The device is shipped with a number of physical interfaces, that is, ports and a number of virtual interfaces, depending on the model of the device. The Interface page displays a list of physical interfaces, aliases, virtual interfaces, bridge interfaces, interfaces configured as LAG or as TAP as well as interfaces configured for wireless LAN or for cellular

WAN.

| Configure | 300

Interfaces allows you to configure a range of physical and virtual interfaces. If a virtual interface is configured for a physical interface, it is displayed below the physical interface. Virtual interface configuration can be updated or deleted.

Note: Updating the interface details may affect dependent configurations. Refer

Configurations dependent on

Interfaces

for more details.

The possible configurations are provided below:

•

Alias

– Alias allows you to bind multiple IP addresses to a single physical interface.

•

Bridge

– A bridge enables you to configure transparent subnet gatewaying.

•

LAG

– Link Aggregation Group (LAG) allows multiple network connections to be combined into a single connection. It is also known as trunking, NIC teaming, NIC bonding, or Ether Channel. LAG is mostly used to handle LAN traffic.

•

VLAN

– A virtual LAN is a broadcast domain with each VLAN being configured on a switch to individual ports.

•

Wireless Networks

– A wireless network links devices through a wireless distribution method, connecting them to the Internet through an access point.

If a wireless network is configured with a “Separate Zone” for

Client Traffic

mode under Protect > Wireless >

Wireless Networks, a wlnet interface of the type “Wireless Protection” is automatically created on this page with the configured IP address and zone of the wireless network. In order to use the interface, you need to configure a DHCP server for the interface so that the wireless clients can connect to the device. The interface will automatically be deleted once the wireless network is deleted.

•

Cellular WAN

– A cellular WAN is a wide area network (WAN) for data that is typically provided by cellular carriers to transmit a wireless signal over a range of several miles to a mobile device.

•

TAP

– A TAP interface enables you to deploy the device in Discover Mode. In this mode, the device can monitor all the network traffic without making any changes in the existing network schema. Discover Mode can be configured through the command line interface (CLI).

•

RED

- The Remote Ethernet Device (RED) is used to connect remote branch offices to your head office as if the

branch office is part of your local network. The RED device connects to the main device using a RED interface and can be configured using this interface. On factory default, all the configured RED interfaces are deleted.

Interface status messages can have the following values:

• Disabled - The interface is currently not bound to any zone.

• Connected - The interface is connected, configured and is running.

• Connecting (Displayed only for PPPoE and cellular WAN (WWAN1) interfaces) - Displayed when a new IP address is being leased.

• Disconnected (Displayed only for PPPoE and cellular WAN (WWAN1) interfaces) - Displayed after the IP address has been released.

• Disconnecting (Displayed only for PPPoE and cellular WAN (WWAN1) interfaces) - Displayed during the process of IP release.

• Unplugged - No physical connection.

• Not Available (Applicable for Flexi Ports devices) - If the Flexi Ports module has previously been inserted and

Flexi Ports have been configured, then after removing the Flexi Ports module from the device, the Flexi Ports will carry the status "Not Available".

The following list shows the different icons, representing the different interface types:

Icons Meaning

Ethernet

Wireless

Bridge

| Configure | 301

Icons Meaning

VLAN

RED10

RED15

RED50

LAG

WWAN

Note: Configurations dependent on Interfaces

• Updating the interface details may affect dependent configurations, including Interface zone binding,

DNS, gateway, interface-based hosts, VLAN interfaces, and dynamic DNS.

• Deleting the virtual interface will delete the firewall rule defined for the virtual interface.

• Deleting the interface will also remove all its dependent configurations, including interface zone binding,

DHCP server or relay, interface-based firewall rule, ARP (static and proxy), protected servers, protected server-based firewall rules, interface-based hosts and references from host groups as well as unicast and multicast routes.

• Your network connections might get affected for some time after updating/deleting Interfaces. If you face any network issues during this time then please wait for some time and check again.

Physical Interface Configuration

Use this page to edit physical interface configurations.

1. Go to Configure > Network > Interfaces. Identify the physical interface whose settings need to be updated and click the icon on the right side. Click Edit Interface within the box.

2. Enter the details for General Settings.

Physical Interface

Physical interfaces are ports which may be marked in numeric (Port1, Port2, and so on), alphabetic

(PortA, PortB, and so on), alphanumeric (PortA2, PortA3, and so on), or in special alphanumeric form (eth0, eth1, and so on), depending on your device.

Network Zone

Select the zone to which the interface belongs.

Available Options:

• None: Select to unbind the interface.

• LAN

• WAN

• DMZ

• WiFi

Figure 301: General Settings

3. Enter the IPv4 configuration details.

IP Assignment

Select the IP assignment type.

Available Options:

• Static - Click to specify the IP address manually.

• PPPoE - Click to enable the interface to receive the IP address from a PPPoE server.

• DHCP - Click to enable the interface to receive the IP address dynamically from a DHCP server.

IPv4/Netmask

Enter the IPv4 address of the interface. Select the network subnet mask.

Preferred IP (available only if selected IP Assignment is PPPoE)

Many Internet service providers assign a static IP address to PPPoE connections. The device allows you to bind the static IP address to the PPPoE connection.

Note: An IP Address other than the preferred IP Address may be assigned to the

PPPoE connection, depending on the PPPoE Server configuration.

4. Enter the IPv4 gateway details.

Gateway Detail (available only for WAN zone)

• Static IP Assignment - Enter the Gateway Name and the IPv4 address through which traffic is to be routed.

• PPPoE IP Assignment - Enter the Gateway Name through which traffic is to be routed.

• DHCP IP Assignment - Enter the Gateway Name through which traffic is to be routed.

| Configure | 302

Figure 302: IPv4 Configuration

5. Enter the details for PPPoE IP Assignment.

Username

Enter the PPPoE account username.

Password

Enter the PPPoE account password.

Access Concentrator/Service Name

Enter the access concentrator and service name.

The device initiates only those sessions with the access concentrator that can provide the specified service.

LCP Echo Interval

Enter the time interval at the end of which the system sends an echo request to check whether the link is alive. Once an attempt is made, the device waits for the defined time interval before the next attempt is made.

Default: 20 seconds

LCP Failure

Enter the number of attempts (echo requests) to be made. Once the specified number of attempts are made without receiving a response from the client, the device disconnects the PPPoE connection.

Default: 3

Schedule Time For Reconnect

The IP address assigned to a PPPoE connection, whether dynamic or static (preferred), can have a predefined validity period. Once the validity expires, the PPPoE connection is terminated and is reconnected.

To prevent reconnection during working hours, enable the PPPoE reconnect schedule. You may choose to schedule the PPPoE reconnection on daily or weekly basis at the configured time

(HH:MM).

Default: Disabled

Default schedule when enabled: All days of the week

Note: Even when a Preferred IP address has been configured, if Schedule Time For

Reconnect is enabled and configured, on reconnection, an IP address other than the preferred IP address may be assigned to the PPPoE connection.

| Configure | 303

Figure 303: PPPoE Configuration

6. Enter the IPv6 configuration details.

IP Assignment

Select the IP assignment type.

Available Options:

• Static

• DHCP

Mode (only for DHCP mode)

Select the DHCP mode.

Select the relevant option to configure the IPv6 addresses through stateful (DHCPv6) or Stateless address assignment methods depending on the Managed (M) Address Configuration and Other (O) configuration flags advertised in the Router Advertisement (RA) message.

Available Options:

Auto - If selected, the IPv6 address will be configured based on the router advertisement packet through Stateless Address Auto-Configuration (SLAAC) or through DHCPv6 depending on the

Managed (M) Address Configuration and Other (O) Configuration flags advertised in the Router

Advertisement (RA) message. Manual - Select the relevant option to configure the IPv6 address either through SLAAC or through DHCPv6.

• DHCP Only - In this manual mode, the client will configure IPv6 Address and other configuration parameters using DHCPv6 Server. Gateway details should be manually specified.

• Stateless - In this manual mode, client will configure IPv6 Address based on advertised RA message through SLAAC.

• Accept Other Configuration from DHCP: Select to configure other parameters using

DHCPv6 Server. By default, it is enabled.

DHCP Rapid Commit

If enabled, the interface will be configured using a 2-message exchange (Solicit and Reply) rather than the 4-message exchange (Solicit, Advertise, Request, and Reply). It allows for quicker client configuration.

Note: Rapid commit should also be enabled on the DHCPv6 server.

IPv6 / Prefix (Only for static IP assignment)

Enter the IPv6 address and the prefix.

Gateway Detail (Only for "WA"N zone)

For Static IP assignment:Enter the gateway name and IPv6 address through which the traffic is to be routed. For DHCP IP assignment:Enter the gateway name, if Stateless manual mode is selected. For DHCP only manual mode, specify the gateway name and IPv6 address.

| Configure | 304

Figure 304: IPv6 Configuration - DHCP

7. Enter details for the Advanced Settings.

Interface Speed

Select interface speed for synchronization. Interface speed can also be configured through CLI using set network interface-speed command.

Speed mismatch between the device and third-party routers and switches can result in errors or collisions on the interface, disconnection, traffic latency, or slow performance.

Depending on the model deployed, the following options are available:

Auto Negotiation 10 Mbps - Half Duplex 10 Mbps - Full Duplex 100 Mbps - Half Duplex 100

Mbps - Full Duplex 1000 Mbps - Full Duplex

Default - Auto Negotiation

MTU

Enter the MTU (Maximum Transmission Unit) value.

MTU is the largest physical packet size, in bytes, that a network can transmit. This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes.

Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent.

Default - 1500

Acceptable Range (For IPv4 Configuration):576 to 1500

Acceptable Range (For IPv6 Configuration):1280 to 1500

Override MSS

Select to override the default MSS.

MSS defines the amount of data that can be transmitted in a single TCP packet.

Default: 1460

Acceptable Range:536 to 1460

Use Default MAC Address

Click to use the default MAC address for the interface.

By default, the first port that is included as member port becomes the default MAC address.

Override Default MAC Address

Click to override the default MAC address for the interface and enter the new MAC address.

On factory reset, it is set to the default MAC Address.

| Configure | 305

Figure 305: Advanced settings

8. Click Save.

Advanced Settings for Bridge Interface

Use this page to edit the advanced settings for bridge interface.

1. Go to Configure > Network > Interfaces. Identify the bridge interface whose advanced settings need to be updated and click the icon on the right-hand side. Click Edit Interface within the box.

2. Enter the details for Advanced Settings.

Physical Interface

Displays the physical bridge member interface.

Network Zone

Displays the zone to which the physical interface belongs.

Interface Speed

Select the interface speed for synchronization. Interface speed can also be configured through CLI using the set network interface-speed command.

Speed mismatch between the device and third-party routers and switches can result in errors or collisions on the interface, disconnection, traffic latency, or slow performance.

Depending on the device, the following options are available:

• Auto Negotiation

• 10 Mbps - Half Duplex

• 10 Mbps - Full Duplex

• 100 Mbps - Half Duplex

• 100 Mbps - Full Duplex

• 1000 Mbps - Full Duplex

Default: Auto Negotiation.

MTU

Enter the MTU (Maximum Transmission Unit) value. MTU is the largest physical packet size (in bytes) that a network can transmit.

Default: 1500

Override MSS

Select the checkbox to override the default MSS (Maximum Segment Size). MSS defines the amount of data that can be transmitted in a single TCP packet.

Default: 1460

Use Default MAC Address

Click to use the default MAC address of the interface. The MAC address of the first port to be added as member port becomes the default MAC address.

Override Default MAC Address

Click to override the default MAC address of the interface and enter the new MAC address. On factory reset, it will be set to the default MAC address.

| Configure | 306

Figure 306: Advanced Settings - Bridge Interface

3. Click Save.

Add Bridge

The device can be deployed in bridge mode.

Use this page to create a bridge interface.

This feature is not supported when the device is deployed on Microsoft Hyper-V hypervisors.

| Configure | 307

1. Go to Configure > Network > Interfaces, click Add Interface on the right side and click Add Bridge from the drop-down list.

2. Enter the details for General Settings.

Name

Enter a name to identify the bridge.

Description

Enter a description for the bridge.

Enable routing on this bridge pair

Select the checkbox to enable routing on this bridge.

Figure 307: General Settings

3. Enter the details of Member Interfaces.

Interface

Select the interfaces of the bridge. For example, Port A, Port B.

Zone

For each interface, select the zone to which the interface belongs.

Figure 308: Bridge Member Interfaces

4. Enter IPv4 configuration and gateway details.

IPv4 / Netmask

Enter the IPv4 address and select the network subnet mask.

Gateway Name

Enter a name to identify the gateway.

Gateway IP

Enter the IPv4 address for the gateway.

Figure 309: IPv4 Configuration and Gateway Details

5. Enter the IPv6 configuration details.

IPv6 / Prefix

Enter the IPv6 address and the prefix.

Gateway Name

Enter a name to identify the gateway.

IP Address

Enter the IPv6 address for the gateway.

Figure 310: IPv6 Configuration

6. Enter the details for Advanced Settings.

MTU

Enter the MTU (Maximum Transmission Unit) value.

MTU is the largest physical packet size (in bytes) that a network can transmit. Problem arises when networks with differing MTU sizes are interconnected. In such a scenario, packets larger than the specified MTU value are divided (fragmented) into smaller packets before they are sent.

Default: 1500

Acceptable Range (For IPv4 Configuration):576 to 1500

Acceptable Range (For IPv6 Configuration):1280 to 1500

Override MSS

Select the checkbox to override the default MSS (Maximum Segment Size).

MSS defines the amount of data that can be transmitted in a single TCP packet.

Default: 1460

Acceptable Range: 536 to 1460

Figure 311: Advanced Settings

| Configure | 308

| Configure | 309

Note:

• A single WAN interface is supported in a bridge.

• A single interface cannot be part of multiple bridges.

7. Click Save.

Add Alias

Use this page to bind multiple IP addresses to a single interface.

1. Go to Configure > Network > Interfaces, click Add Interface on the right side and click Add Alias from the drop-down list.

2. Enter the interface details.

Physical Interface

Select the interface to which an Alias must be bound.

IP Family

Select the IP family for the Alias.

Available Options:

IPv4 (Only for physical interfaces with IPv4 configuration)

IPv6 (Only for physical interfaces with IPv6 configuration)

IPv4/Netmask (Available only if IP Family selected is IPv4)

Enter the IPv4 address and select the network subnet mask.

IPv6/Prefix (Available only if IP Family selected is IPv6)

Enter the IPv6 address and the prefix.

Default: 64

Figure 312: Add Alias

3. Click Save.

Configure Cellular WAN Settings

The device allows you to configure Cellular WAN interface.

Use this page to configure celluar WAN settings.

Enable Cellular WAN from Configure > Network > Cellular WAN.

1. Go to Configure > Network > Interfaces. Identify the cellular WAN (WWAN1) interface whose settings need to be updated and click the icon on the right side. Click Edit Interface within the box.

2. Enter the details for General Settings.

Interface Name

Enter a name for the interface.

IP Assignment

Select the IP assignment method from the available options:

Available Options:Dial-up (PPP)Network Adapter (DHCP)

Show Recommended Configuration

Click to view the modem details and the recommended configuration. The recommended configuration is displayed in two sections:

Information Section:

• Modem Name

• Vendor ID

• Product ID

• SIM PIN Enabled – Yes/No

Configuration Section:

Available IP Assignment Methods:

Possible Values

• Dial-up (PPP)

• Network Adapter (DHCP)

• Dial-up (PPP) & Network Adapter (DHCP)

Modem Port:

Possible Values

• Not Available

• Serial n (n= 0, 1, …9)

Secondary Modem Ports:

Possible Values

• Not Available

• Serial n (n = 0, 1, …9)

Note: This parameter displays the next available modem port. This port must be used as the Modem Port, if the recommended modem port fails.

APN (Access Point Name):

Possible Values

• Not Available

• <name>

DHCP Connect Command:

Possible Values

• Not Required

• Required but not available

• <AT command>

DHCP Disconnect Command:

Possible Values

• Not Required

• Required but not available

• <AT command >

Click Load Recommended Configuration to load the recommended configuration onto the page.

This action removes previous configurations, if any, and replaces them with the recommended configuration.

Note: When you click Load Recommended Configuration, values of the secondary modem ports are not loaded.

Connect

Select the mode to establish a cellular WAN connection.

| Configure | 310

Available Options:AutoManual

Reconnect Tries

Select the number of attempts to be made when reconnecting to an access point.

Available Options:Always123Default: Always

Modem Port (Available only if IP Assignment selected is Dial-up (PPP))

Enter the serial interface on which the modem will establish a connection.

Available Options:Serial 0 to 9

Phone Number (Available only if IP Assignment selected is Dial-up (PPP))

Enter the phone number to be used in order to establish the connection or select one from the dropdown list.

Username

Enter a username for the connection.

Password

Enter a password.

SIM Card PIN Code

Enter the PIN code in order to unlock the PIN-enabled SIM card.

Many operators lock their SIM card to prevent the use of another operator's SIM card. Such modems can be unlocked using the PIN code in order to establish a connection.

APN

Enter the Access Point Name (APN).

The APN is a configurable network identifier based on which the device identifies the Packet Data

Network (PDN) or the GSM carrier with which the user wants to communicate.

DHCP Connect Command (Available only if IP Assignment selected is Network Adapter (DHCP))

Enter a DHCP command to connect to the cellular WAN.

DHCP Disconnect Command (Available only if IP Assignment selected is Network Adapter (DHCP))

Enter a DHCP command to disconnect from the cellular WAN.

Initialization String

Enter an initialization string for the specific wireless modem. In case of multiple strings, the strings must be entered in the order of their priority.

| Configure | 311

Figure 313: General Settings - Dial-up

3. Enter the details for Gateway Settings.

Gateway Name

Enter a name to identify the gateway.

Gateway IP

Enter the IP address of the gateway.

Figure 314: Gateway Settings

4. Enter the details for Advanced Settings.

MTU

Enter the MTU (Maximum Transmission Unit) value.

Default: 1500

Acceptable Range: 576 to 1500

MSS

Enter the MSS (Maximum Segment Size).

MSS is the amount of data that can be transmitted in a single TCP packet.

Default: 1460

Acceptable Range: 536 to 146

MAC Address (Available only if IP Assignment selected is Network Adapter (DHCP))

| Configure | 312

Select the method of providing a MAC address to the modem:

Available Options:Use Default MAC AddressOverride Default MAC Address (If you select this option, provide the MAC address.)

| Configure | 313

Figure 315: Other Settings

5. Click Save.

Virtual LAN (VLAN)

VLANs are virtual LANs in which work devices on one or more LANs are logically segregated into independent broadcast domains. The logical segregation allows devices from multiple LANs across different floors or geographical regions to communicate as if they are physically connected. At the same time, a single LAN can be separated into multiple VLANs based on roles, work groups, services, or any other logical parameter.

Although routers are generally used to create broadcast domains in LANs, switches create the VLAN broadcast domains. You can assign each VLAN to one or more ports on a single switch. In case of distributed VLANs, you can assign them across multiple switches. Communication within a VLAN happens through the switch, while communication across different VLANs requires a layer 3 device – a router, a layer 3 switch, or a firewall.

You can implement VLAN technology between a Sophos Firewall (SF) device and 802.1Q-compliant switches and routers. Tag-based LAN multiplexing technology simulates multiple LANs within a single physical LAN and traffic from each broadcast domain is given a different VLAN tag. VLAN IDs/tags are 4-byte frame extensions that contain a VLAN identifier and information specific to your configuration.

SF recognizes VLAN IDs, allowing you to apply firewall rules specific to each VLAN, including authentication and other relevant policies of your network. You can also apply firewall rules to secure the network between broadcast domains.

Advantages

• Increase in the number of ports

• Logical segmentation of network regardless of physical location

• Granular firewall rules specific to workgroups

• Improved network throughput due to the creation of smaller broadcast domains

Add VLAN Interface

1. Go to Configure > Network > Interfaces, click Add Interface on the right side and select Add VLAN from the drop-down list.

2. Enter the VLAN details.

Physical Interface

Select a parent interface for the virtual sub-interface. The virtual sub-interface becomes a member of the selected physical interface.

Zone

Select a zone to assign to the virtual sub-interface. The virtual sub-interface becomes a member of the selected zone which can be LAN, DMZ, WAN, WiFi or a custom zone.

VLAN ID

Enter the VLAN ID. The interface VLAN ID can be any number between 2 and 4094. The VLAN

ID of each virtual sub-interface must match the VLAN ID of the packet. If the IDs do not match, the virtual sub-interface will not receive the VLAN-tagged traffic.

Note: When added to the same physical interface, more than one virtual sub-interface cannot carry the same VLAN ID. However, virtual sub-interfaces carrying the same

VLAN ID can be added to different physical interfaces.

| Configure | 314

Figure 316: VLAN Details

3. Enter the IPv4 configuration details (Only for physical interfaces with IPv4 configuration).

IP Assignment

Select the IP assignment type.

Available Options:

• Static

• PPPoE

• DHCP

IPv4/Netmask

Enter the IPv4 address for the interface and select the network subnet mask.

Preferred IP (available only if IP Assignment selected is PPPoE )

Many Internet service providers assign a static IP address to PPPoE connections. The device allows you to bind the static IP address to the PPPoE connection.

Enter the preferred IP address for the PPPoE connection.

Gateway Detail (For "WA"N zone)

• Static IP Assignment: Specify the Gateway Name and the IPv4 address through which the traffic is to be routed.

• PPPoE IP Assignment: Specify the Gateway Name through which the traffic is to be routed.

• DHCP IP Assignment: Specify the Gateway Name through which the traffic is to be routed.

Figure 317: IPv4 Configuration

4. Enter the details for PPPoE IP Assignment.

Username

Enter the PPPoE account username.

Password

Enter the PPPoE account password.

Access Concentrator/Service Name

Enter the access concentrator and service name.

The device initiates only those sessions with the access concentrator that can provide the specified service.

LCP Echo Interval

Enter the length of time that the system must wait before it sends an echo request to check whether the link is alive. Once an attempt is made, the device waits for the defined time interval before the next attempt is made.

Default: 20 seconds

LCP Failure

Enter the number of attempts (echo requests) to be made. Once the specified number of attempts are made without receiving a response from the client, the device disconnects the PPPoE connection.

Default: 3

Schedule Time For Reconnect

To prevent reconnection during working hours, enable the PPPoE reconnect schedule. You may choose to schedule the PPPoE reconnection on daily or weekly basis at the configured time

(HH:MM).

Default: Disabled

Default schedule when enabled: All days of week

Note: Even when a Preferred IP address has been configured, if Schedule Time For

Reconnect is enabled and configured, on reconnection, an IP address other than the preferred IP address may be assigned to the PPPoE connection.

| Configure | 315

Figure 318: PPPoE Configuration

5. Enter the IPv6 configuration details (Only for physical interfaces with IPv6 configuration)

IP Assignment

Select the IP assignment type.

Available Options:

• Static

• DHCP

Mode (available only if IP Assignment selected is DHCP)

Select DHCP mode.

Administrator can select to configure IPv6 address through Stateful (DHCPv6) or StateLess address assignment methods depending on the Managed (M) Address Configuration and Other (O)

Configuration flags advertised in the Router Advertisement (RA) message .

Available Options:

Auto:If selected, IPv6 address will be configured based on the Router Advertisement packet through Stateless Address Auto-Configuration (SLAAC) or DHCPv6 depending on the

Managed (M) Address Configuration and Other (O) Configuration flags advertised in the Router

Advertisement (RA) message. Manual:Administrator can select to configure IPv6 address either through SLAAC or DHCPv6.

• DHCP Only:In this manual mode, client will configure IPv6 Address and other configuration parameters using DHCPv6 Server. Gateway details should be manually specified.

• Stateless:In this manual mode, client will configure IPv6 Address based on advertised RA message through SLAAC.

• Accept Other Configuration from DHCP: Select to configure other parameters using

DHCPv6 Server. By default, it is enabled.

DHCP Rapid Commit

If enabled, the interface will be configured using a 2-message exchange (Solicit and Reply) rather than the 4-message exchange (Solicit, Advertise, Request, and Reply). It enables quicker client configuration.

Note: Rapid commit should also be enabled on the DHCPv6 server.

IPv6 / Prefix (Only for static IP assignment)

Enter the IPv6 address and the prefix.

Gateway Detail (Only for "WA"N zone)

• For "Static" IP assignment:Specify the gateway name and IPv6 address through which the traffic is to be routed.

• For “DHCP” IP assignment:Specify the gateway name, if Stateless manual mode is selected.

For DHCP only manual mode, specify the gateway name and the IPv6 address.

| Configure | 316

Figure 319: IPv6 Configuration

6. Click Save.

Link Aggregation Group

| Configure | 317

LAG is not supported in Sophos virtual security devices.

Link Aggregation Group (LAG) combines multiple physical links into a single logical link, connecting the SF device to another network device (switch). Also known as trunking, NIC teaming, NIC bonding or Ether Channel, LAG provides redundancy – when one interface fails, the remaining interfaces continue to carry the LAN traffic, ensuring continuity within the network.

LACP

Link Aggregation Control Protocol (LACP) is part of the IEEE specification 802.3ad and provides additional LAG functionality. You can assign load sharing across links based on the algorithm applied in the xmit hash policy. Link aggregation increases the bandwidth available without the need to deploy additional hardware.

The SF device supports the following LAG modes:

• Active Backup: This mode provides automatic link failover. One link (member of the LAG) remains active while the other remains in standby mode. When the active link fails, the standby link becomes active.

• LACP (802.3ad): This mode provides load balancing and automatic failover. In this mode, all the links are used to forward traffic.

Prerequisites for LACP (802.3ad) mode

• For LACP to be functional, it must be enabled at both ends of the link.

• All the member interfaces (ports) in the LAG must be of the same type and have the same interface speed.

• All the links must be full-duplex.

Limitations

• Only unbound static physical interfaces can be members of the LAG.

• PPPoE, 3G, 4G, Cellular WAN, WLAN and Transport mode are not supported in LAG.

• A maximum of 4 ports can be configured on a single LAG interface.

Add Link Aggregation Group (LAG)

1. Go to Configure > Network > Interfaces, click Add Interfaceon the right-hand side and click Add LAG from the drop-down list.

LAG interface properties can be configured or edited from the command line, but a LAG interface cannot be added from CLI.

2. Enter the details for Global Settings.

Interface Name

Enter a name for the LAG interface.

Member Interface

Click Add New Item. The drop-down list displays all unbound ports.

Select the checkbox to select the port(s).

Note:

• At least 2 member ports are required to create a LAG interface.

• A maximum of 4 ports can be configured on a single LAG interface.

• Interfaces that have been configured for PPPoE, Cellular WAN or WLAN cannot participate in LAG.

Mode

Select the mode of LAG.

Available Options:

Active-Backup:Select the Active-Backup mode to provide failover. 802.3ad (LACP):Select the

802.3ad (LACP) mode to load balance the traffic in addition to providing failover.

Network Zone

Select the network zone for the interface.

Available Options:

LAN WAN DMZ WiFi

Figure 320: Global Settings

3. Enter the IPv4 configuration details.

IP Assignment

Select the type of IP assignment.

Available Options:StaticDHCP

IPv4/Netmask

Enter the IPv4 address for the interface and select the network subnet mask.

4. Enter the IPv4 gateway details (Available only if Network Zone selected is WAN)

Gateway Name

Enter the gateway name.

IPv4 Address

Enter the gateway IPv4 address.

Figure 321: IPv4 Configuration - Static

5. Enter the IPv6 configuration details.

IPv6/Prefix

Enter the IPv6 address and the prefix.

6. Enter the IPv6 gateway details (Available only if Network Zone selected is WAN).

Gateway Name

Enter the gateway name.

IPv6 Address

Enter the gateway IPv6 address.

| Configure | 318

Figure 322: IPv6 Configuration

7. Enter the details for Advanced Settings.

Interface Speed

Select the interface speed for synchronization. Interface speed can also be configured through CLI using the set network interface-speed command.

Speed mismatch between the device and third-party routers and switches can result in errors or collisions on the interface, disconnection, traffic latency, or slow performance.

Default: Auto Negotiation

MTU

Enter the MTU (Maximum Transmission Unit) value.

Default: 1500

Acceptable Range (For IPv4 Configuration): 576 to 1500

Acceptable Range (For IPv6 Configuration): 1280 to 1500

Override MSS

Select the checkbox to override the default MSS (Maximum Segment Size).

MSS defines the amount of data that can be transmitted in a single TCP packet.

Default: 1460

Acceptable Range: 536 to 1460

Xmit Hash Policy (Available only if Mode selected is LACP (802.3ad))

Select the Xmit hash policy to be applied to the member interfaces from the available options in the drop-down list:

Available Options:

Layer2:Select to generate the hash value using MAC Addresses. Layer2+3:Select to generate the hash value using a combination of Layer 2 (MAC Address) and Layer 3 (IP Address) protocol information. Layer3+4:Select to generate the hash value using Transport layer protocol information.

Primary Interface (Available only if Mode selected is Active-Backup )

Select an interface to be the primary interface. This interface remains active as long as it is available.

Default: Auto

The interfaces included in the member interface list are listed here. If you set the Primary Interface to Auto, the device selects any interface from the member interface list as the primary interface.

Use Default MAC Address

| Configure | 319

Click to use the default MAC address of the interface.

Override Default MAC Address

Click to override the default MAC address of the interface and enter the new MAC address.

On factory reset, it will be set to the default MAC address.

| Configure | 320

Figure 323: Advanced Settings

8. Click Save.

Add RED

This page allows you to configure a Remote Ethernet Device (RED) at a remote office.

1. Ensure that RED is activated. This can be done from Configure > System Services > RED.

2. Go to Configure > Network, click Add Interface on the upper right and select Add RED from the drop-down list.

3. Enter the RED Settings details.

Branch Name

Enter the name for the remote location in which the RED is to be set up.

Type

Select the RED device to be connected from the drop-down list.

• RED 10

• RED 15

• RED 15w

• RED 50

• Firewall RED Server

• Firewall RED Client

• Firewall RED Server Legacy

• Firewall RED Client Legacy

Note: RED device Firewall RED Server Legacy and Firewall RED Client Legacy are able to connect Sophos XG Firewall with Sophos UTM via RED Site2Site. For more information, see

RED Site-to-Site between Sophos XG Firewall and Sophos

UTM

on page 327.

RED ID (not available for Type Firewall RED Server, Firewall RED Server Legacy, Firewall RED Client

and Firewall RED Client Legacy)

Enter the RED ID.

The RED ID is a 15-character string printed on the sticker which is stuck to the bottom of the RED device as well as on the front of the carton.

Tunnel ID (not available if Type is Firewall RED Client and Firewall RED Client Legacy)

Select the Tunnel ID from the drop-down list.

By default, Automatic is selected. Tunnels are numbered consecutively. Select a unique tunnel ID and make sure that it is the same for both the devices - RED and Sophos XG Firewall.

Note: If the type is Firewall RED Server Legacy or Firewall RED Server Legacy make sure that the tunnel ID is available on the appliance that should be connected.

Unlock Code

Enter the unlock code. (Do not fill this field if this RED is being deployed for the first time.)

The unlock code is an 8-character string that is generated when a RED is added to a Sophos XG

Firewall. If this RED has been deployed before, you must enter the unlock code here. The unlock code is generated during the deployment of a RED device, and is emailed instantly to the address you provided by activating RED. This is a security feature, which ensures that a RED device cannot simply be removed and installed elsewhere.

For manual deployment through USB stick and for automatic deployment through Provisioning

Service (see

Device Deployment

below), two separate unlock codes are generated. If you switch a

RED device from one deployment method to the other, make sure that you use the corresponding unlock code: For manual deployment, provide the unlock code of the previous manual deployment; for automatic deployment, provide the unlock code of the previous automatic deployment.

Firewall IP/Hostname (not available for Type Firewall RED Server and Firewall RED Server Legacy)

Enter the hostname of the Sophos XG Firewall.

The hostname must be a publicly resolvable DNS name or IP address for the Sophos XG Firewall.

The RED will use this name or the IP address to connect back to the Sophos XG Firewall.

2nd Firewall IP/Hostname (not available if client Type is RED 10)

Specify the hostname of the second Sophos XG Firewall.

Use 2nd IP/Hostname for (not available if client Type is RED 10)

Select from the following options:

• Failover: Ensures that the secondary Sophos XG Firewall takes over when the primary Sophos

XG Firewall fails. The secondary host takes over automatically without loss of connection.

• Load Balancing: Distributes traffic equally between, the primary and the secondary Sophos XG

Firewall.

Provisioning File (available only if Type is Firewall RED Client or Firewall RED Client Legacy)

To provide the configuration data to the remote client device. Upload the provisioning file using the

Browse button and transfer the file to the remote device.

Description

Enter a description for the RED interface.

Device deployment

Select the deployment method:

• Automatically via Provisioning Service

• Manually via USB Stick

Note: If you select manual deployment, it is extremely important to retain the unlock code, which is sent by email. If you lose the unlock code, you can never connect the RED device again to another Sophos XG Firewall and you have to contact the Sophos Support.

By default, Sophos XG Firewall provides the RED's configuration data automatically via Sophos'

RED Provisioning Service. In this case, the RED device receives its configuration via Internet.

If the RED does not have an Internet connection, you can provide the configuration manually,

| Configure | 321

via USB stick. If you deploy a RED device manually, you have to ensure that the Sophos XG

Firewall is acting as NTP server. Activate the NTP on the Sophos XG Firewall under System >

Administration > Time and allow the correct network or the IP address of the RED.

| Configure | 322

Figure 324: Add RED Interface

4. Enter the details for Uplink Settings.

Uplink Connection

Select the connection type for the uplink:

• DHCP: The RED pulls an IP address from a DHCP server.

• Static: Enter an IP address, the corresponding netmask, a gateway and a DNS server IP address.

2nd Uplink Connection (available only if client Type is RED 50 is selected)

Select the connection type for the uplink:

• DHCP: The RED pulls an IP address from a DHCP server.

• Static: Enter an IP address, a corresponding netmask, gateway and DNS server IP address.

2nd Uplink Mode (available only if client Type is RED 50)

Select an uplink mode for the 2nd host.

• Failover

• Load Balancing

3G/UMTS Failover (not available if Operation Mode is Transparent/Split)

Select to enable the 3G/UMTS failover function. Clear the check box to disable the function.

Note: Plug in a 3G/UMTS USB stick into the RED's USB port. The stick can provide

Internet uplink failover in case of WAN interface failure. For the necessary settings refer to your Internet provider's data sheet.

• Mobile Network: Select the mobile network type from the drop-down list.

• GSM

• CDMA

• Username/Password (available only if CDMA is selected): If required, specify a username and password for the mobile network.

• PIN (available only if GSM is selected): Specify the PIN of the SIM card if a PIN is configured.

Note: If you specify a wrong PIN, the connection cannot be established through

3G/UMTS in case of WAN interface failure. Instead, the 3G/UMTS Failover

checkbox of the RED device is automatically cleared. Thus, the wrong PIN is used only once. When the WAN interface comes up again, the RED device displays a warning: A wrong PIN was entered for 3G/UMTS failover uplink. Please change

the login data.. When you open the Edit RED dialog box, a message is displayed which tells you that the 3G/UMTS failover was automatically unselected. Enter the correct PIN and select the checkbox. After making three connection attempts with a wrong PIN, the SIM card is locked. It cannot be unlocking through the RED device or Sophos XG Firewall and you have to contact the Sophos support.

• APN (available only if GSM is selected): Enter your provider's access point name information.

• Dial String : If your provider uses a different dial string, enter it here.

Default for GSM: *99#

Default for CDMA: #777

| Configure | 323

Figure 325: RED Uplink Settings

5. Specify the RED Network Settings details.

RED Operation Mode

Select to define how the remote network is to be integrated into your local network:

• Standard/Unified: All the remote network traffic is routed through the Sophos XG Firewall which serves as the DHCP server and as the default gateway too. Sophos XG Firewall has complete control over the network traffic of the remote network. It can apply firewall rules to traffic between the local and remote LANs as well as filter web traffic and applications of the remote network.

Note: Handle VLAN traffic through this mode if VLAN is deployed behind the

RED.

• Standard/Split: Only traffic to select local networks is routed through the Sophos XG Firewall.

Select the local networks from the drop-down list in the Split Network box or create new networks which can be accessed by the RED. Sophos XG Firewall controls the traffic to these networks from the remote network. It also serves as the DHCP server and as the default gateway.

All other remote network traffic is sent directly out through the local Internet connection.

Note: VLAN tagged frames cannot be handled in this operation mode. To use a

VLAN behind your RED device, select the Standard/Unified operation mode.

• Transparent/Split (not available if 3G/UMTS Failover is selected): Sophos XG Firewall does not control network traffic of the remote network, nor does it serve as the DHCP server nor as the default gateway. On the contrary, it pulls an IP address of the remote network from the DHCP server to become part of that network. However, you can enable access to the local network for remote clients. Define split networks that can be accessed by the remote network.

Additionally, you can define one or more split domains to be accessible. If your local domains are not publicly resolvable, define a Split DNS Server, which can be queried by the remote clients.

Note: VLAN tagged frames cannot be handled in this operation mode. To use a VLAN behind your RED device, select the Standard/Unified operation mode instead.

RED IP (not available if Transparent/Split is selected)

Enter the IP address of the RED device.

RED Netmask (not available if Transparent/Split is selected)

Select the netmask from the drop-down list.

Zone

Select the zone from the drop-down list:

• LAN

• DMZ

• VPN

• WiFi

Configure DHCP

Enable to configure a DHCP range for RED.

RED DHCP Range (available only if Configure DHCP is selected)

Enter the DHCP range which the RED is allowed to use.

Split DNS Server (available only if Transparent/Split is selected)

If your local domains are not publicly resolvable, you need to define a Split DNS Server, which can be queried by remote clients.

Split Network (not available if Standard/Unified is selected)

Select the split networks from the drop-down list or add more networks.

Note: Traffic to the networks listed in the Split Network box is redirected to your

Sophos XG Firewall. The remaining traffic is directly routed to the Internet.

To check traffic from the branch office to the main office intranet for viruses, route it through the Sophos XG Firewall. Or use the Sophos XG Firewall as an HTTP proxy.

Split Domains (not available if Transparent/Split is selected)

Add one or more split domains.

Note: Since Sophos XG Firewall is only a client of the remote network, it is not possible to route traffic to the split networks the way it is done with the other modes.

Therefore, the RED device intercepts all traffic: Traffic targeting to a network listed in the Split Network box or going to a domain listed in the Split Domain box is redirected to the Sophos XG Firewall interface. This is accomplished by replacing the default gateway's MAC address in the respective data packets with the MAC address of Sophos XG Firewall.

Example: A partner or service provider requires access to your intranet or a certain server in your local network. Using a RED device the partner's network remains completely independent of your network, but they can access a defined part of your network for certain purposes, as if they were connected via LAN.

MAC Filtering Type

To restrict the MAC addresses allowed to connect to the RED device select Blacklist or Whitelist.

Whitelist: Only MAC addresses listed in the MAC Address list are allowed.

Blacklist, MAC addresses listed in the MAC address list are not allowed.

MAC Address: The list of MAC addresses used to allow or restrict access to the RED device. MAC address lists can be created on the System > Hosts and Services > MAC Host page.

Note: MAC filtering only works for RED rev. 2 or newer. For RED 10, a maximum of 200 MAC addresses is allowed, whereas for RED 50, the list may contain up to 400

MAC addresses.

Tunnel Compression

Select to compress all traffic sent through the RED tunnel. Data compression can increase the throughput of the RED device deployed in regions with very slow Internet connection such as

1-2 MBps. However, performance increase depends on the data's potential to be compressed (for

| Configure | 324

example, data that is already compressed such as HTTPS or SSH cannot be compressed further). In some circumstances enabling data compression can actually reduce throughput of the RED device.

In such case, disable data compression.

Note: Tunnel compression is not available for RED 10 rev.1.

| Configure | 325

Figure 326: RED Network Settings

6. Enter the details of Switch Settings (available only if client Type is RED 50).

Switchport Mode

RED 50 offers four LAN ports that can be configured either as simple switches or for intelligent

VLAN usage. When set to Switch, all the traffic is sent to all ports. When set to VLAN, traffic can be filtered according to the Ethernet frames' VLAN tag, thus allowing the tunneling of more than one network into the RED tunnel.

Select the switchport mode for the switch settings

• Switch: RED 50 uses the switch by default.

• VLAN: Select the LAN port(s) and enter the LAN VID(s).

When using the VLAN switch port configuration, you can configure each LAN port separately. For each LAN port, the following options are available:

• Untagged (Hybrid Port): Ethernet frames with the VLAN IDs specified in the LAN VID(s) field below will be sent to this port. The frames are sent without tags, thus the end devices do not have to support VLAN. This port allows just one VLAN ID.

• Untagged, drop tagged (Access port): Ethernet frames with the VLAN IDs specified in the

LAN VID(s) field below will not be sent to this port. The frames are sent without tags, thus the end devices do not have to support VLAN.

• Tagged (Trunk Port): Ethernet frames with the VLAN IDs specified in the LAN VID(s) field below will be sent to this port. The frames are sent with tags, and the end devices have to support VLAN. Frames without VLAN IDs will not be sent to this port. This port allows up to

64 different VLAN ID(s) separated by comma.

• Disabled: This port is closed. No frames with or without VLAN IDs specified in the LAN

VID(s) will be sent to this port.

7. Click Save.

Note: If the message "Registering with RED service failed. Please make sure that this device can connect to the Internet on port 3400" appears, a network problem has occurred. Check if you can reach

| Configure | 326 red.astaro.com through port 3400 (via console command telnet red.astaro.com 3400). If you can, the error could be due to high network load. Retry to connect later.

Related tasks

Configure RED

on page 455

This page describes how to configure RED.

Related information

RED Supported 3G/4G/LTE USB Dongles

Manage RED Interface

This chapter describes the functions of the icon of RED interfaces on the Configure > Network > Interfaces page.

The following options are available:

Activate/deactivate

The toggle switch next to the branch name shows the status of the interface. Click it to turn it on/off.

Note: The RED interface is deactivated and can not be edited if the RED device is bound to another system.

Download Provisioning file

This option is available only if the RED interface is in offline provisioning mode (if Device Deployment is set to

Manually via USB Stick).

Clicking on the link will download the provisioning file for the RED device. Save the file to the root directory of a USB stick. Then plug the USB stick into the RED appliance before turning it on. The RED will fetch its configuration from the USB stick. After that the connection between your appliance and the RED appliance is going to be established.

Note: It is crucial that you keep the unlock code, which is emailed instantly to the address provided on the

RED Configuration page as soon as the RED appliance receives its configuration. (In case of switching between manual and automatic deployment, make sure to keep both unlock codes.) You need the unlock code when you want to use the RED appliance with another Sophos XG Firewall. If you then do not have the unlock code ready, the only way to unlock the RED appliance is to contact the Sophos Support. The Support however can only help you if you deployed the configuration automatically, via the RED Provisioning

Service.

3G/UMTS Failover

Displays if the 3G/UMTS Failover function is enabled or disabled.

Configure RED Site-to-Site Tunnel

This page describes how to set up a RED Site-to-Site Tunnel.

For such a connection, you need a RED server and a RED client. RED Site-toSite connection is also possible between

Sophos XG Firewall and Sophos UTM using the RED server legacy and RED client legacy. For more information,

see

RED Site-to-Site between Sophos XG Firewall and Sophos UTM

on page 327.

1. Configure the Firewall RED Server on the server machine.

How to configure RED is described in chapter

Configure RED

on page 455.

2. Add a RED interface on the Interfaces page.

How to add a RED interface is described in chapter

Add RED

on page 320.

3. Go to Configure > Network > Interfaces.

On the required RED interface, click the icon towards the right and select Download Provisioning File.

| Configure | 327

5. Configure the Firewall RED Client on the client machine and upload the provisioning file you downloaded from the server machine.

The RED Site-to-Site tunnel has been established and is active. You can control the RED connection status on both machines in the Network Security Control Center in the section User Threat Quotient.

RED Site-to-Site between Sophos XG Firewall and Sophos UTM

RED Site-toSite connection is also possible between Sophos XG Firewall and Sophos UTM. Select interface type

RED Server Legacy if you want to use Sophos XG Firewall as a RED firewall server for a Sophos UTM client. The provisioning file needs to be uploaded in the Sophos UTM client management. When you use Sophos UTM as RED firewall you need to upload the provisioning file from the Sophos UTM in a Sophos XG Firewall interface with type

RED Client Legacy.

Sophos XG Firewall as RED Firewall server

This page describes how to set up a RED Site-to-Site Tunnel between Sophos XG Firewall as RED firewall server legacy and Sophos UTM as RED client.

1. Ensure that RED on Sophos XG Firewall is activated. This can be done from Configure > System Services >

RED.

2. Go to Configure > Network, click Add Interface on the upper right and select Add RED from the drop-down list.

3. Create a RED interface with type RED Firewall Server Legacy.

How to create a RED interface is described in chapter

Add RED

on page 320.

4. Download the provisioning file.

5. Log in to Sophos UTM.

6. Ensure that RED on Sophos UTM is activated. This can be done from RED Management > Global Settings.

7. Go to RED Management > [Client] Tunnel Management, click New Tunnel.

8. Create a tunnel and upload the provisioning file from Sophos XG Firewall.

How to create a tunnel is described in

Sophos UTM Administration Guide

(Chapter 15.5 Tunnel Management).

9. Go to Interface & Routing > Interfaces, click New Interface.

10. Create a interface with the RED tunnel.

How to create a RED interface is described in

Sophos UTM Administration Guide

(Chapter 6.1 Interfaces).

The Site-to-Site connection between Sophos XG Firewall and Sophos UTM is now activated and can be seen in SF-

OS under Configure > Network > Interfaces and in the Control Center.

Sophos UTM as RED Firewall Server

This page describes how to set up a RED Site-to-Site Tunnel between Sophos UTM as RED firewall server and

Sophos XG Firewall as RED client legacy.

1. Ensure that RED on Sophos UTM is activated. This can be done from RED Management > Global Settings.

2. Go to RED Management > [Server] Client Management, click New RED.

3. Create a RED.

How to create a RED is described in

Sophos UTM Administration Guide

(Chapter 15.3 Client Management).

4. Download the provisioning file.

5. Go to Interface & Routing > Interfaces, click New Interface.

6. Create an interface with the RED server.

How to create a RED interface in Sophos UTM is described in

Sophos UTM Administration Guide

(Chapter 6.1

Interfaces).

7. Ensure that RED on Sophos XG Firewall is activated. This can be done from Configure > System Services >

RED.

8. Go to Configure > Network, click Add Interface on the upper right and select Add RED from the drop-down list.

Network

Interfaces

Свързани

Sophos XG Firewall User Guide

Swisscom Huawei Router B593s-22 Instructions

Sophos XG Firewall v16.5 Command Reference Guide

Cyberoam Web Filter Policy Manual: AI Chat & PDF

Sophos Email Appliance User Manual | AI Chat & PDF Access

Kramer Panels User Manual + AI Chat & PDF Download

Kramer Panels User Manual: AI Chat & PDF Access

Vodafone Email Client User Manual: AI Chat & PDF Access

PACE V5542 Modem Firmware Update Instructions

Sophos Group Level Web Interface Guide

VPN Client Windows 7 How To

Cyberoam Firewalls User Manual | AI Chat & PDF Access