG to log all messages.
The device supports following severity levels:EMERGENCY - System is not usableALERT
- Action must be taken immediatelyCRITCAL - Critical conditionERROR - Error conditionWARNING - Warning conditionNOTIFICATION - Normal but significant conditionINFORMATION - InformationalDEBUG - Debug level messages.
Format
The device produces logs in the specified format. The device currently produces logs in device standard format.
Sophos XG Firewall | Configure | 309
Figure 254: Add Syslog Server
Note: You can configure maximum five syslog servers.
3. Click Save.
Once you add the server, go to the System > System Services > Log Settings page and enable all those logs, which are to be sent to the syslog server in the section Log Settings.
Data Anonymization
This page allows you to enable/disable data anonymization and select authorizer administrators, also to de-anonymize all the user identities - Username, IP Address, MAC Address and Email Address in all logs /activities / reports.
View the report from Configure > System Services > Data Anonymization.
Once Data Anonymization is enabled, the Device anonymizes all the user identities. It means user identities in all the logs and reports are displayed in encrypted form.
To view the actual details, IT Administrator has to de-anonymize the same. To de-anonymize, approval from one of the authorizers configured on the Configure > System Services > Data Anonymization page is required.
Data Anonymization Setting
Enable data anonymization for the IT administrator to view or download user-specific activities, logs or reports. Apart from the IT administrator, at least one independent authorizer with the administrative privileges is required.
Once enabled:
1. All the user identities - username, IP address (IPv4 / IPv6), MAC address and email address in all logs /activities / reports are anonymized.
2. If an IT administrator wants to de-anonymize above mentioned user details, approval is required from at least one of the Authorizers.
3. Similarly, to disable data anonymization, approval from at least one of the Authorizers is required.
Note: To enable/disable data anonymization if you are logged in as one of the Authorizers, approval from at least one of the other Authorizers is required.
This section provides the following options:
Enable Data Anonymization
Click to enable Data Anonymization.
Select Authorizer
• Administrator List displays all the administrators.
Sophos XG Firewall | Configure | 310
• Click the check-box given under Select Authorizer menu to select the administrator. All the selected administrators are displayed under Selected Authorizer list.
Exceptions
This section allows to de-anonymize all the user identities - Username, IP Address, MAC Address and Email Address in all logs /activities / reports.
Depending on whether you want to de-anonymize the user identities in all logs /activities / reports or in particular log /activity / report, there are two ways to de-anonymize the user identities:
• From Data Anonymization page
• From Log Viewer page or Reports module
Follow the steps below to de-anonymize all the user identities - Username, IP Address, MAC Address and Email
Address in all logs /activities / reports:
1. Select Username(s) to be de-anonymized from user(s) listed under the User parameter.
2. Specify IP Address(s) (IPv4 / IPv6) to be de-anonymized.
3. If required, specify MAC Address(s) and Email Address(s) to be de-anonymized from Advanced Settings section.
4. Click Apply. An Authorization Window shall pop-up. Given below are the parameters and their description:
a. User Name: Select the Authorizer configured from Configure > System Services > Data Anonymization page.
b. Password: Specify password for the selected Authorizer and click OK.
5. Once approved, user identities in all logs and reports are decrypted and displayed with the actual user details.
Sophos XG Firewall | Configure | 311
Figure 255: Exceptions
From Log Viewer page or Reports module
Follow the steps below to de-anonymize a particular user identity in a particular log /activity / report:
1. To access the Log Viewer page, go to
. Else, you can view a report containing anonymized (encrypted) user identities from the Reports module.
2. Click the icon against an anonymized (encrypted) string. A new window titled De-Anonymize shall pop up.
Given below are the parameters and their description:
a. Anonymized String: Displayed the encrypted string. This is the string you want to decrypt.
b. De-Anonymized String: Displays the decrypted user identity i.e. actual user identity detail.
Note: This field is displayed blank until you specify password for the selected Authorised Username and click OK. Once approved, user identity in the log / report is decrypted and displayed with the actual user detail.
c. Authorised Username: Displays the Authorizer list configured from Configure > System Services > Data
Anonymization page. Select the desired Authorizer from the drop-down list.
Sophos XG Firewall | Configure | 312
Note: If you are logged in as one of the Authorizers, the drop-down list does not display your
Username. Else, all the Authorizers are displayed.
d. Password: Specify password for the selected Authorizer.
e. De-Anonymize: Select the desired option:
• For this Search: Select to de-anonymize the user identity from the anonymized (encrypted) string selected in step 2, for this particular search only.
• Session: Select to de-anonymize the user identity from the anonymized (encrypted) string selected in step
2, until you log out of the Admin Console.
• Permanently: Select to permanently de-anonymize the user identity from the anonymized (encrypted) string selected in step 2.
Note: This is similar to the first method i.e. De-Anonymizing the user identities from the De-
Anonymize page, where all the user identities in all logs and reports are decrypted and displayed with the actual user details.
f. Type: The drop-down list displays the type of user identity. Possible options are:
• Username
• IP Address
• MAC Address
• Email Address
Note: By default, it displays the user identity associated with the anonymized (encrypted) string, selected in step 2. For example, if the anonymized string is a Host, the type would be displayed as
IP Address.
3. Click Save. The De-Anonymized String should now display the decrypted user identity i.e. actual user identity detail.
4. Click Cancel to close the De-Anonymize window. Now the selected log / report should display the decrypted user identity in place of the Anonymized String.
Traffic Shaping
The Traffic Shaping tab displays a list of predefined and custom policies and provides the option to create a new traffic shaping policy, schedule traffic shaping policies, update parameters or delete policies.
You can also clone a policy. Select an existing policy and click the icon to create a copy of the selected policy.
You can edit the cloned policy as per your requirements.
Create New Traffic Shaping Policy
This page describes how to quickly configure a new traffic shaping policy. All the bandwidth-related data are displayed only in KBps (1000 bytes per second).
1. Go to System > Profiles > Traffic Shaping and click Add.
2. Specify the Traffic Shaping Policy details.
Name
Specify a unique name for the Policy.
Policy Association
Select an option to specify for whom the policy is to be created.
Available Options:Users: Restricts the bandwidth for a particular user or for a user group.Rules:
Restricts the bandwidth of any entry to which the firewall rule is applied.Web Categories: Restricts the bandwidth for the URL categorized under the web categories.Applications: Restricts the bandwidth for the applications categorized under the application categories.
Rule Type
Select the type of policy.
Sophos XG Firewall | Configure | 313
Available Options:Limit: In this type of policy, the user cannot exceed the defined bandwidth limit.Guarantee: In this type of policy, the user is allocated the guaranteed amount of bandwidth and can draw the bandwidth up to the defined Limit, if available.
It enables to assign fixed minimum and maximum amounts of bandwidth to the users. By borrowing excess bandwidth when available, users are able to burst above guaranteed minimum limits, up to the defined Limit. Guaranteed rates also assure minimum bandwidth to critical users to receive constant levels of bandwidth during peak and non-peak traffic periods.
Guarantee represents the minimum guaranteed bandwidth and Limit represents the maximum bandwidth that the user can use, if available.
Limit Upload/Download Separately
Select from the available options.
Available Options:
Disable: Limits total (upload + download) bandwidth.
Enable: Limits upload and download bandwidth separately.
Priority
Set the bandwidth priority. Priority can be set from 0 (highest) to 7 (lowest) depending on the traffic required to be shaped.
0 - Real Time for example, VOIP 1 - Business Critical 2 to 5 - Normal 6 - Bulky - FTP 7 - Best
Effort for Example, P2P
By default, priority is given to the real time traffic.
Note: However, if the administrator does not want this preference, the feature can be disabled from Configure > System Services > Traffic Shaping Settings page.
If Optimize for Real-Time (VoIP), under Configure > System Services > Traffic Shaping
Settings page is disabled the priority will be applicable only for excess bandwidth i.e. bandwidth remaining after guaranteed bandwidth allocation.
If Optimize for Real-Time (VoIP), under Configure > System Services > Traffic Shaping
Settings page is enabled the real-time traffic (Traffic Shaping policy with priority 0) like VOIP will be given precedence over all other traffic.
As priority is given to the real time traffic, it is possible that some non real-time traffic will not get their minimum guaranteed bandwidth. Specifically, if sum of Limit (max allowed) of all Traffic
Shaping policies (real-time and non real-time) is greater than total max-limit then guaranteed bandwidth of the real-time policies will be fulfilled but non real-time might not get the minimum guaranteed bandwidth.
Limit (in KBps) (only if Rule Type is Limit and Limit Upload/Download Separately is disabled)
Specify the allowed total bandwidth.
Total bandwidth range: 2 – 2560000 KBps
Limit bandwidth should be greater than or equal to guaranteed bandwidth.
Upload Bandwidth (in KBps) (only if Rule Type is Limit and Limit Upload/Download Separately is
enabled)
Specify the upload bandwidth.
Total bandwidth range: 2 – 2560000 KBps
Download Bandwidth (in KBps) (only if Rule Type is Limit and Limit Upload/Download Separately is
enabled)
Specify the download bandwidth.
Total bandwidth range: 2 - 2560000 KBps
Sophos XG Firewall | Configure | 314
Guarantee - Limit (in KBps) (only if Rule Type is Guarantee and Limit Upload/Download Separately is
disabled)
Specify the range for guaranteed bandwidth limit.
Total bandwidth range: 2 – 2560000 KBps
Guarantee - Limit Upload (in KBps) (only if Rule Type is Guarantee and Limit Upload/Download
Separately is enabled)
Specify the range for guaranteed upload bandwidth.
Total bandwidth range: 2 – 2560000 KBps
Guarantee - Limit Download (in KBps) (only if Rule Type is Guarantee and Limit Upload/Download
Separately is enabled)
Specify the range for guaranteed download bandwidth.
Total bandwidth range: 2 - 2560000 KBps
Bandwidth Usage Type
Select the type of bandwidth usage.
Available Options:Individual: Allocated bandwidth is for the particular User/Rule/Web Category/
Application only.Shared: Allocated bandwidth is shared among all the Users/Rules/Web
Categories/Applications who have been assigned this policy.
Description
Specify a description for the policy.
Figure 256: Add Traffic Shaping (QoS) Policy
3. Click Add under Add Schedule wise Traffic Shaping Policy Details to override default Traffic Shaping
Policy Details to Add Schedule wise Traffic Shaping Policy Details to override default Traffic Shaping Policy
Details. Refer
Schedule Traffic Shaping Policy
for details.
4. Click Save.
Schedule Traffic Shaping Policy
This page describes how to schedule a traffic shaping policy. All the bandwidth-related data are displayed only in
KBps (1000 bytes per second).
Sophos XG Firewall | Configure | 315
The page allows you to add a schedule-wise traffic shaping policy to override default traffic shaping policy details.
1. Go to System > Profiles > Traffic Shaping.
2.
Click on the icon of the requested policy.
3. Click Add.
4. Specify the Traffic Shaping Policy details.
Name
Displays the policy name.
Rule Type
Displays the default policy type set at the time of creation of policy. Modify if required.
Note: The configured policy type will override the default policy and will be applicable only for the selected scheduled time interval.
Limit Upload/Download Separately
Displays the default implementation strategy set at the time of creation of the policy. Modify if required.
Note: The configured policy type will override the default policy and will be applicable only for the selected scheduled time interval.
Limit (in KBps) (only if Rule Type is Limit and Limit Upload/Download Separately is disabled)
Displays the allocated total bandwidth. Modify if required.
Note: The modified bandwidth restriction is applicable only for the selected time interval.
Upload Bandwidth (in KBps) (pnly if Rule Type is Limit and Limit Upload/Download Separately is
enabled)
Displays the allocated individual upload bandwidth. Modify if required.
Note: The modified bandwidth restriction is applicable only for the selected time interval.
Download Bandwidth (in KBps) (only if Rule Type is Limit and Limit Upload/Download Separately is
enabled)
Displays the allocated individual download bandwidth. Modify if required.
Note: The modified bandwidth restriction is applicable only for the selected time interval.
Guarantee - Limit (in KBps) (only if Rule Type is Guarantee and Limit Upload/Download Separately is
disabled)
Displays the range for the total guaranteed bandwidth. Modify if required.
Total bandwidth range: 2 – 2560000 KBps
Guarantee - (only if Rule Type is Guarantee and Limit Upload/Download Separately is enabled)
Displays the range for the guaranteed upload bandwidth. Modify if required.
Total bandwidth range: 2 – 2560000 KBps
Guarantee - Limit Download (in KBps) (only if Rule Type is Guarantee and Limit Upload/Download
Separately is enabled)
Displays the range for the guaranteed download bandwidth. Modify if required.
Total bandwidth range: 2 - 2560000 KBps
Schedule
Select a schedule from the available list during which the traffic shaping policy will be applied.
Only recurring schedule can be applied.
If you are not sure about the schedule details, check
to view the details.
Sophos XG Firewall | Configure | 316
Figure 257: Add Traffic Shaping (QoS) Policy Detail
5. Click Save.
Services
Services page allows you to view and manage the status of configured services.
You can view the current status and manage all the configured services:
• Anti-Spam
• Anti-Spam Center Connectivity
• Anti-Virus
• Authentication
• DNS Server
• IPS
• Web Proxy
• WAF
• DHCP Server
• DHCPv6 Server
• Router Advertisement Service
• Hotspot
Parameters
Services
Name of the configured service.
Status
Current status of the service.
Manage
Click to start or stop or restart the respective service.
Actions
Start
Start the service whose status is Stopped.
Stop Button
Stop the service whose status is Running.
Restart Button
Restart service: Only for authentication service and web proxy service.
Sophos XG Firewall | Configure | 317
Status
No Web Server configured
Indicates that no web server is configured.
Note: The Start button is disabled in this case.
Connected
Displayed when Internet connectivity is available for the gateway.
Running
Indicates that service has successfully started.
Disconnected
Displayed when Internet connectivity is unavailable for the gateway.
Stopped
Displayed when a service is stopped or when the respective subscription module is not subscribed.
Figure 258: Services
Related concepts
on page 168
This page allows you to configure authentication for firewall, VPN and admin traffic.
on page 388
This page displays the list of all the pre-defined and custom IPS policies.
The Authentication Policies menu allows you to configure policies for direct authentication.
The Hotspots menu allows you to enable the Hotspots feature and define users who are allowed to view and distribute hotspot access information.
Λήψη
Δημόσιος σύνδεσμος ενημερώθηκε
Ο δημόσιος σύνδεσμος για τη συνομιλία σας ενημερώθηκε. You may view and manage your chat links after registration here.
Δημόσιος σύνδεσμος εγγράφου
Διαφήμιση
