Firewall. Sophos v16.5
Advertisement
Advertisement
Sophos XG Firewall | Protect | 318
Protect
Firewall
Firewall rules are security rule-sets to implement control over users, applications or network objects in an organization. Using the firewall rule, you can create blanket or specialized traffic transit rules based on the requirement. This page provides centralized management for the entire set of device firewall rules. Sophos XG
Firewall implements a single pane of management to secure all enterprise applications using configuration templates for various rule types.
Following sections provide more information on the Firewall section.
•
•
•
•
•
Understanding List of Firewall Rules
Introduction
Firewall rules are based on the following configurable templates:
1.
2.
Managing Firewall Rules
You can see the entire list of added firewall rules from the Firewall page. Using the same page, you can update existing firewall rules or add new firewall rules. To change the processing order, you can re-order firewall rules by drag and drop action.
Note: All custom firewall rules can be re-ordered. The order of processing is top to bottom.
On the Firewall page, the following action buttons can be found.
• IPv4: Select to filter only IPv4 rules
• IPv6: Select to filter only IPv6 rules
• Enable Filter: Select to open filter view and apply the following filters for IPv4 or IPv6 rules:
1. Rule Type - Select to filter rules based on Business, User or Network
2. Source Zone - Select to filter rules based on LAN, WAN, DMZ, LOCAL, VPN or WiFi
3. Destination Zone - Select to filter rules based on LAN, WAN, DMZ, LOCAL, VPN or WiFi
4. State - Select to filter rules based on Unused, Disabled, Changed, New
5. Rule ID - Specify Rule ID to see the specific rule.
• Reset Filter (Available if filter is enabled) - Select to reset all filters
• Disable Filter (Available if filter is enabled) - Select to close filter view
• + Add Firewall Rule - Select to add a new rule among Business Application Rule, or User/Network Rule.
Default Firewall Rules
At the time of deployment, Network Configuration Wizard provides option to enable User/Network Rule for LAN to WAN traffic and automatically creates default firewall rule Default_Network_Policy. You can apply Web filter,
App filter and IPS policy through this default policy from the Wizard itself or from Web Admin console whenever required.
Sophos XG Firewall | Protect | 319
Understanding Icons
There are various action icons as well as symbolic icons on the Firewall page. Meanings and associated actions of all icons are shown below.
Icons
Icons in Collapsed view
Meaning
Business Application Rule
User Rule
Network Rule
Rule ID
Traffic Shaping
Schedule
IPS
Security Heartbeat inactive
Security Heartbeat Red required. No restriction on endpoints.
Firewall Rule enabled. Click to disable the rule.
Firewall Rule disabled. Click to enable the rule.
Expand the rule for more information
Icons in Expanded view
Rule ID
Edit rule
Delete rule (not applicable for default rules)
Insert a new rule above
Insert a new rule below
Move rule. To move the rule, click the icon and drag-and-drop at the required position (not applicable for default rules).
Sophos XG Firewall | Protect | 320
Icons Meaning
Collapse rule
Understanding the List of Firewall Rules
All added rules are available in the form of a list. Each rule in the list presents a quick snapshot of the rule. To view rule details, click to expand the view. Which items are available in the collapsed or expanded view is shown below.
Items in collapsed view:
• Rule Name: name of the rule
• In/Out: amount of traffic (in bytes) coming in or going out using the particular rule
• Firewall Rule features: status of Schedule, heartbeat, IPS and traffic shaping
• Source: source zone
• Destination: destination zone
• What: shows protected domains/services
• Action: status of protected servers, status of web and application protection for user
Additional items in expanded view:
• ID: rule ID
• User's Policy Applied: status of application filter, web policy, AV and AS scanning, NAT policy and route through gateway, if configured
• Firewall Rule Summary: summary of the added rule
While configuring any Firewall Rule, hover mouse over the following objects to see additonal details of it:
• Source/Destination Zones
• Schedule
• Services
• Source/Destination Networks
• Hosted Address
• Allowed/Blocked Client Networks
• Protected Server(s)
• Protected Zone
User / Network Rule
User/Network Rule is used to define access rights and protection to the network objects/hosts. In a nutshell, if you want to control traffic by source, service, destination, zone, then use a Network Rule. Additionally, the administrator has the option to attach user identity to a rule in order to customize access of assorted hosts/servers. Such an identity based rule is considered a User Rule.
You can view or add a User/Network Rule for IPv4 and IPv6 traffic.
1.
Add User / Network Rule (IPv4)
2.
Add User / Network Rule (IPv6)
Add User/Network Rule (IPv4)
This page allows you to create firewall rules to control traffic that uses the IPv4 protocol. The firewall rules control traffic between internal and external networks and protect the network from unauthorized access. The device determines the rule to be applied based on the source and destination zone you configure in the firewall rule. Use this page to create identity-based firewall rules by applying them to users.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and User/Network Rule.
Sophos XG Firewall | Protect | 321
3. Enter the rule introduction details.
Rule Name
Enter a name for the rule.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule from the available options.
Available Options:
Top Bottom
Action
Specify an action for the rule traffic from the available options. Accept – Allow accessDrop –
Silently discardReject – Deny access (“ICMP port unreachable” message is sent to the source)
When sending a response it might be possible that the response is sent using a different interface than the one on which the request was received. This may happen depending on the routing configuration done on the device.
For example: If the request is received on the LAN port using a spoofed IP address (public IP address or the IP address not in the LAN zone network) and no specific route is defined, the device will send a response to these hosts using the default route. Hence, the response will be sent through the WAN port.
Figure 259: About This Rule
4. Enter the Source details.
Source Zones
Select the source zones allowed to the user.
A new zone can be created directly from this page itself or from Configure > Network > Zones page.
Source Networks and Devices
Select the source networks/devices allowed to the user.
A new network host can be created directly from this page itself or from System > Hosts and
Services.
During Scheduled Time
Select the schedule allowed to the user.
A new schedule can be created directly from this page itself or from the System > Profiles >
Schedule page.
Figure 260: Source
5. Enter the Destination and Services details.
Sophos XG Firewall | Protect | 322
Destination Zones
Select the destination zones allowed to the user.
Destination Networks
Select the destination networks allowed to the user.
A new network host can be created directly from this page itself or from System > Hosts and
Services.
Services
Select the services allowed to the user.
A new service can be created directly from this page itself or from the System > Hosts and
Services > Services page.
Figure 261: Destination
6. Enter Identity details. Follow this step if you want to configure a User Rule.
Match known users
Select to enable a rule based on the user identity.
Show captive portal to unknown users (only available if Match known users is selected)
Select the check box to accept traffic from unknown users. Captive portal page is displayed to the user where the user can login to access the Internet.
Clear the check box to drop traffic from unknown users.
User or Groups.(only available if Match known users is selected)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting. (only available if Match known users is selected)
Select to exclude user traffic activity from data accounting. In other words, the traffic allowed through this rule will not be accounted towards data transfer for the user.
By default, user’s network traffic is considered in data accounting.
Figure 262: Identity
7. Enter Malware Scanning details (available only if Action selected for the traffic is Accept).
Scan HTTP
Enable HTTP traffic scanning.
Decrypt & Scan HTTPS
Enable HTTPS traffic decryption and scanning.
Sophos XG Firewall | Protect | 323
Detect zero-day threats with Sandstorm
Send files downloaded using HTTP or HTTPS for analysis by Sandstorm. Sandstorm protects your network against unknown and unpublished threats (“zero-day” threats).
Scan FTP
Enable FTP traffic scanning.
8. Enter Advanced settings details (available only if Action selected for the traffic is Accept).
a) Specify policies for User Applications.
Intrusion Prevention
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from Protect > Intrusion Prevention > IPS Policies page.
Traffic Shaping Policy
User's traffic shaping policy will be applied automatically if Match known users is selected.
You need to select traffic shaping policy for the rule if Match known users is not selected.
Web Policy
Select a web policy for the rule.
A new web policy can be created directly from this page itself or from the Protect > Web > Policies page.
Apply Web Category based Traffic Shaping Policy
Click to restrict bandwidth for the URLs categorized under the Web category.
A three step configuration is required as follows:
1. Create a traffic shaping policy from the System > Profiles > Traffic Shaping page. Here, specify the Policy Association as Web Categories.
2. Now, on this page assign the created policy to Web Policy.
3. Select Apply Web Category based Traffic Shaping Policy to apply the rule.
Application Control
Select an application filter policy for the rule. A new application filter policy can be created directly from this page itself or from the Protect > Applications > Application Filter page.
Apply Application-based Traffic Shaping Policy
Click to restrict bandwidth for the applications categorized under the Application category.
A three step configuration is required as follows:
1. Create a traffic shaping policy from the System > Profiles > Traffic Shaping page. Here, specify the Policy Association as Applications.
2. Now, on this page assign the created policy to Application Control.
3. Select Apply Application-based Traffic Shaping Policy to apply the rule.
Sophos XG Firewall | Protect | 324
Figure 263: User Applications
b) Configure Synchronized Security settings.
Minimum Source HB Permitted
Select a minimum health status that a source device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this rule will not be granted to the user.
Block clients with no heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a source device's access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Destination HB Permitted (not available if the only Destination Zone selected is WAN)
Select a minimum health status that a destination device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this rule will not be granted to the user.
Note: You can use the option if you have selected multiple zones along with WAN.
Block request to destination with no heartbeat (not available if the only Destination Zone selected is
WAN)
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can block requests to destinations not sending heartbeat.
Enable/disable the option to require the sending of heartbeats.
Note: You can use the option if you have selected multiple zones along with WAN.
Sophos XG Firewall | Protect | 325
Figure 264: Synchronized Security
c) Enter NAT and Routing details.
Rewrite source address (Masquerading)
Select if you want to re-write the source address or specify a NAT policy.
Default: Disabled
Use Gateway Specific Default NAT Policy (available only if Masquerading is selected)
Select to override the default NAT policy with a gateway specific policy.
Override default NAT policy for specific Gateway (available only if Use Gateway Specific Default
NAT Policy is selected)
Select to specify gateway and corresponding NAT policy. Multiple gateways and NAT policies can be added.
Use Outbound Address (available only if Rewrite source address is selected)
Select the NAT policy to be applied from the list of available NAT policies.
A new NAT policy can be created directly from this page itself or from the System > Profiles >
Network Address Translation page.
Default: MASQ.
MASQ (Interface Default IP)
• IP Address of the Destination Zone as configured in Configure > Network > Interfaces will be displayed instead of (Interface Default IP) when single Destination Zone is selected.
• (Interface Default IP) will be displayed when multiple Destination Zones are selected.
Primary Gateway
Specify the Primary Gateway. This is applicable only if more than one gateway is defined.
Note: On deletion of the gateway, Primary Gateway will display WAN Link Load
Balance for WAN Destination Zone and None for other zones. In such case, firewall rule will not make routing decisions.
Backup Gateway
Specify the Backup Gateway. This is applicable only if more than one gateway is defined.
Note: On deletion of the gateway, Backup Gateway will display None.
DSCP Marking
Select the DSCP Marking.
Sophos XG Firewall | Protect | 326
DSCP (DiffServ Code Point) classifies flow of packets as they enter the local network depending upon QoS. Flow is defined by 5 elements; source IP address, destination IP address, source port, destination port and the transport protocol.
For available options, refer to
Figure 265: NAT & Routing
9. Define logging option for the user application traffic.
Log Firewall Traffic
Select to enable logging of permitted and denied traffic.
Figure 266: Log Traffic
10. Click Save.
Add User / Network Rule (IPv6)
This page allows you to create firewall rules to control traffic that uses the IPv6 protocol. The firewall rules control traffic between internal and external networks and protect the network from unauthorized access. The device determines the rule to be applied based on the source and destination zone you configure in the firewall rule. Use this page to create identity-based firewall rules by applying them to users.
1. Go to Protect > Firewall and select IPv6. using the filter switch.
2. Click +Add Firewall Rule and User / Network Rule.
3. Specify the policy introduction details.
Rule Name
Enter a name for the rule.
Description
Specify a description for the rule.
Rule Position
Specify the position of the rule from the available options.
Available Options:
Top Bottom
Action
Sophos XG Firewall | Protect | 327
Specify an action for the rule traffic from the available options. Accept – Allow accessDrop –
Silently discardReject – Deny access (“ICMP port unreachable” message is sent to the source)
When sending a response it might be possible that the response is sent using a different interface than the one on which the request was received. This may happen depending on the routing configuration done on the device.
For example: If the request is received on the LAN port using a spoofed IP address (public IP address or the IP address not in the LAN zone network) and no specific route is defined, the device will send a response to these hosts using the default route. Hence, the response will be sent through the WAN port.
Figure 267: About This Rule
4. Specify Source details.
Source Zones
Select the source zones allowed to the user.
Source Networks and Devices
Select the source networks/devices allowed to the user.
A new network host can be created directly from this page itself by clicking Create new or from
System > Hosts and Services.
During Scheduled Time
Select the schedule allowed to the user.
A new schedule can be created directly from this page itself or from the System > Profiles >
Schedule page.
Figure 268: Source
5. Specify Destination and Services details.
Destination Zones
Select the destination zones allowed to the user.
Destination Networks
Select the destination networks allowed to the user.
A new network host can be created directly from this page itself by clicking Create new or from
System > Hosts and Services.
Services
Select the services(s) allowed to the user.
A new service can be created directly from this page itself or from the System > Hosts and
Services > Services page.
Sophos XG Firewall | Protect | 328
Figure 269: Destination
6. Specify Identity details.
Match known users
Select to enable a rule based on the user identity.
Show Captive Portal to unknown users
Select the check box to accept traffic from unknown users. Captive portal page is displayed to the user where the user can login to access the Internet.
Clear the check box to drop traffic from unknown users.
User or Groups.(only available if Match known users is selected)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting. (only available if Match known users is selected)
Select to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic user data accounting. The traffic allowed through this rule will not be accounted towards data transfer for the user.
Figure 270: Identity
7. Specify Malware Scanning details. (only available if Action for the traffic is Accept)
Scan HTTP
Enable HTTP traffic scanning.
Decrypt & Scan HTTPS
Enable HTTPS traffic decryption and scanning.
Detect zero-day threats with Sandstorm
Send files downloaded using HTTP or HTTPS for analysis by Sandstorm. Sandstorm protects your network against unknown and unpublished threats (“zero-day” threats).
8. Specify Advanced settings details (only available if Action for the traffic is Accept) a) Specify policies for user applications.
Intrusion Prevention (IPS)
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from Protect > Intrusion Prevention > IPS Policies page.
Traffic Shaping Policy
User's traffic shaping policy will be applied automatically if Match known users is selected.
Sophos XG Firewall | Protect | 329
You need to select traffic shaping policy for the rule if Match known users is not selected.
Web Policy
Select a web policy for the rule.
A new web policy can be created directly from this page itself or from the Protect > Web > Policies page.
Apply Web Category based Traffic Shaping Policy
Click to restrict bandwidth for the URLs categorized under the Web category.
A three step configuration is required as follows:
1. Create a traffic shaping policy on the System > Profiles > Traffic Shapingpage. Here, specify the Policy Association as Web Categories.
2. Now, on this page assign the created policy to Web Policy .
3. Select Apply Web Category based Traffic Shaping Policy to apply the policy.
Application Control
Select an application filter policy for the rule. A new application filter policy can be created directly from this page itself or from the Protect > Applications > Application Filter page.
Apply Application-based Traffic Shaping Policy
Click to restrict bandwidth for the applications categorized under the Application category.
A three step configuration is required as follows:
1. Create a traffic shaping policy from the System > Profiles > Traffic Shaping page. Here, specify the Policy Association as Applications.
2. Now, on this page assign the created policy to Application Control.
3. Select Apply Web based Traffic Shaping Policy to apply the policy.
Figure 271: User Applications
b) Specify Routing details.
Rewrite source address (Masquerading)
Disable if you do not want to re-write the source address or specify a NAT policy.
Sophos XG Firewall | Protect | 330
Default - Enabled
Use Gateway Specific Default NAT Policy (only if Masquerading is selected)
Click to override the default NAT policy with a gateway specific policy.
Override default NAT policy for specific Gateway (only if Use Gateway Specific Default NAT Policy
is selected )
Enable to specify gateway and corresponding NAT policy. Multiple gateways and NAT policies can be added.
Use Outbound Address (only if Rewrite source address is selected)
Select the NAT policy to be applied from the list of available NAT policies.
A new NAT policy can be created directly from this page itself or from the System > Profiles >
Network Address Translation page.
Default: MASQ.
MASQ (Interface Default IP)
• IP Address of the Destination Zone as configured in Configure > Network > Interfaces will be displayed instead of (Interface Default IP) when single Destination Zone is selected.
• (Interface Default IP) will be displayed when multiple Destination Zones are selected.
Primary Gateway
Specify the primary gateway. This is applicable only if more than one gateway is defined.
Note: On deletion of the gateway, Primary Gateway will display WAN Link Load
Balance for WAN Destination Zone and None for other zones. In such case, firewall rule will not make routing decisions.
Backup Gateway
Specify the backup gateway. This is applicable only if more than one gateway is defined.
Note: On deletion of the gateway, Backup Gateway will display None.
DSCP Marking
Select the DSCP Marking.
DSCP (DiffServ Code Point) classifies flow of packets as they enter the local network depending upon QoS. Flow is defined by 5 elements; Source IP Address, Destination IP Address, Source port,
Destination port and the transport protocol.
For available options, refer to
Sophos XG Firewall | Protect | 331
Figure 272: NAT & Routing
9. Define logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 273: Log Traffic
10. Click Save.
DSCP Value
DiffServ Code Point (DSCP) uses the 6 bits, thereby giving 2^6 = 64 different values (0 to 63). describes the standard
DSCP values. Remaining DSCP values can be customized as per the QoS requirement.
Decimal
22
24
26
28
30
32
14
16
18
20
0
8
10
12
DSCP
AF23
CS3
AF31
AF32
AF33
CS4
Default
CS1
AF11
AF12
AF13
CS2
AF21
AF22
Description
Best Effort
Class 1 (CS1)
Class 1, Gold (AF11)
Class 1, Silver (AF12)
Class 1, Bronze (AF13)
Class 2 (CS2)
Class 2, Gold (AF21)
Class 2, Silver (AF22)
Class 2, Bronze (AF23)
Class 3 (CS3)
Class 3, Gold (AF31)
Class 3, Silver (AF32)
Class 3, Bronze (AF33)
Class 4 (CS4)
Sophos XG Firewall | Protect | 332
Decimal
46
48
56
34
36
38
40
DSCP
AF41
AF42
AF43
CS5
EF
CS6
CS7
Description
Class 4, Gold (AF41)
Class 4, Silver (AF42)
Class 4, Bronze (AF43)
Class 5 (CS5)
Expedited Forwarding (EF)
Control (CS6)
Control (CS7)
Business Application Rule
Business Application Rule is used to protect internally or publicly hosted business applications or servers like
SalesForce, Sharepoint etc.
Using Business Application Rule, the administrator can configure protection of the http and non-http web servers from unauthorized access over the Internet. You can also control access of protected server or services through a
Business Application Rule.
Several templates are available that cover protection configuration for a variety of different types of http and non-http web servers and application. A list of these application templates appear on the Business Application Rule page.
Adding a Business Application Rule
Go to Protect > Firewall and select IPv4. using the filter switch. Now, click on +Add Firewall Rule and select
Business Application Rule. You can then select the Application Template from the list of available templates.
The application template allows you to choose the rule which suits the configuration of the required business application. Once you select the template, you can see the configuration page with few fields pre-populated. The prepopulated values eliminate the need to manually specify the configuration for securing your business application, but you may customize the settings according to your network setup or other requirements.
1.
DNAT/Full NAT/Load Balancing rule
- It is used to protect Non-Web servers, like mail or other servers hosted
inside the network (LAN or DMZ). Using this template, you can define access rights of such servers to users who require access over the WAN or Internet. Additionally, you can use the following Non-web application template:
2.
: Email Server (SMTP) rule is used to protect mail servers which are hosted internally in a
network and require protection.
3.
- Email Clients (POP and IMAP) rule is used to protect mail servers which are
hosted publicly (WAN) and require protection.
Note:
If you delete Email Clients rule, the Emails which are under process by this rule will be queued but will not be delivered.
We recommend to follow below given steps so that you do not lose all the emails processed by this rule:
1. Before deleting this rule, clone this rule by choosing Clone Above option and change the Action to
Drop. This cloned rule will hold all the incoming emails.
2. Go to Email > Mail Spool and check if spool is empty.
3. Once the spool is empty, delete both the firewall rules.
Application Protection Templates for common HTTP-based Applications
SF-OS offers several pre-configured templates to create a protection rule for commonly used HTTP-based applications. You can use a pre-configured template to create a rule for the web application that is close to your configuration, then modify it to fit your needs.
Pre-configured templates for common HTTP applications include:
Sophos XG Firewall | Protect | 333
1.
- Web Server Protection is used to protect HTTP or generic web application servers
hosted in the network. This template is essentially WAF implementation but with additional benefit of defining
WAF objects, rules, exceptions from the same page.
2.
3.
4.
5.
6.
Microsoft Remote Desktop Gateway 2008 and R2
7.
Microsoft Remote Desktop Web 2008 and R2
8.
Microsoft Sharepoint 2010 and 2013
Add Web Server Protection (WAF) Rule
This page allows you to control HTTP traffic flowing to and from a web application. Use this page to create Web
Server Protection (WAF) rule for traffic that uses IPv4 protocol.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Enter the general rule details.
Application Template
Select Web Server Protection (WAF) to define an application filter policy for HTTP based applications.
Rule Name
Enter a name for the rule.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options:
• Top
• Bottom
Figure 274: About this Rule
4. Enter Hosted Server details.
Hosted Address
Select the interface of the hosted server to which the rule applies. It is the public IP address through which Internet users access the internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Listening Port
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Sophos XG Firewall | Protect | 334
Select to enable or disable scanning of HTTPS traffic.
HTTPS Certificate (only available if HTTPS is selected)
Select the HTTPS certificate to be used.
Redirect HTTP (only available if HTTPS is selected)
Select to redirect HTTP requests.
Domains
(if HTTPS is disabled): Enter the domains the web server is responsible for as FQDN, e.g.
shop.example.com.
(if HTTPS is enabled): Depending on the HTTPS certificate you select, some domains may be preselected. You can edit or delete these domains or add new ones.
Figure 275: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (a path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (only available if Path-specific routing is selected)
Click Add Path to define a new path.
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Web Server (not available if Path-specific routing is selected)
With this option, you select the web servers that are to be protected. Select a web server from Web
Server list. The selected web server is displayed on the right side of the table under Selected Web
Server(s).
Sophos XG Firewall | Protect | 335
A new web server can be created on the Protect > Web Server > Web Servers page.
Figure 276: Protected Server(s)
6. Specify Access Permission details (not available if Path-specific routing is selected).
Allowed Client Networks
Select or add the allowed networks that should be able to connect to the hosted web server.
Blocked Client Networks
Select or add the denied networks that should be blocked to your hosted web server.
Authentication
Select a web app authentication profile or click Create new to create a new authentication profile.
You can also create an authentication profile from the Protect > Web Server > Authentication
Policies page.
on page 513
Figure 277: Access Permission
7. Add path Exceptions for the web servers.
Click Add New Exception to specify a new exception.
Figure 278: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Traffic Shaping
Sophos XG Firewall | Protect | 336
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 279: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local
but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (only available if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Sophos XG Firewall | Protect | 337
Figure 280: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The business application rule has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Exchange Autodiscover
(Only available for IPv4 policy) This page describes how to configure a rule for Exchange Autodiscover.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general rule details.
Application Template
Select Exchange Autodiscover to configure a policy for an Exchange Autodiscover environment.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options:
• Top
• Bottom
Rule Name
Specify a name for the rule.
Figure 281: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access an internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Listening Port
Sophos XG Firewall | Protect | 338
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Select this option to enable or disable HTTPS traffic.
HTTPS Certificate (available only if HTTPS is selected)
Select the HTTPS certificate to be used.
Redirect HTTP (available only if HTTPS is selected)
Select this option to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 282: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (the path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Default: Enabled
Add New Path (available only if Path-specific routing is selected)
Click Add New Path to define a new path.
Note: Add New Path will only be active only after at least one web server and one hosted web server have been created.
Default: /autodiscover, /Autodiscover, /AutoDiscover
Sophos XG Firewall | Protect | 339
Web Server (not available if Path-specific routing is selected)
Web servers are the application servers to be protected. Select a web server from the list of web servers or enter a web server and click Create to add a web server.
A new web server can be created directly from this page or from the Protect > Web Server > Web
Servers page.
Figure 283: Protected Server(s)
6. Specify Access Permission details (not available if Path-specific routing is selected).
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles.
You can also create a new authentication profile on this page or on the Protect > Web Server >
Authentication Policies page.
Figure 284: Access Permission
7. Add path Exceptions for the web servers.
Click Add New Exception to specify new exception.
Default: /autodiscover/*,/Autodiscover/*
Figure 285: Exceptions
Sophos XG Firewall | Protect | 340
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 286: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local
but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Sophos XG Firewall | Protect | 341
Rewrite cookies (only available if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Figure 287: Advanced
9. Click Save.
Note: As soon as a new HTTP based policy configuration has been created and saved or an existing
HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The firewall rule for Microsoft Remote Desktop Gateway 2008 and R2 has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Exchange Outlook Anywhere
(only available for IPv4 policy) This page describes how to configure a rule for Exchange Outlook Anywhere.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general policy details.
Application Template
Select Exchange Outlook Anywhere to configure rule for Exchange Outlook Anywhere.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Rule Name
Specify a name for the rule.
Figure 288: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access an internal server/host.
Sophos XG Firewall | Protect | 342
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Listening Port
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Select to enable or disable of HTTPS traffic.
HTTPS Certificate (only available if HTTPS is selected)
Select the HTTPS certificate to be used.
Redirect HTTP (only available if HTTPS is selected)
Select to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 289: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (only available if Path-specific routing is selected)
Click Add New Path to define a new path.
Sophos XG Firewall | Protect | 343
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Default: /rpc, /RPC
Web Server (not available if Path-specific routing is selected)
Web servers are the application servers that are to be protected. Select a web server from the list of web servers or click Add New Item to add a web server.
A new web server can be created directly from this page or from the Protect > Web Server > Web
Servers page.
Figure 290: Protected Server(s)
6. Specify Access Permission details. (not available if Path-specific routing is selected).
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles. You can also create a new authentication profile from this page or from the Protect > Web Server >
Authentication Policies page.
Figure 291: Access Permission
7. Add path Exceptions for the web servers.
Click Add New Exception to specify new exception.
Default: /rpc/*,/RPC/*.
Figure 292: Exceptions
Sophos XG Firewall | Protect | 344
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 293: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local
but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Sophos XG Firewall | Protect | 345
Rewrite cookies (only available if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Figure 294: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The Exchange Outlook Anywhere rule has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Exchange General
(only available for IPv4 policy) This page describes how to configure a rule for Exchange General.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general policy details.
Application Template
Select Exchange General to configure a rule for Exchange General.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Rule Name
Specify a name for the rule.
Figure 295: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access an internal server/host.
Sophos XG Firewall | Protect | 346
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Listening Port
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Select to enable or disable of HTTPS traffic.
HTTPS Certificate (only available if HTTPS is selected)
Select the HTTPS certificate to be used.
Redirect HTTP (only available if HTTPS is selected)
Select to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 296: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (only available if Path-specific routing is selected)
Click Add New Path to define a new path.
Sophos XG Firewall | Protect | 347
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Default: /owa, /OWA, /ecp, /ECP, /oab, /OAB, /ews, /EWS, /oma, /OMA, /Microsoft-Server-
ActiveSync
Web Servers (not available if Path-specific routing is selected)
Web servers are the application servers that are to be protected. Select a web server from the list of web servers or click Add New Item to add a web server.
A new web server can be created directly from this page or from the Protect > Web Server > Web
Servers page.
Figure 297: Protected Server(s)
6. Specify Access Permission details. (not available if Path-specific routing is selected)
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles. You can also create new authentication profile on this page or on the Protect > Web Server > Authentication
Policies page.
Sophos XG Firewall | Protect | 348
Figure 298: Access Permission
7. Add path Exceptions for the web servers.
Click Add New Exception to specify a new exception.
Default: /owa/*,/OWA/*,/ews/*,/EWS/*,/ecp/*,/ECP/*,/oab/*,/OAB/*,/oma/*,/OMA/*,/Microsoft-Server-
ActiveSync?*, /owa/ev.owa*
Figure 299: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Sophos XG Firewall | Protect | 349
Figure 300: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local
but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (only available if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Sophos XG Firewall | Protect | 350
Figure 301: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The Exchange General rule has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Microsoft Lync
(only available for IPv4 policy) This page describes how to configure a rule for Microsoft Lync.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general rule details.
Application Template
Select Microsoft Lync to define Application filter policy for HTTP based applications.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options:
• Top
• Bottom
Rule Name
Specify a name to identify the rule.
Figure 302: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Listening Port
Sophos XG Firewall | Protect | 351
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Click to enable or disable of HTTPS traffic.
HTTPS Certificate (available if HTTPS is enabled)
Select the HTTPS certificate to be used.
Redirect HTTP (available if HTTPS is enabled)
Click to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 303: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (the path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (available if Path-specific routing is enabled)
Click Add Path to define a new path.
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Web Server (available if Path-specific routing is disabled)
Hosts are the web servers that are to be protected. Select a web server from the list of web servers or click Add New Item to add a web server.
Sophos XG Firewall | Protect | 352
A new web server can be created directly from this page or from the Protect > Web Server > Web
Servers page.
Figure 304: Protected Application Server(s)
6. Specify Access Permission details (not available if Path-specific routing is selected).
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles.
You can also create a new authentication profile on this page or on the Protect > Web Server >
Authentication Policies page.
Figure 305: Access Permission
7. Specify path Exceptions for the web servers.
Click Add New Exception to specify a new exception.
Figure 306: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Sophos XG Firewall | Protect | 353
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 307: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local
but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (only available if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Sophos XG Firewall | Protect | 354
Figure 308: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The Microsoft Lync rule has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Microsoft Remote Desktop Gateway 2008 and R2
(only available for IPv4 policy) This page describes how to configure a rule for Microsoft Remote Desktop Gateway
2008 and R2.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general rule details.
Application Template
Select Microsoft Remote Desktop Gateway 2008 and R2 to configure a rule for Microsoft
Remote Desktop Gateway 2008 and R2.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options:
• Top
• Bottom
Rule Name
Specify a name to identify the rule.
Figure 309: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access an internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Sophos XG Firewall | Protect | 355
Listening Port
Enter a port number on which the hosted web server can be reached externally, over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Click to enable or disable of HTTPS traffic.
HTTPS Certificate (available if HTTPS is enabled)
Select the HTTPS certificate to be used.
Redirect HTTP (available if HTTPS is enabled)
Click to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 310: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (a path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (available if Path-specific routing is enabled)
Click Add New Path to define a new path.
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Web Server (available if Path-specific routing is disabled)
Sophos XG Firewall | Protect | 356
Web servers are the application servers that are to be protected. Select from the list of web servers or click Add New Item to add a web server.
A new web server can be created directly from this page or from the Protect > Web Server > Web
Servers page.
Figure 311: Protected Server(s)
6. Specify access permission details. (Available if Path-specific routing is disabled)
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles. You can also create a new authentication profile from this page or from the Protect > Web Server >
Authentication Policies page.
Figure 312: Access Permission
7. Specify path Exceptions for the web servers.
Click Add New Exception to specify new exception.
Figure 313: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Sophos XG Firewall | Protect | 357
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 314: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local
but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (only available if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Sophos XG Firewall | Protect | 358
Figure 315: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The rule for Microsoft Remote Desktop Gateway 2008 and R2 has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Microsoft Remote Desktop Web 2008 and R2
(only available for IPv4 policy) This page describes how to configure a rule for Microsoft Remote Desktop Web 2008 and R2.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general rule details.
Application Template
Select Microsoft Remote Desktop Web 2008 and R2 to configure a rule for Microsoft Remote
Desktop Web 2008 and R2.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Rule Name
Specify a name to identify the rule.
Figure 316: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access an internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Listening Port
Sophos XG Firewall | Protect | 359
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Click to enable or disable of HTTPS traffic.
HTTPS Certificate (available if HTTPS is enabled)
Select the HTTPS certificate to be used.
Redirect HTTP (available if HTTPS is enabled)
Click to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 317: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (the path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (available if Path-specific routing is enabled)
Click Add New Path to define a new path.
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Web Server (available if Path-specific routing is disabled)
Web servers are the application servers that are to be protected. Select a web server from the list of web servers or click Add New Item to add a web server.
Sophos XG Firewall | Protect | 360
A new web server can be created directly on this page or on the Protect > Web Server > Web
Servers page.
Figure 318: Protected Server(s)
6. Specify Access Permission details (available if Path-specific routing is disabled).
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles.
You can also create new authentication profile on this page or on the Protect > Web Server >
Authentication Policies page.
Figure 319: Access Permission
7. Add path Exceptions for the web servers.
Click Add New Exception to specify new exception.
Figure 320: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Traffic Shaping
Sophos XG Firewall | Protect | 361
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 321: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local
but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (only available if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Sophos XG Firewall | Protect | 362
Figure 322: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The rule for Microsoft Remote Desktop Web 2008 and R2 has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Microsoft Sharepoint 2010 and 2013
(only available for IPv4 policy) This page describes how to configure a rule for Microsoft SharePoint 2010 and 2013.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general rule details.
Application Template
Select Microsoft Sharepoint 2010 and 2013 to configure a rule for Microsoft Sharepoint 2010 and
2013.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options:
• Top
• Bottom
Rule Name
Specify a name to identify the rule.
Figure 323: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access an internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Sophos XG Firewall | Protect | 363
Listening Port
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Click to enable or disable of HTTPS traffic.
HTTPS Certificate (available if HTTPS is enabled)
Select the HTTPS certificate to be used.
Redirect HTTP (available if HTTPS is enabled)
Click to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 324: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (a path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (available if Path-specific routing is enabled)
Click Add New Path to define a new path.
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Web Server (available if Path-specific routing is disabled)
Sophos XG Firewall | Protect | 364
Web servers are the application servers that are to be protected. Select a web server from the list of web servers or click Add New Item to add a web server.
A new web server can be created directly from this page or from the Protect > Web Server > Web
Servers page.
Figure 325: Protected Application Server(s)
6. Specify Access Permission details (available if Path-specific routing is disabled).
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles.
You can also create new authentication profile from this page or from the Protect > Web Server >
Authentication Policies page.
Figure 326: Access Permission
7. Add path Exceptions for the web servers.
Click Add New Exception to specify new exception.
Figure 327: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Sophos XG Firewall | Protect | 365
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 328: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local
but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (only available if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Sophos XG Firewall | Protect | 366
Figure 329: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The rule for Microsoft Sharepoint 2010 and 2013 has been created and appears on the Firewall page when the IPv4 filter is set.
Add Path
(only available for the HTTP based business application rules) This page describes how to define (a path) to which real web servers incoming requests are forwarded.
1. Enable path-specific routing and click Add New Path.
2. Specify the path details.
Path
Enter the path for which you want to create the site path route.
Example: /products/.
Web Server
Select the web servers which are to be used for the specified path.
Authentication
Select the web app authentication profile. Select Create new to create a new authentication profile.
You can also create an authentication profile from the Protect > Web Server > Authentication
Policies page.
on page 513
Allowed Client Networks
Select or add the allowed networks that should be able to connect to the hosted web server.
Blocked Client Networks
Select or add the denied networks that should be blocked to your hosted web server.
Sticky session cookie
Click the toggle switch to ensure that each session is bound to one web server. If enabled, a cookie is passed to the user's browser, which causes Sophos XG Firewall to route all requests from this browser to the same real web server. If the server is not available, the cookie will be updated, and the session will switch to another web server.
Hot-standby mode
Click the toggle switch if you want to send all requests to the first selected web server, and use the other web servers only as a backup. The backup servers are only used in case the main server fails.
As soon as the main server starts functioning, the sessions will switch back - unless you have selected the Sticky session cookie option.
Sophos XG Firewall | Protect | 367
Figure 330: Add New Path
3. Click Save.
Add Exception
(only available for the HTTP based business application rules) This page describes how to specify path exceptions for the web servers.
1. Click Add New Exception.
2. Specify exception details.
Path
Specify the path which you want to exclude.
Operation
Select the operation among AND or OR for Path and Source.
Source
Specify the source networks where the client request comes from and which are to be exempted from the selected check(s).
Sophos XG Firewall | Protect | 368
Skip these Checks
Cookie Signing
Click to skip cookie signing. Cookie signing protects a web server against manipulated cookies.
When the web server sets a cookie, a second cookie is added to the first cookie containing a hash built of the primary cookie's name, its value and a secret, where the secret is only known by the WAF. Thus, if a request cannot provide a correct cookie pair, there has been some sort of manipulation and the cookie will be dropped.
Static URL Hardening
Protects against URL rewriting. When a client requests a website, all static URLs of the website are signed. The signing uses a similar procedure as with cookie signing. Additionally the response from the web server is analyzed in respect to the links that can be validly requested next.
Form Hardening
Click to skip form hardening. Form hardening protects against web form rewriting. Form hardening saves the original structure of a web form and signs it. Therefore, if the structure of a form has changed when it is submitted the WAF rejects the request.
Anti-virus
Select this option to protect a web server against viruses.
Block clients with bad reputation
Based on GeoIPClosed and RBLClosed information you can block clients which have a bad reputation according to their classification.
Skip these categories
Protocol Violations
Enforces adherence to the RFC standard specification of the HTTP protocol. Violating these standards usually indicates malicious intent.
Protocol Anomalies
Searches for common usage patterns. Lack of such patterns often indicates malicious requests.
These patterns include, among other things, HTTP headers like 'Host' and 'User-Agent'.
Request Limits
Enforces reasonable limits on the amount and ranges of request arguments. Overloading request arguments is a typical attack vector.
HTTP Policy
Narrows down the allowed usage of the HTTP protocol. Web browsers typically use only a limited subset of all possible HTTP options. Disallowing the rarely used options protects against attackers aiming at these often less well supported options.
Bad Robots
Checks for usage patterns characteristic of bots and crawlers. By denying them access, possible vulnerabilities on your web servers are less likely to be discovered.
Generic Attacks
Searches for attempted command executions common to most attacks. After having breached a web server, an attacker usually tries to execute commands on the server like expanding privileges or manipulating data stores. By searching for these post-breach execution attempts, attacks can be detected that might otherwise have gone unnoticed, for example because they targeted a vulnerable service by the means of legitimate access.
SQL Injection Attacks
Checks for embedded SQL commands and escape characters in request arguments. Most attacks on web servers target input fields that can be used to direct embedded SQL commands to the database.
XSS Attacks
Sophos XG Firewall | Protect | 369
Checks for embedded script tags and code in request arguments. Typical cross-site scripting attacks aim at injecting script code into input fields on a target web server, often in a legitimate way.
Tight Security
Performs tight security checks on requests, like checking for prohibited path traversal attempts.
Trojans
Checks for usage patterns characteristic of trojans, thus searching for requests indicating trojan activity. It does not, however, prevent the installation of such trojans as this is covered by the antivirus scanners.
Outbound
Prevents web servers from leaking information to the client. This includes, among other things, error messages sent by servers which attackers can use to gather sensitive information or detect specific vulnerabilities.
Advanced
Never change HTML during static URL hardening or form hardening
If selected, no data matching the defined exception settings will be modified by the WAF engine.
With this option, e.g., binary data wrongly supplied with a text/html content type by the web server will not be corrupted. On the other hand, web requests may be blocked due to activated URL hardening, HTML rewriting, or form hardening. Those three features use an HTML parser and therefore to some extent depend on the modification of web page content. To prevent undesired blocking, skip URL hardening and/or form hardening for requests affected by blocking; you might need to do this in another/new exception to reflect dependencies between web servers and/or web pages.
Accept unhardened form data
Even though having an exception for form hardening, it is possible that form data will not be accepted if the form hardening signature is missing. With this option, unhardened form data will be accepted anyway.
Figure 331: Add New Exception
Sophos XG Firewall | Protect | 370
Sophos XG Firewall | Protect | 371
3. Click Save.
Application Protection Templates for common non-HTTP Applications
SF-OS offers several pre-configured templates to create a protection rule for commonly used non-HTTP applications and services. You can use these templates to create a rule for the web application, that is close to your configuration, then modify it to fit your needs.
Pre-defined templates include:
1.
2.
Add DNAT/Full NAT/Load Balancing Rule
This page describes how to configure a DNAT/Full NAT/Load Balancing (Non-web) rule.
A DNAT/Full NAT/Load Balancing based rule is used to protect non-web servers, like mail or other servers hosted inside the network (LAN or DMZ). Using this rule, you can define access rights of such servers to users who require access over the WAN or Internet.
1. Go to Protect > Firewall and select between IPv4 or IPv6 using the default filter.
2. Now, click +Add Firewall Rule and select Business Application Rule.
3. Specify the general rule details.
Application Template
Select DNAT/Full NAT/Load Balancing to configure a rule for generic Non-Web based applications.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Rule Name
Specify a name to identify the rule.
Figure 332: About This Rule
4. Specify Source details.
Source Zones
Select a source zone or click Add New Item to define a new LAN or DMZ zone.
Allowed Client Networks
Select the allowed host(s) or add a new one by clicking Add New Item.
Blocked Client Networks
Select the blocked host(s)/network(s).
Figure 333: Source
Sophos XG Firewall | Protect | 372
5. Specify Destination & Service details.
Destination Host/Network
Select the destination host/network to apply rule. It is the public IP address through which users access an internal server/host over the Internet.
Available Options: IP Address: Specified IP address is mapped to a corresponding mapped single
IP address or a range of IP addresses. If a single IP address is mapped to a range of IP addresses, the device uses a round robin algorithm to load balance the requests.IP Range (only available for
IPv4): Specified IP address range is mapped to a corresponding range of mapped IP addresses. The
IP range defines the start and end of an address range. The start of the range must be lower than the end of the IP. Select when any of the device port, alias or virtual LAN (VLAN) sub-interface is required to be mapped to the destination host or network.
Forward Type
Select the type of external port from the available options.
Available Options: PortPort RangePort List Everything
When Everything is selected, all ports are forwarded. Select other options to enable custom port forwarding and specify port forwarding details.
Service Port(s) Forwarded (not available if Forward Type selected is Everything)
Specify the public port number for which you want to configure port forwarding.
Protocol (not available if Forward Type selected is Everything)
Select the protocol TCP or UDP to be used by forwarding packets.
Figure 334: Destination and Service
6. Specify Forward To details.
Protected Server(s)
From the available options, select the application server(s) on which the web server is to be hosted.
Available options: IP Address – External IP address is mapped to the specified IP address.IP
Range – External IP address range is mapped to the specified IP address range.IP List – External
IP address is mapped to the specified IP list.FQDN – External IP address is mapped to the specified
FQDN. Internal mapped server can be accessed by FQDN. This option is only available for IPv4
Virtual hosts.
Mapped Port Type (available only if Change Destination Port(s) is selected)
Select the type of mapped port from the available options.
Available Options:PortPort RangePort List
Mapped Port (available only if Change Destination Port(s) is selected)
Specify the mapped port number on the destination network to which the public port number is mapped.
Protected Zone
Select the zone to apply web server rule.
Change Destination Port(s)
Select the check box to specify different mapped port. Clear the check box to use the same Service
Port(s) Forwarded as mapped port.
Sophos XG Firewall | Protect | 373
Figure 335: Forward To
7. Specify Load balancing details.
Load Balancing (available only if selected Protected Server is IP Range or IP List or selected Destination
Host/Network is IP Address)
Select the method for load balancing from the available options.
Available Options:Round Robin - In this method, requests are served in a sequential manner where the first request is forwarded to the first server, second request to the second server and so on. When a request is received, the device checks to see which was the last server that was assigned a request.
It then assigns this new request to the next available server. This method can be used when equal distribution of traffic is required and there is no need for session-persistence.First Alive - In this method, all incoming requests are served by the first server (the first IP address that is configured in the IP range). This server is considered as the primary server and all others are considered as backup. Only when the first server fails, the requests are forwarded to the next server in line. This method is used for failover scenarios. Random - In this method, the requests are forwarded to the servers randomly. Nevertheless, the device makes sure that all configured servers receive equally distributed load. Hence, this method is also called uniform random distribution. This method can be used when equal distribution of traffic is required and there is no need for session-persistence or order of distribution.Sticky IP - In this method, along with the Round Robin distribution of traffic, the device forwards incoming traffic according to the source IP address. All traffic from a particular source is forwarded only to its mapped server. This means that all requests for a given source IP are sent to the same application server instance. This method is useful in cases where all requests or sessions are required to be processed by the same server. For example: banking websites, E-
Commerce websites.
Health Check (available only if Load Balancing is enabled)
Click to enable a health check for failover and specify the parameters based on the description shown below.
Port (available only if selected Health Check Method is TCP Probe)
Specify the port number on the server health is monitored.
Acceptable range: 1 to 65535
Interval
Specify the time interval in seconds after which the health will be monitored.
Acceptable range: 5 to 65535 seconds
Default: 60
Probe Method
Select the probe method to check the health of the server from the available options.
Available Options:ICMP TCP
Timeout
Specify the time interval in seconds within which the server must respond.
Acceptable range: 1 to 10 seconds
Default: 2
Retries
Sophos XG Firewall | Protect | 374
Specify the number of tries to probe the health of the server, after which the server will be declared unreachable.
Acceptable range: 1 to 10
Default: 3
Figure 336: Load Balancing
8. Specify Identity details.
Match known users
Match rule based on user identity allows you to check whether the specified user/user group from the selected zone is allowed to access the selected service or not.
Click to attach the user identity.
Enable check identity to apply the following policies per user.
Show Captive Portal to unknown users
Select the check box to accept traffic from unknown users. Captive portal page is displayed to the user where the user can login to access the Internet.
Clear the check box to drop traffic from unknown users.
User or Groups (available if Match known users is selected)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting (available if Match known users is selected)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic from user data accounting. The traffic allowed through this firewall rule will not be accounted towards data transfer for the user.
Figure 337: Identity
9. Specify Advanced settings details.
Sophos XG Firewall | Protect | 375 a) Specify Polices for Business Applications.
Intrusion Prevention
Select the required IPS policy. If Match rule based on user identity is enabled, user’s IPS policy will be applied automatically, but will not be effective till the respective module is subscribed. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention >
IPS Policies page.
Traffic Shaping Policy
Select the required traffic shaping policy. If Match rule based on user identity is enabled, user’s traffic shaping policy will be applied automatically.
You need to select traffic shaping policy for the rule if Match known users is not selected.
A new traffic shaping policy can be created directly from this page or from the System > Profiles >
Traffic Shaping page.
Figure 338: Policies for Business Applications
b) Specify Security Heartbeat details (only available if IPv4 is selected).
Minimum Source HB Permitted
Select a minimum health status that a source device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this rule will not be granted to the user.
Block clients with no heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a source device's access to certain services and networks.
Enable the option to require the sending of heartbeats.
Block request to destination with no heartbeat (not available if Protected Zone selected is WAN)
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can block requests to destinations not sending heartbeat.
Enable/disable the option to require the sending of heartbeats.
Sophos XG Firewall | Protect | 376
Figure 339: Synchronized Security
c) Specify Routing details.
Rewrite source address (Masquerading)
Enable/disable to re-write the source address or specify a NAT policy.
Use Outbound Address (available only if Rewrite source address is enabled)
Select the NAT policy to be applied from the list of available NAT policies.
A new NAT policy can be created directly from this page or from the System > Profiles > Network
Address Translation page.
The default NAT policy is Masquerade.
MASQ (Interface Default IP): IP Address of the selected Protected Zone as configured in
Configure > Network > Interfaces will be displayed instead of (Interface Default IP).
Create Reflexive Rule
Enable to automatically create a reflexive firewall rule for the protected host.
A reflexive rule has the same policies as those rules configured for the hosted server but instead of source zone to destination zone, this rule is applicable on traffic from destination zone to source zone.
By default, the reflexive rule is not created.
Figure 340: Routing
10. Specify the logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 341: Log Traffic
11. Click Save.
The non-web based rule has been created and appears on the Firewall page when the appropriate filter is set.
Sophos XG Firewall | Protect | 377
Add Rule for Email Clients (POP and IMAP)
Email Clients (POP and IMAP) rule is used to protect mail servers which are hosted publicly (WAN). This page describes how to configure a protection rule and control access of mail servers using application template - Email
Clients .
Note:
If you delete Email Clients rule, the Emails which are under process by this rule will be queued but will not be delivered.
We recommend to follow below given steps so that you do not lose all the emails processed by this rule:
1. Before deleting this rule, clone this rule by choosing Clone Above option and change the Action to Drop.
This cloned rule will hold all the incoming emails.
2. Go to Email > Mail Spool and check if spool is empty.
3. Once the spool is empty, delete both the firewall rules.
1. Go to Protect > Firewall and select between IPv4 or IPv6 using the default filter.
2. Now, click +Add Firewall Rule and select Business Application Rule.
3. Specify the general rule details.
Application Template
Select Email Clients (POP & IMAP) to define a application filter policy for POP and IMAP based email clients.
Description
Specify the rule description.
Rule Position
Specify the position of the rule.
Available Options:TopBottom
Rule Name
Specify a name to identify the rule.
Figure 342: About This Rule
4. Specify Source details.
Zone
Select the allowed source zone(s).
Networks
Select the allowed source network(s) . A new network host can be created directly from this page or from the System > Hosts and Services > IP Host page.
Figure 343: Source
Sophos XG Firewall | Protect | 378
5. Specify Destination details.
Zone
Select the zone to which the rule applies.
Networks
Select the network(s) to be protected.
A new network host can be created directly from this page or from the System > Hosts and
Services > IP Host page.
Figure 344: Destination
6. Specify Identity details.
Match rule based on user identity
Click to enable a rule based on the user identity.
Show Captive Portal to unknown users
Select the check box to accept traffic from unknown users. Captive portal page is displayed to the user where the user can login to access the Internet.
Clear the check box to drop traffic from unknown users.
User or Groups (only available if Match rule based on user identity is enabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting (only available if Match rule based on user identity is
enabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic from user data accounting. The traffic allowed through this rule will not be accounted towards data transfer for the user.
Figure 345: Identity
7. Specify Malware Scanning details.
Scan IMAP/IMAPS/POP3/POP3S/SMTP/SMTPS
Click to enable/disable scanning of IMAP/IMAPS/POP3/POP3S/SMTP/SMTPS traffic.
Sophos XG Firewall | Protect | 379
Figure 346: Malware Scanning
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Intrusion Prevention
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from the Protect > Intrusion Prevention > IPS Policies page.
Traffic Shaping (Not available if Match rule based on user identity is selected)
Select a traffic shaping policy for the rule.
A traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
A new traffic shaping policy can be created directly from this page or from the System > Profiles >
Traffic Shaping page.
Figure 347: Policies for Business Applications
b) SpecifySecurity Heartbeat settings (only available if IPv4 is selected).
Minimum Source HB Permitted
Select a minimum health status that a source device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this rule will not be granted to the user.
Block clients with no heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a source device's access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Destination HB Permitted (Not available if the only Destination Zone selected is WAN)
Select a minimum health status that a destination device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this policy will not be granted to the user.
Note: You can use the option if you have selected multiple zones along with WAN.
Block request to destination with no heartbeat (Not available if the only Destination Zone selected is WAN)
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can block requests to destinations not sending heartbeat.
Enable/disable the option to require the sending of heartbeats.
Sophos XG Firewall | Protect | 380
Note: You can use the option if you have selected multiple zones along with WAN.
Figure 348: Security Heartbeat
c) Specify Routing details.
Rewrite source address (Masquerading)
Enable/disable to re-write the source address or specify a NAT policy.
Use Gateway Specific Default NAT Policy (only if Masquerading is selected)
Select to override the default NAT policy with a gateway specific policy.
Override default NAT policy for specific Gateway (only if Use Gateway Specific Default NAT Policy
is selected )
Select to specify gateway and corresponding NAT policy. Multiple gateways and NAT policies can be added.
Use Outbound Address (only available if Rewrite source address is enabled and Use Gateway
Specific Default NAT Policy is disabled )
Select the NAT policy to be applied the list or available NAT policies.
A new NAT policy can be created directly from this page or from the System > Profiles > Network
Address Translation page.
The default NAT policy is Masquerade.
MASQ (Interface Default IP)
• IP Address of the Destination Zone as configured in Configure > Network > Interfaces will be displayed instead of (Interface Default IP) when single Destination Zone is selected.
• (Interface Default IP) will be displayed when multiple Destination Zones are selected.
Primary Gateway
Select the primary gateway to route the request. You can create new gateway from this page itself or from Configure > Routing > Gateways.
Note: On deletion of the gateway, Primary Gateway will display WAN Link Load
Balance for WAN Destination Zone and None for other zones. In such case, firewall rule will not make routing decisions.
Backup Gateway
Select the backup gateway to route the request. You can create new gateway from this page itself or from Configure > Routing > Gateways.
Note: On deletion of the gateway, Backup Gateway will display None.
Sophos XG Firewall | Protect | 381
Figure 349: Routing
9. Specify logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 350: Log Traffic
Add Rule for Email Servers (SMTP)
This page describes how to configure a rule for email servers (SMTP).
1. Go to Protect > Firewall and select between IPv4 or IPv6 using the default filter.
2. Now, click +Add Firewall Rule and select Business Application Rule.
3. Specify the general rule details.
Application Template
Select Email Servers (SMTP) to configure a rule for SMTP based email applications.
Description
Specify the policy description.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Rule Name
Specify a name to identify the policy.
Figure 351: About This Rule
4. Specify Source details.
Source Zones
Click to select the source zone. Click Add New Item to define a new LAN or DMZ zone.
Allowed Client Networks
Select the allowed host(s) or add a new one by clicking Add New Item.
Blocked Client Networks
Sophos XG Firewall | Protect | 382
Select the blocked host(s)/network(s).
Figure 352: Source
5. Specify Destination & Service details.
Destination Host/Network
Select the destination host/network to apply rule. It is the public IP address through which users access internal server/host over the Internet.
Available Options:IP Address – Specified IP address is mapped to a corresponding mapped single or range of IP addresses. If a single IP address is mapped to a range of IP addresses, the device uses a round robin algorithm to load balance the requests.IP Range – Specified IP address range is mapped to a corresponding range of mapped IP addresses. The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP (only
available for IPv4) – Select when any of the device port, alias or virtual LAN (VLAN) sub interface is required to be mapped to the destination host or network.
Forward Type
Select the type of external port from the available options.
Available Options: PortPort RangePort List Everything
When Everything is selected, all ports are forwarded. Select other options to enable custom port forwarding and specify port forwarding details.
Service Port(s) Forwarded (not available if Forward Type selected is Everything)
Specify the public port number for which you want to configure port forwarding.
Protocol (not available if Forward Type selected is Everything)
Select the protocol TCP or UDP to be used by forwarded packets.
Figure 353: Destination and Service
6. Specify Forward To details.
Protected Server(s)
Select from the available options on which the email server is to be hosted.
Available options: IP Address – External IP address is mapped to the specified IP address.IP Range
– External IP address range is mapped to the specified IP address range.IP List – External IP address is mapped to the specified IP list.FQDN (available only for IPv4 virtual hosts) – External IP address is mapped to the specified FQDN. Internal mapped server can be accessed by FQDN.
Mapped Port Type (available only if Change Destination Port(s) is selected)
Select the type of mapped port from the available options.
Available Options:PortPort RangePort List
Mapped Port (available only if Change Destination Port(s) is selected)
Specify mapped port number on the destination network to which the public port number is mapped.
Sophos XG Firewall | Protect | 383
Protected Zone
Select the zone to which the email server rule applies.
Change Destination Port(s)
Select the check box to specify different mapped port. Clear the check box to use the same Service
Port(s) Forwarded as mapped port.
Figure 354: Forward To
7. Specify Load balancing details.
Load Balancing (only available if selected Protected Server is IP Range or IP List and selected
Destination Host/Network is IP Address)
Select the method for load balancing from the available options.
Available Options:Round Robin - In this method, requests are served in a sequential manner where the first request is forwarded to the first server, second request to the second server and so on. When a request is received, the device checks to see which the last server that was assigned a request was.
It then assigns this new request to the next available server. This method is can be used when equal distribution of traffic is required and there is no need for session-persistence.First Alive - In this method, all incoming requests are served by the first server (the first IP address that is configured in the IP range). This server is considered as the primary server and all others are considered as backup. Only when the first server fails, the requests are forwarded to the next server in line. This method is used for failover scenarios. Random -In this method, the requests are forwarded to the servers randomly. Although, the device makes sure that all configured servers receive equally distributed load. Hence, this method is also called uniform random distribution. This method can be used when equal distribution of traffic is required and there is no need for session-persistence or order of distribution.Sticky IP - In this method, along with Round Robin distribution of traffic, the device forwards incoming traffic according to the source IP address. All traffic from a particular source is forwarded only to its mapped server. This means that all requests for a given source IP are sent to the same application server instance. This method is useful in cases where all requests or sessions are required to be processed by the same server. For example: Banking websites, E-
Commerce websites.
Health Check (available only if Load Balancing is enabled)
Click to enable health check for failover and specify the parameters based on the description shown below.
Port (available only if selected health check method is TCP Probe)
Specify the port number on the server health is monitored.
Acceptable range: 1 to 65535
Interval
Specify the time interval in seconds after which the health will be monitored.
Acceptable range: 5 to 65535 seconds
Default: 60
Probe Method
Select the probe method to check the health of the server from the available options.
Available Options:ICMP TCP
Timeout
Sophos XG Firewall | Protect | 384
Specify the time interval in seconds within which the server must respond.
Acceptable range: 1 to 10 seconds
Default: 2
Retries
Specify the number of tries to probe the health of the server, after which the server will be declared unreachable
Acceptable range: 1 to 10
Default: 3
Figure 355: Load Balancing
8. Specify Identity details.
Match known users
Match known users allows you to check whether the specified user/user group from the selected zone is allowed to access the selected service or not.
Click to attach the user identity.
Show Captive Portal to unknown users
Select the check box to accept traffic from unknown users. Captive portal page is displayed to the user where the user can login to access the Internet.
Clear the check box to drop traffic from unknown users.
User or Groups (available only if Match known users is enabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting (available only if Match known users is enabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic from user data accounting. The traffic allowed through this firewall rule will not be accounted towards data transfer for the user.
Sophos XG Firewall | Protect | 385
Figure 356: Identity
9. Specify Malware Scanning details.
Scan SMTP
Click to enable/disable scanning of SMTP traffic.
Scan SMTPS
Click to enable/disable scanning of SMTPS traffic.
Figure 357: Malware Scanning
10. Specify Advanced settings details.
a) Specify Polices for Business Applications.
Intrusion Prevention
Select the required IPS policy. If Match rule based on user identity is enabled, user’s IPS policy will be applied automatically, but will not be effective till the respective module is subscribed.
A new IPS policy can be created directly from this page or from the Protect > Intrusion
Prevention > IPS Policies page.
Traffic Shaping Policy (not available if Match known users is selected)
Select the required IPS policy. If Match rule based on user identity is enabled, user’s QoS policy will be applied automatically.
A new traffic shaping policy can be created directly from this page or from the System > Profiles >
Traffic Shaping page.
Figure 358: Policies for Business Applications
b) Specify Security Heartbeat settings (available only if IPv4 is selected).
Minimum Source HB Permitted
Sophos XG Firewall | Protect | 386
Select a minimum health status that a source device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this rule will not be granted to the user.
Block clients with no heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a source device's access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Destination HB Permitted (not available if Protected Zone selected is WAN)
Select a minimum health status that a destination device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this rule will not be granted to the user.
Block request to destination with no heartbeat (not available if Protected Zone selected is WAN)
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can block requests to destinations not sending heartbeat.
Enable/disable the option to require the sending of heartbeats.
Figure 359: Security Heartbeat
c) Specify Routing details.
Rewrite source address (Masquerading)
Enable/disable to re-write the source address or specify a NAT policy.
Use Outbound Address (available only if Rewrite source address is enabled)
Select the NAT policy to be applied from the list of available NAT policies.
A new NAT policy can be created directly from this page or from the System > Profiles > Network
Address Translation page.
The default NAT policy is Masquerade.
MASQ (Interface Default IP): IP Address of the selected Protected Zone as configured in
Configure > Network > Interfaces will be displayed instead of (Interface Default IP).
Create Reflexive Rule
Select ON to automatically create a reflexive firewall rule for the protected host.
The reflexive rule has the same policies as those configured for the hosted server but instead of source zone to destination zone, this rule is applicable on traffic from destination zone to source zone.
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
