| Configure | 456
Force TLS 1.2
This page describes how to force TLS 1.2.
For security reasons it is recommended to force the RED device to use only TLS 1.2. This option is disabled by default to ensure that new RED devices can connect to the Firewall and first have a firmware updgrade to support
TLS 1.2.
Note: If you want to add new RED devices, first disable TLS to ensure that the RED devices are able to connect to the Firewall.
1. Ensure that RED is enabled.
2. In the Force TLS 1.2 area select Enable.
3. Click Apply.
Automatic Device Deauthorization
This page describes how to deauthorize a RED device.
When RED is enabled, you can specify if disconnected RED devices should automatically be deauthorized after a certain time span. With this feature, you can prevent stolen RED devices from connecting to Sophos XG Firewall.
Note: The Automatic Device Deauthorization does not work for a RED tunnel between 2 Sophos XG
Firewall devices.
1. Ensure that RED is activated.
2. Select Enable next to Automatic Device Deauthorization.
3. Enter a time span for Deauthorize After.
4. Click Apply.
Automatic Device Deauthorization will now be successfully configured.
When a RED device reconnects after being disconnected for a time span longer than the defined time span, it will automatically be disabled.
Disable RED
This page describes how to disable RED.
Disabling RED will not cause the deletion of the REDs. If you disable the RED functionality, RED devices will be deactivated and lose their connection. If you re-enable the RED functionality, the REDs will be activated again.
1. Click the toggle switch of the RED Status.
2. Confirm deactivation by clicking on the Confirm removal of RED configuration button.
RED is now deactivated. All RED devices will be disconnected.
Log Settings
Device provides extensive logging capabilities for traffic, system and network protection functions. Detailed log information and reports provide historical as well as current analysis of network activity to help identify security issues and reduce network abuse. To view logs, relevant modules must be subscribed.
Device can log many different network activities and traffic including:
• Firewall Rules log
• Anti Virus infection and blocking
• Web filtering, URL and HTTP content blocking
• Signature and anomaly attack and prevention
• Spam filtering
• Administrator logs
• User Authentication logs
• SSL VPN logs
• Web Server Protection logs
| Configure | 457
• Advanced Threat Protection logs
• Heartbeat logs
Device can either store logs locally or send logs to external syslog servers for storage and archival purposes. Traffic
Discovery logs can be stored locally only.
Syslog is an industry standard protocol/method for collecting and forwarding Logs from devices to a server running a syslog daemon usually via UDP Port 514. Logging to a central syslog server helps in aggregation of logs and alerts.
If configured, device sends a detailed log to an external syslog server in addition to the standard event log. Device
Syslog support requires an external server running a syslog daemon on any of the UDP Port. When configuring logging to a syslog server, one needs to configure the facility, severity and log file format. One can also specify logging location if multiple syslog servers are defined.
Device logs all activity and includes every connection source and destination IP Address (IPv4 / IPv6), IP service, and number of bytes transferred.
A Syslog service simply accepts messages, and store them in files or prints. This form of logging is the best as it provides a central logging facility and a protected long-term storage for logs. This is useful both in routine troubleshooting and in incident handling.
Use this page to configure below settings:
• Syslog Servers - Configure Syslog server for logs storage and archival purposes.
• Log Settings - Configure logs to be sent to the Syslog server.
Syslog Servers
The Syslog Servers section displays list of configured syslog servers. You can sort the list based on server name. The page also provides option to add, update, or delete the server.
Log Settings
After configuring syslog server, configure logs to be sent to the syslog server by selecting checkbox against the log under Syslog. If multiple syslog servers are configured, you can send various logs on different servers.
To record logs you must enable the respective log and specify logging location. Administrator can choose between
On-Device (local) logging or Syslog logging. Administrator can also disable logging temporarily. Below are the different log types with their description:
Firewall
Firewall Log records following events:
• Firewall Rules
Log records the entire traffic for Firewall.
• Invalid Traffic
Log records the dropped traffic that does not follow the protocol standards, invalid fragmented traffic and the traffic whose packets or device is not able to relate to any connection.
• Local ACLs
Log records the entire (allowed and dropped) incoming traffic.
• DoS Attack
The DoS Attack Log records attacks detected and prevented by the device i.e. dropped TCP, UDP and ICMP packets.
To generate logs, go to System > System Services > DoS & Spoof Protection and click Apply Flag against SYN
Flood, UDP Flood, TCP Flood, and ICMP/ICMPv6 Flood individually.
• Dropped ICMP Redirected Packet
Log records all the dropped ICMP redirect packets.
| Configure | 458
To generate log, go to System > System Services > DoS & Spoof Protection and click Apply Flag against
Disable ICMP/ICMPv6 Redirect Packet.
• Dropped Source Routed Packet
Log records all the dropped source routed packets.
To generate log, go to System > System Services > DoS & Spoof Protection and click Apply Flag against Drop
Source Routed Packets.
• Dropped Fragmented Traffic
Log records the dropped fragmented traffic.
• MAC Filtering
Log records the dropped packets when filtering is enabled from Spoof prevention.
• IP-MAC Pair Filtering
Log records the dropped packets when filtering is enabled from Spoof prevention.
• IP Spoof Prevention
Log records the dropped packets when filtering is enabled from Spoof prevention.
• SSL VPN Tunnel
Log records of SSL VPN traffic.
• Protected Application Server
Log records of protected application server traffic.
• Heartbeat
Log records of Heartbeat traffic.
• ICMP Error Message
Log records of ICMP error messages such as network/host/port unreachable, destination network/host unknown and so on.
Figure 421: Firewall Rule
IPS
Records detected and dropped attacks based on unknown or suspicious patterns (anomaly) and signatures.
Figure 422: IPS
Anti Virus
Virus detected in HTTP, SMTP, FTP, POP3, IMAP4, HTTPS, SMTPS, IMAPS and POPS traffic.
| Configure | 459
Figure 423: Anti-Virus
Anti Spam
SMTP, POP3, IMAP4, SMTPS, POPS, IMAPS spam and probable spam mails.
Figure 424: Anti-Spam
Content Filtering
Web filtering and Application Filtering logs.
Log records of the name of applications/URLs accessed and their categories.
Note:
To view the logs:
• Web Filter and Application Filter Policies should be applied in Firewall Rule.
• Log Firewall Traffic under Firewall page should be enabled.
Figure 425: Content Filtering
Events
Admin Events: Log records of configurations done through Admin Console.
Authentication Events: Log records of all authentication related events.
System Events: Log records of all system related events like Gateway Up/Down, Anti Virus updates etc.
| Configure | 460
Figure 426: Events
Web Server Protection
Web Server Protection Events.
Note: Web Server Protection logs are not available in CR10iNG, CR15i, CR15wi, CR15iNG, CR15wiNG,
CR25ia, CR25wi, CR35ia and CR35wi Sophos Devices.
Figure 427: Web Server Protection
Advanced Threat Protection
ATP Events: Log records of drop or alert event.
Figure 428: Advanced Threat Protection
Wireless
Access Points & SSID: Log records of the connected APs and SSID.
Figure 429: Wireless
Heartbeat
Endpoint Status: Log records of the health status of the endpoint.
Figure 430: Heartbeat
System Health
Usage: Log records of CPU usage, memory usage, no. of live users, interface and disk partition information.
Figure 431: System Health
Sandstorm
Sandstorm Event: Log records of all Sandstorm events.
Figure 432: Sandstorm
Add Syslog Server
This page describes how to add a syslog server.
1. Go to Configure > System Services > Log Settingsand click Add under the Syslog Servers section.
2. Enter server details.
Name
Enter a unique name for the syslog server.
IP Address / Domain
Specify the IP address (IPv4 / IPv6) or domain name of the syslog server. Logs from the device will be sent to the server.
Port
Specify the port number for communication with the syslog server. The device will send logs using the configured port.
Facility
Select syslog facility for logs to be sent to the syslog server.
Facility indicates to the syslog server the source of a log such as operating system, the process or an application. It is defined by the syslog protocol.
The device supports several syslog facilities for received log.
Available Options:DAEMON
Daemon logs (information of services running in device as daemon).
KERNEL
Kernel log
LOCAL0 - LOCAL7
Log level information.
USER
Logging based on users who are connected to the server.
Severity Level
Specify severity levels of logs.
Severity level is the severity of the log that has been generated.
The device logs all the messages at and above the logging severity level you select. For example, select ERROR to log all messages tagged as ERROR, as well as any messages tagged with
CRITICAL, ALERT and EMERGENCY and select DEBUG to log all messages.
The device supports following severity levels:EMERGENCY - System is not usableALERT
- Action must be taken immediatelyCRITCAL - Critical conditionERROR - Error conditionWARNING - Warning conditionNOTIFICATION - Normal but significant conditionINFORMATION - InformationalDEBUG - Debug level messages.
Format
The device produces logs in the specified format. The device currently produces logs in device standard format.
| Configure | 461
