Figure 35: Add Profile
3. Click Save.
Hosts and Services
Sophos XG Firewall | System | 63
Sophos XG Firewall | System | 64
Hosts and Services allows defining and managing system hosts and services.
This section covers the following topics:
•
IP Host
- The page displays the list of all dynamic and default hosts. The page also provides options to add a new
host, update the existing host, or delete a host.
•
IP Host Group
- Host Group is a grouping of hosts. Security Policies can be created for the individual host or host groups. This page displays the list of all the host groups. It also provides options to manage these host groups.
•
MAC Host
- Device allows creating a host based on MAC Address. One can create a MAC Host of either a single
MAC Address or multiple MAC Addresses. This page displays the list of all the available MAC host. The page also provides option to add a new MAC host, update the existing host, or delete a host.
•
FQDN Host
- This page displays the list of all the available FQDN host.
•
FQDN Host Group
- FQDN Host Group is a grouping of FQDN hosts. This page displays the list of all the
available FQDN host groups.
•
Country Group
- Country Group is a grouping of Countries. Multiple countries can be selected to block or allow incoming traffic by using Country Group. This page displays the list of all the available Country groups.
•
Services
- You can use services to determine the types of traffic allowed or denied by the firewall. This page
displays the list of all the default and custom services. It also provides options to manage services.
•
Service Group
- Service Group is a grouping of services. Custom and default services can be grouped in a single group. The page displays the list of all the default and custom groups.
IP Host
The IP Host page displays the list of all the dynamic hosts, default hosts and manually added hosts.
Hosts allow the entities to be defined once, which can be re-used in multiple referential instances throughout the configuration. For example, consider an internal Mail Server with an IP Address 192.168.1.15. Rather than repeated use of the IP Address while configuring Security Policies or NAT Policies, it allows to create a single entity Internal
Mail Server as a Host name with an IP Address 192.168.1.15. This host, Internal Mail Server can then be selected in any configuration that uses Host as a defining criterion.
By using host name instead of numerical address, you only need to make changes in a single location, rather than in each configuration where the IP Address appears.
Using Hosts, reduces the error of entering incorrect IP Addresses, makes it easier to change IP Addresses, and increases readability.
You can group multiple entities performing the same function within a single hostname.
The IP Host page displays the list of all the dynamic hosts which are automatically added on creation of VPN Remote access connections (IPsec and SSL) and the default hosts (IPv6 and IPv4) for remote access connection - ##ALL_RW,
##WWAN1, ##ALL_IPSEC_RW and ##ALL_SSLVPN_RW along the manually added hosts. The page also provides option to add a new host, update the existing host, or delete a host.
Note:
• System hosts cannot be updated or deleted.
• Dynamic hosts which are automatically added on creation of VPN Remote Access connections cannot be deleted.
• Default hosts (IPv6 and IPv4) for remote access connection - ##ALL_RW, ##WWAN1,
##ALL_IPSEC_RW and ##ALL_SSLVPN_RW cannot be updated or deleted.
Add IP Host
Add IP Host allows you to assign a hostname to a network, IP address, range or list.
1. Go to System > Hosts and Services > IP Host and click Add.
2. Enter the hostname.
3. Select the IP Family.
Available Options:
Sophos XG Firewall | System | 65
• IPv4
• IPv6
4. Select the host Type.
Available Options:
• IP
• Network
• IP Range
• IP List (IP addresses which belong to different networks or are not within a range.)
5. If the selected host type is IP, Network or IP Range:
1. Enter the IP address, subnet or range based on the host type.
2. Select an IP Host Group or create a new one.
Note: A single host can be the member of multiple host groups. A host group cannot include both IPv4 and IPv6 hosts.
6. If the selected host type is IP List, enter the List of IP Addresses.
Note: Only Class B IP addresses can be added to an IP list. You can add or remove an IP address from the
IP list.
Figure 36: Add IP Host
7. Click Save.
IP Host Group
The IP Host Grouppage displays the list of all the host groups.
Host Group is a grouping of hosts. Security policies can be created for the individual host or host groups.
Note: Dynamic host groups which are automatically added on creation of VPN Remote Access Connections cannot be deleted.
The page also provides option to add a new host group, update the parameters of the existing host group, add members to the existing host group, or delete a host group.
Add a IP Host Group
The Add IP Host Group page allows you to configure an IP host group.
1. Go to System > Hosts and Services > IP Host Group and click Add.
2. Enter IP host group details.
Name
Sophos XG Firewall | System | 66
Enter a name to identify the IP host group.
Description
Enter a description for the IP host group.
IP Family
Select the type of IP family from the options available:
Available Options:
• IPv4
• IPv6
Select Host
The host list displays all the hosts including default hosts. Click the corresponding checkbox(es) to select the host(s). A single host can be a member of multiple host groups. A group with IPv4 and
IPv6 hosts cannot be created.
Figure 37: Add IP Host Group
3. Click Save.
The IP host group has been created and appears on the IP Host Group page.
MAC Host
The device allows you to assign a hostname to one or more MAC addresses.
Add a MAC Host
The Add MAC Host page allows you to manually create a MAC Host of either a single MAC Address or multiple
MAC Addresses.
1. Go to System > Hosts and Services > MAC Host and click Add.
2. Enter MAC Host details.
Name
Enter a name to identify a MAC Host.
Type
Select the MAC Host Type.
Available Options:MAC Address - Select to add a single MAC Address.MAC List - Select to add multiple MAC Addresses.
Sophos XG Firewall | System | 67
MAC Address (Applicable only if Type is selected as MAC Address)
Specify MAC Address based on the Host Type selected in the form of 00:16:76:49:33:CE or
00-16-76-49-33-CE.
List of MAC Addresses (Applicable only if Type is selected as MAC List)
Specify MAC Address based on the Host Type selected in the form of 00:16:76:49:33:CE or
00-16-76-49-33-CE.
Use comma to configure multiple MAC Addresses.
Figure 38: Add MAC Host
3. Click Save.
The MAC Host has been created and appears on the MAC Host page.
FQDN Host
The FQDN Host page displays the list of all the available FQDN host.
FQDN (Fully Qualified Domain Name) Hosts allow entities to be defined once and be re-used in multiple referential instances throughout the configuration. For example,
www.example.com
has an IP Address as 192.168.1.15.
Rather than remembering the IP Address of the intended website while accessing it, you can simply provide
www.example.com
in the browser. The FQDN
www.example.com
will now be mapped to its respective IP Address, and the intended webpage opens.
The page also provides option to add a new FQDN host, update the existing host, or delete a host.
Add an FQDN Host
Use the Add FQDN Host page to create a new Fully Qualified Domain Name (FQDN) host.
The Add FQDN Host page allows you to manually configure a new FQDN host.
1. Go to System > Hosts and Services > FQDN Host and click Add.
2. Enter FQDN host details.
Name
Specify a name to identify the FQDN host.
FQDN
Specify an FQDN address. You can also specify a Wildcard FQDN by adding the prefix *.
FQDN Host Group
Select an FQDN host group or add a new one. A single FQDN host can be member of multiple host groups. You can add a new FQDN host group on this page or on the System > Hosts and
Services > FQDN Host Group page.
Sophos XG Firewall | System | 68
Figure 39: Add FQDN Host
3. Click Save.
FQDN Host Group
FQDN Host Group allows you to add individual FQDN hosts to one or more host groups.
Add FQDN Host Group
The Add FQDN Host Group page allows you to configure a new FQDN host group.
1. Go to System > Hosts and Services > FQDN Host Group and select Add.
2. Enter FQDN host group details.
Name
Enter a name to identify the FQDN host group.
Description
Enter a description for the FQDN host group.
Select Host
The host list displays all the hosts including default hosts. Click the corresponding checkbox(es) to select the host(s). A single host can be a member of multiple host groups.
Figure 40: Add FQDN Host Group
3. Click Save.
Country Group
Sophos XG Firewall | System | 69
The device offers predefined country groups based on their continent. It also offers the list of countries which appears when you create a firewall rule. You can create custom country groups.
Note: On factory reset, the device resets to predefined country groups.
Note: You can edit or delete predefined and custom country groups.
Add a Country Group
The Add Country Group page allows you to manually configure parameters to add a new country group.
1. Go to System > Hosts and Services > Country Group and click Add.
2. Enter Country Group details.
Name
Enter a name to identify the Country group.
Description
Country Group description.
Select Country
Click Add New Item to select and add countries in the group.
A country can be a member of multiple country groups.
Figure 41: Add Country Group
3. Click Save.
Services
The Services page displays the list of all the default and custom services.
Services are definitions of certain types of network traffic and combine information about a protocol such as TCP,
ICMP or UDP as well as protocol-related options such as port numbers. You can use services to determine the types of traffic allowed or denied by the firewall.
Certain well-known traffic types have been predefined in services. These predefined services are defaults, and cannot be updated or deleted. If you require service definitions that are different from the predefined services, you can add them as custom services.
The page also provides option to add a new service, update the parameters of the existing service, or delete a service.
Note:
• Service used by Security Policies cannot be deleted.
• Default Services can neither be updated nor deleted.
Sophos XG Firewall | System | 70
Add Service
The Add Service page allows you to manually configure parameters to add a new Service.
1. Go to System > Hosts and Services > Services and click Add.
2. Enter Service parameters.
Name
Enter a name to identify the Service.
Type
Select a protocol for the service.
Available Options:TCP/UDP - Enter Source and Destination port. You can enter multiple ports for the same service.IP - Select Protocol Number for the Service. You can select multiple ports for the same service.ICMP - Select ICMP Type and Code. You can enter multiple types and codes for the same service. Use Add icon and Remove icon to add and delete the parameters respectively.
ICMPv6 - Select ICMPv6 Type and Code. You can enter multiple types and codes for the same service.
Use Add and Remove to add and delete the parameters.
Figure 42: Add Service
3. Click Save.
Service Group
The Service Group page displays the list of all the default and custom service groups.
Service Group is a grouping of services. Custom and default services can be grouped in a single group.
Use to configure Security Policies to:
• block group of services for specific zone
• limit some or all users from accessing group of services
• allow only specific user to communicate using group of service
Create groups of services and then add one firewall to allow or block access for all the services in the group. A service group can contain default services as well as custom services in any combination. A single service can be a member of multiple service groups.
The page also provides option to add a new group, update the parameters of the existing group, add members to the existing group, or delete a group.
Note:
• Default Service Groups can neither be updated nor deleted.
• Service Group used by the Security Policies cannot be deleted.
Add a Service Group
Use the Add Service Group page to add a new customized Service Group.
The Add Service Group page allows you to manually enter details and configure a new service group.
