Sophos XG Firewall | System | 90
Update Default CA
Edit Default CA Parameters allows you to edit the default certificate authority details.
1. Go to System > Certificates > Certificate Authorities.
2.
Go to the Manage column and click against the default certificate.
3. The name of the CA cannot be changed for default CA.
4. Select the country in which the device is deployed.
5. Enter the state within the country.
6. Enter the locality in which the certificate is to be used.
7. Enter the name of the certificate owner (example: Sophos Group).
8. Enter the name of the department to which the certificate is to be assigned (example: marketing).
9. Enter the common name or FQDN (example: marketing.sophos.com).
10. Enter the contact person’s email address.
11. Enter the CA passphrase and re-enter to confirm.
12. Click Save.
Regenerate Certificate Authority
1. Go to System > Certificates > Certificate Authorities.
2.
To regenerate the default certificate, go to the Manage column and click .
Note: When you update the default CA, it is automatically regenerated.
Certificate Revocation Lists
Certificates can be revoked when the key or CA has been compromised, or the certificate is no longer valid for the original purpose. CAs maintain a list of revoked certificates.
You can upload Certificate Revocation List (CRL) of an external CA. Self-signed certificates that are revoked are automatically added to the CRL.
Add CRL
Add CRL allows you to upload the Certificate Revocation List (CRL) of an external certificate authority.
1. Go to System > Certificates > Certificate Revocation Lists and click Add.
2. Enter the CRL Name and upload the CRL file.
3. Click Save.
Download CRL
When you add a CA, a default CRL file default.tar.gz, is generated.
1. Go to System > Certificates > Certificate Revocation Lists.
2. Click Download against the CRL to download the .zip file.
Backup & Firmware
Backup & Firmware provides following options:
•
Backup & Restore
: Backup and restore system data.
•
API
: Application Programming Interface (API) allows third party applications to communicate with the device.
•
Import Export
: Import/export device configuration from/to a text file.
•
Firmware
: Allows you to upload/view firmware versions downloaded.
Sophos XG Firewall | System | 91
•
Pattern Updates
: Update patterns for various modules like Sophos AV, IPS, WAF or set auto-update interval.
Backup & Firmware
Backup is the essential part of data protection. No matter how well your system is treated, no matter how much it is taken care of, you cannot guarantee that your data is safe, if it exists only at one place.
Backups are necessary in order to recover data from loss due to disk failure, accidental deletion or file corruption.
There are many ways of taking backup and just as many types of media to use as well.
Backup consists of all the policies and all other user related information.
Device facilitates to take back-up only of the system data, either through scheduled automatic backup or using a manual backup.
Once the backup is taken, the file for restoring the backup must be uploaded for restoring the configuration.
Below are the screen elements with their description:
Backup
Backup Mode
Select how and to whom backup files should be sent.
Available Options:
Local - Backup is taken and stored on the Device itself.FTP - Configure FTP server IP Address
(IPv4/IPv6), login credentials and FTP path. Email - Configure Email Address on which backup is to be mailed. You can configure multiple Email Addresses.
Backup Prefix
Frequency
Specify backup file name (prefix). The backup file name format is as follows:
• With Prefix: <Prefix>_Backup_<Device Key>_<timestamp>
For example:
Dallas_Backup_ABCDEY190_26Nov2014_12.09.24
NY_Backup_ABCDEY190_26Nov2014_12.09.24
• Without Prefix(Default): Backup_<Device Key>_<timestamp>
For example:
Backup_ABCDEY190_26Nov2014_12.09.24
If prefix is not provided, the default format is used for backup file.
Backup Prefix will be useful in case you need to take backup from multiple devices.
Select the system data backup frequency.
In general, it is best to schedule backup on regular basis. Schedule can be determined depending on how much information is added or modified.
Available Options:
Never - Backup will not be taken at all Daily - Backup will be taken every day Weekly - Backup will be taken every week Monthly - Backup will be taken every month
Schedule
Specify the day/date and time for Daily, Weekly and Monthly backup.
Backup Now
Click to take the backup of system data till date.
Download (Only for Local Backup Mode)
Click to download the latest backup that is available for uploading.
Sophos XG Firewall | System | 92
Figure 61: Backup
Backup Restore
Restore Configuration
To select the complete path of the backup file to be restored, click the file selection button against
Restore Configuration.
Upload and Restore
Click to upload and restore the configuration.
Figure 62: Backup Restore
Note: Restoring data older than the current data results in the loss of current data.
API
Application Programming Interface (API) is an interface which allows third party applications to communicate with the device. This page allows the Administrator to log on and log off users.
API Configuration
API Configuration
Enable to allow only authorized third-party solution providers like ISP, and system integrators to use
API for log-on and log-off process.
Default - Disabled
Allowed IP Address
Add the IP addresses allowed to place the XML log-on and log-off requests.
You will be able to add IP Address only if API Configuration is enabled.
Sophos XG Firewall | System | 93
Figure 63: API Configuration
API Explorer
Request XML String
Specify the XML content containing the configurations to enable user log on or log off.
Parse and apply
Click to parse the XML content and apply the configurations.
Figure 64: API Explore
Sample XML Request Code
For all the requests, XML response will be displayed in a pop-up window.
<Request><LiveUserLogin><UserName>sophos</UserName><Password>sophos</
Password><IPAddress>10.21.18.15</IPAddress><MacAddress>00:0C:29:2D:D3:AC</
MacAddress> </LiveUserLogin></Request>
<Request><LiveUserLogout><Admin><UserName>admin</UserName><Password>admin</
Password></Admin><UserName>sophos</UserName><IPAddress>10.21.18.15</
IPAddress></LiveUserLogout></Request>
For versions prior to 10.6.1 MR-1
<Request><LiveUserLogout><UserName>sophos</UserName><IPAddress>10.21.18.15</
IPAddress></LiveUserLogout></Request>
Please use the below link to use API: https://<Sophos IP>:<port>/webconsole/APIController?reqxml=<Add the XML
request here>
Note: Port you mention in above URL should be same as the port you have configured as Admin Console
HTTPS Port from System > Administration > Admin Settings.
Sophos XG Firewall | System | 94
For example: https://<Sophos IP>:4444/webconsole/APIController?
reqxml=<Request><LiveUserLogin><UserName>sophos</UserName><Password>sophos</
Password><IPAddress>10.21.18.15</IPAddress><MacAddress>00:0C:29:2D:D3:AC</
MacAddress></LiveUserLogin></Request>
Note: When the user logs on using API, the client type of the users will display API Client on the Live
Users page.
Import Export
You can export and import full or partial device configuration across compatible devices of the same or different models. Device configuration is exported to a text file in human readable XML format. Update it offline, if required.
Import
Import File
To select the complete path of the tar file to be imported, click the file selection button against
Import File.
Import
Click to import the configuration on the device.
Device existing configuration will be preserved. Entities with same name in existing configuration will be updated with the imported entity configuration and new Entities will be added.
For example:
If you have a Network Traffic Quota Policy with name “Daily 10 MB” in both the existing and imported configuration then the existing policy configuration will be updated with the imported configuration. Any new policies in the imported configuration will also get added.
Figure 65: Import Configuration
Export
Export full configuration
Select to export all the entities configuration to a text file.
Export selective configuration
Select to export only selected entities configuration. Click Add New Item to select entities and apply to add the selected entities.
Dependent entities for the selected entity will also be exported if Include dependent entity is selected.
Export
Click to export the configuration from the device.
Sophos XG Firewall | System | 95
Figure 66: Export Configuration
Firmware
This feature is not available in Sophos Firewall Manager (SFM).
The Firmware page allows you to manage the firmware versions on your device. It also enables you to install hotfixes and to choose the default configuration language of your device.
The Firmware section displays the list of firmware versions that have been downloaded. A maximum of two firmware versions are available simultaneously and one of the versions is active.
Upload firmware
Click to upload new firmware. Click Browse in the pop-up window. Click Upload firmware to upload the firmware image file. The uploaded firmware becomes active after the next reboot.
Click Upload & Boot to upload the firmware image file and boot the device. The action upgrades the device to the new version, closes all sessions, restarts the device, and displays the login page.
The process may take a few minutes since it involves migrating the entire configuration.
At the time of uploading new firmware, the error “New Firmware could not be uploaded” might occur due to one of the following reasons:
1. Wrong upgrade file - You are trying to upload wrong upgrade file i.e. a previous version firmware.
2. Incorrect firmware image - You are trying to upload incorrect firmware image for your appliance model. All the firmware’s are model specific and are not inter-changeable. Hence, firmware of one model is not applicable on another model. For example, an error is displayed, if appliance model XG125 is upgraded with firmware for model XG750.
3. Incompatible firmware - You are trying to upload incompatible firmware.
4. Changes in Appliances Hardware - Your appliance hardware configuration is not the standard hardware configuration. Contact support for assistance.
5. Corrupt firmware - There are chances that the firmware you have downloaded is corrupt.
Boot firmware image
Click to upgrade the device to the uploaded firmware image. The action upgrades the device to the new version, closes all sessions, restarts the device and displays the login page.
Boot with factory default configuration
Click to reboot the device and to activate the default configuration.
Note: If you boot with factory default configuration, the current configuration will be lost. Take a backup before you click this option.
Active
The Active icon against a firmware version indicates that the device currently uses this firmware.
Sophos XG Firewall | System | 96
Latest Available Firmware (not available in SFM)
Check For new Firmware
Click to view the new firmware, if available.
Firmware Version
Displays the list of firmware versions available for download.
Type
Displays the type of each firmware.
Available Options:BetaGA
Actions
Click Download to download the firmware. Once the download is complete, click Install to install the firmware.
Figure 67: Available Latest Firmware
SF-OS Hot-fix
Allow auto-install of important Hot-fixes
Hot-fixes are installed automatically when they are available. Clear the check box if you do not want to apply them automatically.
Click Apply to save your selection.
Default: Enabled
Figure 68: SF-OS Hot-Fix
Factory Reset with Default Configuration Language
Default Configuration Language
Select a default language for configuration. When you choose a different language, the device reboots and goes back to the factory default settings. It removes all customizations.
The Admin Console Language can differ from the Default Configuration Language. Choosing a different Admin Console Language displays menus and labels in the selected language while choosing a different Default Configuration Language displays menus, labels as well as default policies and their description in the selected language.
Default: English
Available Options:
• English
• Hindi
• Chinese - Traditional
Sophos XG Firewall | System | 97
• Chinese - Simplified
• French
• Japanese
Note: Take a backup before you choose a different language since the entire configuration will be lost. The device restores the backup in the language that was operational at the time of taking the backup.
Figure 69: Factory Reset with Default Configuration Language
Pattern Updates
This page displays the status of patterns used by various modules of your device like Sophos AV, IPS and Application
Signature, WAF. The page also provides options to update patterns or set an auto-update time interval. By default pattern are updated automatically.
Updates Status
Pattern
Name of the pattern.
Current Version
Version of the pattern in use.
Available Version
Upgrade version, if available.
Last Successful Update
Displays time and date of the last successful update.
Status
Displays status of the pattern.
• Ready to Install
• Success
• Downloading
• Failed
Update Pattern Now
Click to update the pattern definitions.
Sophos XG Firewall | System | 98
Figure 70: Update Status
Pattern Download/Installation
Auto Update
To update pattern definitions automatically, click Auto Update.
Firmware updates for RED and Access Points are automatically downloaded and a notification is displayed. You have to manually install those updates. Usually, after installation the RED or
AP reboots. Connections to REDs or APs will be interrupted during that time and re-established afterwards.
Interval (Available only if Auto Update is turned ON)
Set the time limit in which you want to receive updates.
Available Options:
• Every hour
• Every 2 hours
• Every 4 hours
• Every 12 hours
• Daily
• Every 2 days
Figure 71: Pattern download/installations
