Network. Sophos XG Firewall
Reklama
Reklama
Sophos XG Firewall | Configure | 99
Configure
Network
Network section allows you to configure various components for optimal network operation.
In particular, this section covers the following topics:
•
: Configure and manage the ports/interfaces of the device.
•
: Configure custom zone and view the list of default and custom zones.
•
•
: Manage DNS servers to be used by the device, DNS host entries and routing of specific requests.
•
•
: View the list of configured router advertisements (RA), configure RAs.
•
: Configure parameters of the cellular WAN connection of the device.
•
: Create and manage 6in4, 6to4, 6rd and 4in6 IP tunnels for inter-communication between IPv6 and
IPv4 networks.
•
: View and manage device’s ARP-NDP neighbors.
•
: Integrate device with a dynamic DNS. Manage existing configuration.
Interfaces
Interfaces lists all the interfaces of the device along with their configurations.
The device is shipped with a number of physical interfaces, that is, ports and a number of virtual interfaces, depending on the model of the device. The Interface page displays a list of physical interfaces, aliases, virtual interfaces, bridge interfaces, interfaces configured as LAG or as TAP as well as interfaces configured for wireless LAN or for cellular
WAN.
Interfaces allows you to configure a range of physical and virtual interfaces. If a virtual interface is configured for a physical interface, it is displayed below the physical interface. Virtual interface configuration can be updated or deleted.
Note: Updating the interface details may affect dependent configurations. Refer
for more details.
The possible configurations are provided below:
•
– Alias allows you to bind multiple IP addresses to a single physical interface.
•
– A bridge enables you to configure transparent subnet gatewaying.
•
– Link Aggregation Group (LAG) allows multiple network connections to be combined into a single connection. It is also known as trunking, NIC teaming, NIC bonding, or Ether Channel. LAG is mostly used to handle LAN traffic.
•
– A virtual LAN is a broadcast domain with each VLAN being configured on a switch to individual ports.
•
– A wireless network links devices through a wireless distribution method, connecting them to the Internet through an access point.
If a wireless network is configured with a “Separate Zone” for
mode under Protect > Wireless >
Wireless Networks, a wlnet interface of the type “Wireless Protection” is automatically created on this page with the configured IP address and zone of the wireless network. In order to use the interface, you need to configure a DHCP server for the interface so that the wireless clients can connect to the device. The interface will automatically be deleted once the wireless network is deleted.
•
– A cellular WAN is a wide area network (WAN) for data that is typically provided by cellular carriers to transmit a wireless signal over a range of several miles to a mobile device.
Sophos XG Firewall | Configure | 100
•
– A TAP interface enables you to deploy the device in Discover Mode. In this mode, the device can monitor all the network traffic without making any changes in the existing network schema. Discover Mode can be configured through the command line interface (CLI).
•
branch office is part of your local network. The RED device connects to the main device using a RED interface and can be configured using this interface. On factory default, all the configured RED interfaces are deleted.
Interface status messages can have the following values:
• Disabled - The interface is currently not bound to any zone.
• Connected - The interface is connected, configured and is running.
• Connecting (Displayed only for PPPoE and cellular WAN (WWAN1) interfaces) - Displayed when a new IP address is being leased.
• Disconnected (Displayed only for PPPoE and cellular WAN (WWAN1) interfaces) - Displayed after the IP address has been released.
• Disconnecting (Displayed only for PPPoE and cellular WAN (WWAN1) interfaces) - Displayed during the process of IP release.
• Unplugged - No physical connection.
• Not Available (Applicable for Flexi Ports devices) - If the Flexi Ports module has previously been inserted and
Flexi Ports have been configured, then after removing the Flexi Ports module from the device, the Flexi Ports will carry the status “Not Available”.
The following list shows the different icons, representing the different interface types:
Icons Meaning
Ethernet
Wireless
Bridge
VLAN
RED10
RED15
RED50
LAG
WWAN
Note: Configurations dependent on Interfaces
• Updating the interface details may affect dependent configurations, including Interface zone binding,
DNS, gateway, interface-based hosts, VLAN interfaces, and dynamic DNS.
• Deleting the virtual interface will delete the firewall rule defined for the virtual interface.
• Deleting the interface will also remove all its dependent configurations, including interface zone binding,
DHCP server or relay, interface-based firewall rule, ARP (static and proxy), protected servers, protected server-based firewall rules, interface-based hosts and references from host groups as well as unicast and multicast routes.
Sophos XG Firewall | Configure | 101
• Your network connections might get affected for some time after updating/deleting Interfaces. If you face any network issues during this time then please wait for some time and check again.
Physical Interface Configuration
Use this page to edit physical interface configurations.
1. Go to Configure > Network > Interfaces. Identify the physical interface whose settings need to be updated and click the icon on the right side. Click Edit Interface within the box.
2. Enter the details for General Settings.
Physical Interface
Physical interfaces are ports which may be marked in numeric (Port1, Port2, and so on), alphabetic
(PortA, PortB, and so on), alphanumeric (PortA2, PortA3, and so on), or in special alphanumeric form (eth0, eth1, and so on), depending on your device.
Network Zone
Select the zone to which the interface belongs.
Available Options:
• None: Select to unbind the interface.
• LAN
• WAN
• DMZ
• WiFi
Figure 72: General Settings
3. Enter the IPv4 configuration details.
IP Assignment
Select the IP assignment type.
Available Options:
• Static - Click to specify the IP address manually.
• PPPoE - Click to enable the interface to receive the IP address from a PPPoE server.
• DHCP - Click to enable the interface to receive the IP address dynamically from a DHCP server.
IPv4/Netmask
Enter the IPv4 address of the interface. Select the network subnet mask.
Preferred IP (available only if selected IP Assignment is PPPoE)
Many Internet service providers assign a static IP address to PPPoE connections. The device allows you to bind the static IP address to the PPPoE connection.
Note: An IP Address other than the preferred IP Address may be assigned to the
PPPoE connection, depending on the PPPoE Server configuration.
4. Enter the IPv4 gateway details.
Gateway Detail (available only for WAN zone)
• Static IP Assignment - Enter the Gateway Name and the IPv4 address through which traffic is to be routed.
• PPPoE IP Assignment - Enter the Gateway Name through which traffic is to be routed.
• DHCP IP Assignment - Enter the Gateway Name through which traffic is to be routed.
Sophos XG Firewall | Configure | 102
Figure 73: IPv4 Configuration
5. Enter the details for PPPoE IP Assignment.
Username
Enter the PPPoE account username.
Password
Enter the PPPoE account password.
Access Concentrator/Service Name
Enter the access concentrator and service name.
The device initiates only those sessions with the access concentrator that can provide the specified service.
LCP Echo Interval
Enter the time interval at the end of which the system sends an echo request to check whether the link is alive. Once an attempt is made, the device waits for the defined time interval before the next attempt is made.
Default: 20 seconds
LCP Failure
Enter the number of attempts (echo requests) to be made. Once the specified number of attempts are made without receiving a response from the client, the device disconnects the PPPoE connection.
Default: 3
Schedule Time For Reconnect
The IP address assigned to a PPPoE connection, whether dynamic or static (preferred), can have a predefined validity period. Once the validity expires, the PPPoE connection is terminated and is reconnected.
To prevent reconnection during working hours, enable the PPPoE reconnect schedule. You may choose to schedule the PPPoE reconnection on daily or weekly basis at the configured time
(HH:MM).
Default: Disabled
Default schedule when enabled: All days of the week
Note: Even when a Preferred IP address has been configured, if Schedule Time For
Reconnect is enabled and configured, on reconnection, an IP address other than the preferred IP address may be assigned to the PPPoE connection.
Sophos XG Firewall | Configure | 103
Figure 74: PPPoE Configuration
6. Enter the IPv6 configuration details.
IP Assignment
Select the IP assignment type.
Available Options:
• Static
• DHCP
Mode (only for DHCP mode)
Select the DHCP mode.
Select the relevant option to configure the IPv6 addresses through stateful (DHCPv6) or Stateless address assignment methods depending on the Managed (M) Address Configuration and Other (O) configuration flags advertised in the Router Advertisement (RA) message.
Available Options:
Auto - If selected, the IPv6 address will be configured based on the router advertisement packet through Stateless Address Auto-Configuration (SLAAC) or through DHCPv6 depending on the
Managed (M) Address Configuration and Other (O) Configuration flags advertised in the Router
Advertisement (RA) message. Manual - Select the relevant option to configure the IPv6 address either through SLAAC or through DHCPv6.
• DHCP Only - In this manual mode, the client will configure IPv6 Address and other configuration parameters using DHCPv6 Server. Gateway details should be manually specified.
• Stateless - In this manual mode, client will configure IPv6 Address based on advertised RA message through SLAAC.
• Accept Other Configuration from DHCP: Select to configure other parameters using
DHCPv6 Server. By default, it is enabled.
DHCP Rapid Commit
If enabled, the interface will be configured using a 2-message exchange (Solicit and Reply) rather than the 4-message exchange (Solicit, Advertise, Request, and Reply). It allows for quicker client configuration.
Note: Rapid commit should also be enabled on the DHCPv6 server.
IPv6 / Prefix (Only for static IP assignment)
Enter the IPv6 address and the prefix.
Gateway Detail (Only for “WAN” zone)
Sophos XG Firewall | Configure | 104
For Static IP assignment:Enter the gateway name and IPv6 address through which the traffic is to be routed. For DHCP IP assignment:Enter the gateway name, if Stateless manual mode is selected. For DHCP only manual mode, specify the gateway name and IPv6 address.
Figure 75: IPv6 Configuration - DHCP
7. Enter details for the Advanced Settings.
Interface Speed
Select interface speed for synchronization. Interface speed can also be configured through CLI using set network interface-speed command.
Speed mismatch between the device and third-party routers and switches can result in errors or collisions on the interface, disconnection, traffic latency, or slow performance.
Depending on the model deployed, the following options are available:
Auto Negotiation 10 Mbps - Half Duplex 10 Mbps - Full Duplex 100 Mbps - Half Duplex 100
Mbps - Full Duplex 1000 Mbps - Full Duplex
Default - Auto Negotiation
MTU
Enter the MTU (Maximum Transmission Unit) value.
MTU is the largest physical packet size, in bytes, that a network can transmit. This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes.
Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent.
Default - 1500
Acceptable Range (For IPv4 Configuration):576 to 1500
Acceptable Range (For IPv6 Configuration):1280 to 1500
Override MSS
Select to override the default MSS.
MSS defines the amount of data that can be transmitted in a single TCP packet.
Default: 1460
Acceptable Range:536 to 1460
Use Default MAC Address
Click to use the default MAC address for the interface.
Sophos XG Firewall | Configure | 105
By default, the first port that is included as member port becomes the default MAC address.
Override Default MAC Address
Click to override the default MAC address for the interface and enter the new MAC address.
On factory reset, it is set to the default MAC Address.
Figure 76: Advanced settings
8. Click Save.
Advanced Settings for Bridge Interface
1. Go to Configure > Network > Interfaces. Identify the bridge interface whose advanced settings need to be updated and click the icon on the right-hand side. Click Edit Interface within the box.
2. Enter the details for Advanced Settings.
Physical Interface
Displays the physical bridge member interface.
Network Zone
Displays the zone to which the physical interface belongs.
Interface Speed
Select the interface speed for synchronization. Interface speed can also be configured through CLI using the set network interface-speed command.
Speed mismatch between the device and third-party routers and switches can result in errors or collisions on the interface, disconnection, traffic latency, or slow performance.
Depending on the device, the following options are available:
• Auto Negotiation
• 10 Mbps - Half Duplex
• 10 Mbps - Full Duplex
• 100 Mbps - Half Duplex
• 100 Mbps - Full Duplex
• 1000 Mbps - Full Duplex
Default: Auto Negotiation.
MTU
Enter the MTU (Maximum Transmission Unit) value. MTU is the largest physical packet size (in bytes) that a network can transmit.
Default: 1500
Override MSS
Select the checkbox to override the default MSS (Maximum Segment Size). MSS defines the amount of data that can be transmitted in a single TCP packet.
Sophos XG Firewall | Configure | 106
Default: 1460
Use Default MAC Address
Click to use the default MAC address of the interface. The MAC address of the first port to be added as member port becomes the default MAC address.
Override Default MAC Address
Click to override the default MAC address of the interface and enter the new MAC address. On factory reset, it will be set to the default MAC address.
Figure 77: Advanced Settings - Bridge Interface
3. Click Save.
Add Bridge
This feature is not supported when the device is deployed on Microsoft Hyper-V hypervisors.
1. Go to Configure > Network > Interfaces, click Add Interface on the right side and click Add Bridge from the drop-down list.
2. Enter the details for General Settings.
Name
Enter a name to identify the bridge.
Description
Enter a description for the bridge.
Enable routing on this bridge pair
Select the checkbox to enable routing on this bridge.
Figure 78: General Settings
3. Enter the details of Member Interfaces.
Interface
Select the interfaces of the bridge. For example, Port A, Port B.
Zone
For each interface, select the zone to which the interface belongs.
Sophos XG Firewall | Configure | 107
Figure 79: Bridge Member Interfaces
4. Enter IPv4 configuration and gateway details.
IPv4 / Netmask
Enter the IPv4 address and select the network subnet mask.
Gateway Name
Enter a name to identify the gateway.
Gateway IP
Enter the IPv4 address for the gateway.
Figure 80: IPv4 Configuration and Gateway Details
5. Enter the IPv6 configuration details.
IPv6 / Prefix
Enter the IPv6 address and the prefix.
Gateway Name
Enter a name to identify the gateway.
IP Address
Enter the IPv6 address for the gateway.
Figure 81: IPv6 Configuration
6. Enter the details for Advanced Settings.
MTU
Enter the MTU (Maximum Transmission Unit) value.
MTU is the largest physical packet size (in bytes) that a network can transmit. Problem arises when networks with differing MTU sizes are interconnected. In such a scenario, packets larger than the specified MTU value are divided (fragmented) into smaller packets before they are sent.
Default: 1500
Acceptable Range (For IPv4 Configuration):576 to 1500
Acceptable Range (For IPv6 Configuration):1280 to 1500
Override MSS
Select the checkbox to override the default MSS (Maximum Segment Size).
MSS defines the amount of data that can be transmitted in a single TCP packet.
Default: 1460
Acceptable Range: 536 to 1460
Sophos XG Firewall | Configure | 108
Figure 82: Advanced Settings
Note:
• A single WAN interface is supported in a bridge.
• A single interface cannot be part of multiple bridges.
7. Click Save.
Add Alias
Use this page to bind multiple IP addresses to a single interface.
1. Go to Configure > Network > Interfaces, click Add Interface on the right side and click Add Alias from the drop-down list.
2. Enter the interface details.
Physical Interface
Select the interface to which an Alias must be bound.
IP Family
Select the IP family for the Alias.
Available Options:
IPv4 (Only for physical interfaces with IPv4 configuration)
IPv6 (Only for physical interfaces with IPv6 configuration)
IPv4/Netmask (Available only if IP Family selected is IPv4)
Enter the IPv4 address and select the network subnet mask.
IPv6/Prefix (Available only if IP Family selected is IPv6)
Enter the IPv6 address and the prefix.
Default: 64
Figure 83: Add Alias
Sophos XG Firewall | Configure | 109
3. Click Save.
Related tasks
on page 60
To enable internal hosts to access the Internet through a public IP address, create a Network Address Translation
(NAT) policy. The policy specifies the public IP addresses through which NATing can take place. The NAT policy must then be applied to a Firewall Rule (Protect > Firewall).
Configure Cellular WAN Settings
Enable Cellular WAN from Configure > Network > Cellular WAN.
1. Go to Configure > Network > Interfaces. Identify the cellular WAN (WWAN1) interface whose settings need to be updated and click the icon on the right side. Click Edit Interface within the box.
2. Enter the details for General Settings.
Interface Name
Enter a name for the interface.
IP Assignment
Select the IP assignment method from the available options:
Available Options:Dial-up (PPP)Network Adapter (DHCP)
Show Recommended Configuration
Click to view the modem details and the recommended configuration. The recommended configuration is displayed in two sections:
Information Section:
• Modem Name
• Vendor ID
• Product ID
• SIM PIN Enabled – Yes/No
Configuration Section:
Available IP Assignment Methods:
Possible Values
• Dial-up (PPP)
• Network Adapter (DHCP)
• Dial-up (PPP) & Network Adapter (DHCP)
Modem Port:
Possible Values
• Not Available
• Serial n (n= 0, 1, …9)
Secondary Modem Ports:
Possible Values
• Not Available
• Serial n (n = 0, 1, …9)
Note: This parameter displays the next available modem port. This port must be used as the Modem Port, if the recommended modem port fails.
APN (Access Point Name):
Possible Values
• Not Available
• <name>
Sophos XG Firewall | Configure | 110
DHCP Connect Command:
Possible Values
• Not Required
• Required but not available
• <AT command>
DHCP Disconnect Command:
Possible Values
• Not Required
• Required but not available
• <AT command >
Click Load Recommended Configuration to load the recommended configuration onto the page.
This action removes previous configurations, if any, and replaces them with the recommended configuration.
Note: When you click Load Recommended Configuration, values of the secondary modem ports are not loaded.
Connect
Select the mode to establish a cellular WAN connection.
Available Options:AutoManual
Reconnect Tries
Select the number of attempts to be made when reconnecting to an access point.
Available Options:Always123Default: Always
Modem Port (Available only if IP Assignment selected is Dial-up (PPP))
Enter the serial interface on which the modem will establish a connection.
Available Options:Serial 0 to 9
Phone Number (Available only if IP Assignment selected is Dial-up (PPP))
Enter the phone number to be used in order to establish the connection or select one from the dropdown list.
Username
Enter a username for the connection.
Password
Enter a password.
SIM Card PIN Code
Enter the PIN code in order to unlock the PIN-enabled SIM card.
Many operators lock their SIM card to prevent the use of another operator’s SIM card. Such modems can be unlocked using the PIN code in order to establish a connection.
APN
Enter the Access Point Name (APN).
The APN is a configurable network identifier based on which the device identifies the Packet Data
Network (PDN) or the GSM carrier with which the user wants to communicate.
DHCP Connect Command (Available only if IP Assignment selected is Network Adapter (DHCP))
Enter a DHCP command to connect to the cellular WAN.
DHCP Disconnect Command (Available only if IP Assignment selected is Network Adapter (DHCP))
Enter a DHCP command to disconnect from the cellular WAN.
Sophos XG Firewall | Configure | 111
Initialization String
Enter an initialization string for the specific wireless modem. In case of multiple strings, the strings must be entered in the order of their priority.
Figure 84: General Settings - Dial-up
3. Enter the details for Gateway Settings.
Gateway Name
Enter a name to identify the gateway.
Gateway IP
Enter the IP address of the gateway.
Figure 85: Gateway Settings
4. Enter the details for Advanced Settings.
MTU
Enter the MTU (Maximum Transmission Unit) value.
MTU is the largest physical packet size (in bytes) that a network can transmit. Problem arises when networks with differing MTU sizes are interconnected. In such a scenario, packets larger than the specified MTU value are divided (fragmented) into smaller packets before they are sent.
Default: 1500
Acceptable Range: 576 to 1500
MSS
Enter the MSS (Maximum Segment Size).
MSS is the amount of data that can be transmitted in a single TCP packet.
Sophos XG Firewall | Configure | 112
Default: 1460
Acceptable Range: 536 to 146
MAC Address (Available only if IP Assignment selected is Network Adapter (DHCP))
Select the method of providing a MAC address to the modem:
Available Options:Use Default MAC AddressOverride Default MAC Address (If you select this option, provide the MAC address.)
Figure 86: Other Settings
5. Click Save.
Virtual LAN (VLAN)
VLANs are virtual LANs in which work devices on one or more LANs are logically segregated into independent broadcast domains. The logical segregation allows devices from multiple LANs across different floors or geographical regions to communicate as if they are physically connected. At the same time, a single LAN can be separated into multiple VLANs based on roles, work groups, services, or any other logical parameter.
Although routers are generally used to create broadcast domains in LANs, switches create the VLAN broadcast domains. You can assign each VLAN to one or more ports on a single switch. In case of distributed VLANs, you can assign them across multiple switches. Communication within a VLAN happens through the switch, while communication across different VLANs requires a layer 3 device – a router, a layer 3 switch, or a firewall.
You can implement VLAN technology between a Sophos Firewall (SF) device and 802.1Q-compliant switches and routers. Tag-based LAN multiplexing technology simulates multiple LANs within a single physical LAN and traffic from each broadcast domain is given a different VLAN tag. VLAN IDs/tags are 4-byte frame extensions that contain a VLAN identifier and information specific to your configuration.
SF recognizes VLAN IDs, allowing you to apply firewall rules specific to each VLAN, including authentication and other relevant policies of your network. You can also apply firewall rules to secure the network between broadcast domains.
Advantages
• Increase in the number of ports
• Logical segmentation of network regardless of physical location
• Granular firewall rules specific to workgroups
• Improved network throughput due to the creation of smaller broadcast domains
Add VLAN Interface
1. Go to Configure > Network > Interfaces, click Add Interface on the right side and select Add VLAN from the drop-down list.
2. Enter the VLAN details.
Physical Interface
Select a parent interface for the virtual sub-interface. The virtual sub-interface becomes a member of the selected physical interface.
Zone
Select a zone to assign to the virtual sub-interface. The virtual sub-interface becomes a member of the selected zone which can be LAN, DMZ, WAN, WiFi or a custom zone.
Sophos XG Firewall | Configure | 113
VLAN ID
Enter the VLAN ID. The interface VLAN ID can be any number between 2 and 4094. The VLAN
ID of each virtual sub-interface must match the VLAN ID of the packet. If the IDs do not match, the virtual sub-interface will not receive the VLAN-tagged traffic.
Note: When added to the same physical interface, more than one virtual sub-interface cannot carry the same VLAN ID. However, virtual sub-interfaces carrying the same
VLAN ID can be added to different physical interfaces.
Figure 87: VLAN Details
3. Enter the IPv4 configuration details (Only for physical interfaces with IPv4 configuration).
IP Assignment
Select the IP assignment type.
Available Options:
• Static
• PPPoE
• DHCP
IPv4/Netmask
Enter the IPv4 address for the interface and select the network subnet mask.
Preferred IP (available only if IP Assignment selected is PPPoE )
Many Internet service providers assign a static IP address to PPPoE connections. The device allows you to bind the static IP address to the PPPoE connection.
Enter the preferred IP address for the PPPoE connection.
Gateway Detail (For “WAN” zone)
• Static IP Assignment: Specify the Gateway Name and the IPv4 address through which the traffic is to be routed.
• PPPoE IP Assignment: Specify the Gateway Name through which the traffic is to be routed.
• DHCP IP Assignment: Specify the Gateway Name through which the traffic is to be routed.
Figure 88: IPv4 Configuration
4. Enter the details for PPPoE IP Assignment.
Username
Enter the PPPoE account username.
Sophos XG Firewall | Configure | 114
Password
Enter the PPPoE account password.
Access Concentrator/Service Name
Enter the access concentrator and service name.
The device initiates only those sessions with the access concentrator that can provide the specified service.
LCP Echo Interval
Enter the length of time that the system must wait before it sends an echo request to check whether the link is alive. Once an attempt is made, the device waits for the defined time interval before the next attempt is made.
Default: 20 seconds
LCP Failure
Enter the number of attempts (echo requests) to be made. Once the specified number of attempts are made without receiving a response from the client, the device disconnects the PPPoE connection.
Default: 3
Schedule Time For Reconnect
The IP address assigned to a PPPoE connection, whether dynamic or static (preferred), can have a predefined validity period. Once the validity expires, the PPPoE connection is terminated and is reconnected.
To prevent reconnection during working hours, enable the PPPoE reconnect schedule. You may choose to schedule the PPPoE reconnection on daily or weekly basis at the configured time
(HH:MM).
Default: Disabled
Default schedule when enabled: All days of week
Note: Even when a Preferred IP address has been configured, if Schedule Time For
Reconnect is enabled and configured, on reconnection, an IP address other than the preferred IP address may be assigned to the PPPoE connection.
Figure 89: PPPoE Configuration
5. Enter the IPv6 configuration details (Only for physical interfaces with IPv6 configuration)
IP Assignment
Select the IP assignment type.
Available Options:
Sophos XG Firewall | Configure | 115
• Static
• DHCP
Mode (available only if IP Assignment selected is DHCP)
Select DHCP mode.
Administrator can select to configure IPv6 address through Stateful (DHCPv6) or StateLess address assignment methods depending on the Managed (M) Address Configuration and Other (O)
Configuration flags advertised in the Router Advertisement (RA) message .
Available Options:
Auto:If selected, IPv6 address will be configured based on the Router Advertisement packet through Stateless Address Auto-Configuration (SLAAC) or DHCPv6 depending on the
Managed (M) Address Configuration and Other (O) Configuration flags advertised in the Router
Advertisement (RA) message. Manual:Administrator can select to configure IPv6 address either through SLAAC or DHCPv6.
• DHCP Only:In this manual mode, client will configure IPv6 Address and other configuration parameters using DHCPv6 Server. Gateway details should be manually specified.
• Stateless:In this manual mode, client will configure IPv6 Address based on advertised RA message through SLAAC.
• Accept Other Configuration from DHCP: Select to configure other parameters using
DHCPv6 Server. By default, it is enabled.
DHCP Rapid Commit
If enabled, the interface will be configured using a 2-message exchange (Solicit and Reply) rather than the 4-message exchange (Solicit, Advertise, Request, and Reply). It enables quicker client configuration.
Note: Rapid commit should also be enabled on the DHCPv6 server.
IPv6 / Prefix (Only for static IP assignment)
Enter the IPv6 address and the prefix.
Gateway Detail (Only for “WAN” zone)
• For “Static” IP assignment:Specify the gateway name and IPv6 address through which the traffic is to be routed.
• For “DHCP” IP assignment:Specify the gateway name, if Stateless manual mode is selected.
For DHCP only manual mode, specify the gateway name and the IPv6 address.
Sophos XG Firewall | Configure | 116
Figure 90: IPv6 Configuration
6. Click Save.
Link Aggregation Group
LAG is not supported in Sophos virtual security devices.
Link Aggregation Group (LAG) combines multiple physical links into a single logical link, connecting the SF device to another network device (switch). Also known as trunking, NIC teaming, NIC bonding or Ether Channel, LAG provides redundancy – when one interface fails, the remaining interfaces continue to carry the LAN traffic, ensuring continuity within the network.
LACP
Link Aggregation Control Protocol (LACP) is part of the IEEE specification 802.3ad and provides additional LAG functionality. You can assign load sharing across links based on the algorithm applied in the xmit hash policy. Link aggregation increases the bandwidth available without the need to deploy additional hardware.
The SF device supports the following LAG modes:
• Active Backup: This mode provides automatic link failover. One link (member of the LAG) remains active while the other remains in standby mode. When the active link fails, the standby link becomes active.
• LACP (802.3ad): This mode provides load balancing and automatic failover. In this mode, all the links are used to forward traffic.
Prerequisites for LACP (802.3ad) mode
• For LACP to be functional, it must be enabled at both ends of the link.
• All the member interfaces (ports) in the LAG must be of the same type and have the same interface speed.
• All the links must be full-duplex.
Limitations
• Only unbound static physical interfaces can be members of the LAG.
• PPPoE, 3G, 4G, Cellular WAN, WLAN and Transport mode are not supported in LAG.
• A maximum of 4 ports can be configured on a single LAG interface.
Add Link Aggregation Group (LAG)
1. Go to Configure > Network > Interfaces, click Add Interfaceon the right-hand side and click Add LAG from the drop-down list.
LAG interface properties can be configured or edited from the command line, but a LAG interface cannot be added from CLI.
Sophos XG Firewall | Configure | 117
2. Enter the details for Global Settings.
Interface Name
Enter a name for the LAG interface.
Member Interface
Click Add New Item. The drop-down list displays all unbound ports.
Select the checkbox to select the port(s).
Note:
• At least 2 member ports are required to create a LAG interface.
• A maximum of 4 ports can be configured on a single LAG interface.
• Interfaces that have been configured for PPPoE, Cellular WAN or WLAN cannot participate in LAG.
Mode
Select the mode of LAG.
Available Options:
Active-Backup:Select the Active-Backup mode to provide failover. 802.3ad (LACP):Select the
802.3ad (LACP) mode to load balance the traffic in addition to providing failover.
Network Zone
Select the network zone for the interface.
Available Options:
LAN WAN DMZ WiFi
Figure 91: Global Settings
3. Enter the IPv4 configuration details.
IP Assignment
Select the type of IP assignment.
Available Options:StaticDHCP
IPv4/Netmask
Enter the IPv4 address for the interface and select the network subnet mask.
4. Enter the IPv4 gateway details (Available only if Network Zone selected is WAN)
Gateway Name
Enter the gateway name.
IPv4 Address
Enter the gateway IPv4 address.
Sophos XG Firewall | Configure | 118
Figure 92: IPv4 Configuration - Static
5. Enter the IPv6 configuration details.
IPv6/Prefix
Enter the IPv6 address and the prefix.
6. Enter the IPv6 gateway details (Available only if Network Zone selected is WAN).
Gateway Name
Enter the gateway name.
IPv6 Address
Enter the gateway IPv6 address.
Figure 93: IPv6 Configuration
7. Enter the details for Advanced Settings.
Interface Speed
Select the interface speed for synchronization. Interface speed can also be configured through CLI using the set network interface-speed command.
Speed mismatch between the device and third-party routers and switches can result in errors or collisions on the interface, disconnection, traffic latency, or slow performance.
Default: Auto Negotiation
MTU
Enter the MTU (Maximum Transmission Unit) value.
MTU is the largest physical packet size (in bytes) that a network can transmit. Problem arises when networks with differing MTU sizes are interconnected. In such a scenario, packets larger than the specified MTU value are divided (fragmented) into smaller packets before they are sent.
Default: 1500
Acceptable Range (For IPv4 Configuration): 576 to 1500
Acceptable Range (For IPv6 Configuration): 1280 to 1500
Override MSS
Select the checkbox to override the default MSS (Maximum Segment Size).
MSS defines the amount of data that can be transmitted in a single TCP packet.
Default: 1460
Sophos XG Firewall | Configure | 119
Acceptable Range: 536 to 1460
Xmit Hash Policy (Available only if Mode selected is LACP (802.3ad))
Select the Xmit hash policy to be applied to the member interfaces from the available options in the drop-down list:
Available Options:
Layer2:Select to generate the hash value using MAC Addresses. Layer2+3:Select to generate the hash value using a combination of Layer 2 (MAC Address) and Layer 3 (IP Address) protocol information. Layer3+4:Select to generate the hash value using Transport layer protocol information.
Primary Interface (Available only if Mode selected is Active-Backup )
Select an interface to be the primary interface. This interface remains active as long as it is available.
Default: Auto
The interfaces included in the member interface list are listed here. If you set the Primary Interface to Auto, the device selects any interface from the member interface list as the primary interface.
Use Default MAC Address
Click to use the default MAC address of the interface.
Override Default MAC Address
Click to override the default MAC address of the interface and enter the new MAC address.
On factory reset, it will be set to the default MAC address.
Figure 94: Advanced Settings
8. Click Save.
Add RED
This page allows you to configure a Remote Ethernet Device (RED) at a remote office.
1. Ensure that RED is activated. This can be done from Configure > System Services > RED.
2. Go to Configure > Network, click Add Interface on the upper right and select Add RED from the drop-down list.
3. Enter the RED Settings details.
Branch Name
Enter the name for the remote location in which the RED is to be set up.
Type
Select the RED device to be connected from the drop-down list.
Sophos XG Firewall | Configure | 120
• RED 10
• RED 15
• RED 15w
• RED 50
• Firewall RED Server
• Firewall RED Client
• Firewall RED Server Legacy
• Firewall RED Client Legacy
Note: RED device Firewall RED Server Legacy and Firewall RED Client Legacy are able to connect Sophos XG Firewall with Sophos UTM via RED Site2Site. For more information, see
RED Site-to-Site between Sophos XG Firewall and Sophos
RED ID (not available for Type Firewall RED Server, Firewall RED Server Legacy, Firewall RED Client
and Firewall RED Client Legacy)
Enter the RED ID.
The RED ID is a 15-character string printed on the sticker which is stuck to the bottom of the RED device as well as on the front of the carton.
Tunnel ID (not available if Type is Firewall RED Client and Firewall RED Client Legacy)
Select the Tunnel ID from the drop-down list.
By default, Automatic is selected. Tunnels are numbered consecutively. Select a unique tunnel ID and make sure that it is the same for both the devices - RED and Sophos XG Firewall.
Note: If the type is Firewall RED Server Legacy or Firewall RED Server Legacy make sure that the tunnel ID is available on the appliance that should be connected.
Unlock Code
Enter the unlock code. (Do not fill this field if this RED is being deployed for the first time.)
The unlock code is an 8-character string that is generated when a RED is added to a Sophos XG
Firewall. If this RED has been deployed before, you must enter the unlock code here. The unlock code is generated during the deployment of a RED device, and is emailed instantly to the address you provided by activating RED. This is a security feature, which ensures that a RED device cannot simply be removed and installed elsewhere.
For manual deployment through USB stick and for automatic deployment through Provisioning
Service (see
below), two separate unlock codes are generated. If you switch a
RED device from one deployment method to the other, make sure that you use the corresponding unlock code: For manual deployment, provide the unlock code of the previous manual deployment; for automatic deployment, provide the unlock code of the previous automatic deployment.
Firewall IP/Hostname (not available for Type Firewall RED Server and Firewall RED Server Legacy)
Enter the hostname of the Sophos XG Firewall.
The hostname must be a publicly resolvable DNS name or IP address for the Sophos XG Firewall.
The RED will use this name or the IP address to connect back to the Sophos XG Firewall.
2nd Firewall IP/Hostname (not available if client Type is RED 10)
Specify the hostname of the second Sophos XG Firewall.
Use 2nd IP/Hostname for (not available if client Type is RED 10)
Select from the following options:
• Failover: Ensures that the secondary Sophos XG Firewall takes over when the primary Sophos
XG Firewall fails. The secondary host takes over automatically without loss of connection.
• Load Balancing: Distributes traffic equally between, the primary and the secondary Sophos XG
Firewall.
Sophos XG Firewall | Configure | 121
Provisioning File (available only if Type is Firewall RED Client or Firewall RED Client Legacy)
To provide the configuration data to the remote client device. Upload the provisioning file using the
Browse button and transfer the file to the remote device.
Description
Enter a description for the RED interface.
Device deployment
Select the deployment method:
• Automatically via Provisioning Service
• Manually via USB Stick
Note: If you select manual deployment, it is extremely important to retain the unlock code, which is sent by email. If you lose the unlock code, you can never connect the RED device again to another Sophos XG Firewall and you have to contact the Sophos Support.
By default, Sophos XG Firewall provides the RED’s configuration data automatically via Sophos’
RED Provisioning Service. In this case, the RED device receives its configuration via Internet.
If the RED does not have an Internet connection, you can provide the configuration manually, via USB stick. If you deploy a RED device manually, you have to ensure that the Sophos XG
Firewall is acting as NTP server. Activate the NTP on the Sophos XG Firewall under System >
Administration > Time and allow the correct network or the IP address of the RED.
Figure 95: Add RED Interface
4. Enter the details for Uplink Settings.
Uplink Connection
Select the connection type for the uplink:
• DHCP: The RED pulls an IP address from a DHCP server.
• Static: Enter an IP address, the corresponding netmask, a gateway and a DNS server IP address.
2nd Uplink Connection (available only if client Type is RED 50 is selected)
Select the connection type for the uplink:
• DHCP: The RED pulls an IP address from a DHCP server.
• Static: Enter an IP address, a corresponding netmask, gateway and DNS server IP address.
2nd Uplink Mode (available only if client Type is RED 50)
Sophos XG Firewall | Configure | 122
Select an uplink mode for the 2nd host.
• Failover
• Load Balancing
3G/UMTS Failover (not available if Operation Mode is Transparent/Split)
Select to enable the 3G/UMTS failover function. Clear the check box to disable the function.
Note: Plug in a 3G/UMTS USB stick into the RED’s USB port. The stick can provide
Internet uplink failover in case of WAN interface failure. For the necessary settings refer to your Internet provider’s data sheet.
• Mobile Network: Select the mobile network type from the drop-down list.
• GSM
• CDMA
• Username/Password (available only if CDMA is selected): If required, specify a username and password for the mobile network.
• PIN (available only if GSM is selected): Specify the PIN of the SIM card if a PIN is configured.
Note: If you specify a wrong PIN, the connection cannot be established through
3G/UMTS in case of WAN interface failure. Instead, the 3G/UMTS Failover checkbox of the RED device is automatically cleared. Thus, the wrong PIN is used only once. When the WAN interface comes up again, the RED device displays a warning: A wrong PIN was entered for 3G/UMTS failover uplink. Please change
the login data.. When you open the Edit RED dialog box, a message is displayed which tells you that the 3G/UMTS failover was automatically unselected. Enter the correct PIN and select the checkbox. After making three connection attempts with a wrong PIN, the SIM card is locked. It cannot be unlocking through the RED device or Sophos XG Firewall and you have to contact the Sophos support.
• APN (available only if GSM is selected): Enter your provider’s access point name information.
• Dial String : If your provider uses a different dial string, enter it here.
Default for GSM: *99#
Default for CDMA: #777
Figure 96: RED Uplink Settings
5. Specify the RED Network Settings details.
RED Operation Mode
Select to define how the remote network is to be integrated into your local network:
• Standard/Unified: All the remote network traffic is routed through the Sophos XG Firewall which serves as the DHCP server and as the default gateway too. Sophos XG Firewall has complete control over the network traffic of the remote network. It can apply firewall rules to traffic between the local and remote LANs as well as filter web traffic and applications of the remote network.
Note: Handle VLAN traffic through this mode if VLAN is deployed behind the
RED.
• Standard/Split: Only traffic to select local networks is routed through the Sophos XG Firewall.
Select the local networks from the drop-down list in the Split Network box or create new networks which can be accessed by the RED. Sophos XG Firewall controls the traffic to these
Sophos XG Firewall | Configure | 123 networks from the remote network. It also serves as the DHCP server and as the default gateway.
All other remote network traffic is sent directly out through the local Internet connection.
Note: VLAN tagged frames cannot be handled in this operation mode. To use a
VLAN behind your RED device, select the Standard/Unified operation mode.
• Transparent/Split (not available if 3G/UMTS Failover is selected): Sophos XG Firewall does not control network traffic of the remote network, nor does it serve as the DHCP server nor as the default gateway. On the contrary, it pulls an IP address of the remote network from the DHCP server to become part of that network. However, you can enable access to the local network for remote clients. Define split networks that can be accessed by the remote network.
Additionally, you can define one or more split domains to be accessible. If your local domains are not publicly resolvable, define a Split DNS Server, which can be queried by the remote clients.
Note: VLAN tagged frames cannot be handled in this operation mode. To use a VLAN behind your RED device, select the Standard/Unified operation mode instead.
RED IP (not available if Transparent/Split is selected)
Enter the IP address of the RED device.
RED Netmask (not available if Transparent/Split is selected)
Select the netmask from the drop-down list.
Zone
Select the zone from the drop-down list:
• LAN
• DMZ
• VPN
• WiFi
Configure DHCP
Enable to configure a DHCP range for RED.
RED DHCP Range (available only if Configure DHCP is selected)
Enter the DHCP range which the RED is allowed to use.
Split DNS Server (available only if Transparent/Split is selected)
If your local domains are not publicly resolvable, you need to define a Split DNS Server, which can be queried by remote clients.
Split Network (not available if Standard/Unified is selected)
Select the split networks from the drop-down list or add more networks.
Note: Traffic to the networks listed in the Split Network box is redirected to your
Sophos XG Firewall. The remaining traffic is directly routed to the Internet.
To check traffic from the branch office to the main office intranet for viruses, route it through the Sophos XG Firewall. Or use the Sophos XG Firewall as an HTTP proxy.
Split Domains (not available if Transparent/Split is selected)
Add one or more split domains.
Note: Since Sophos XG Firewall is only a client of the remote network, it is not possible to route traffic to the split networks the way it is done with the other modes.
Therefore, the RED device intercepts all traffic: Traffic targeting to a network listed in the Split Network box or going to a domain listed in the Split Domain box is redirected to the Sophos XG Firewall interface. This is accomplished by replacing the default gateway’s MAC address in the respective data packets with the MAC address of Sophos XG Firewall.
Sophos XG Firewall | Configure | 124
Example: A partner or service provider requires access to your intranet or a certain server in your local network. Using a RED device the partner’s network remains completely independent of your network, but they can access a defined part of your network for certain purposes, as if they were connected via LAN.
MAC Filtering Type
To restrict the MAC addresses allowed to connect to the RED device select Blacklist or Whitelist.
Whitelist: Only MAC addresses listed in the MAC Address list are allowed.
Blacklist, MAC addresses listed in the MAC address list are not allowed.
MAC Address: The list of MAC addresses used to allow or restrict access to the RED device. MAC address lists can be created on the System > Hosts and Services > MAC Host page.
Note: MAC filtering only works for RED rev. 2 or newer. For RED 10, a maximum of 200 MAC addresses is allowed, whereas for RED 50, the list may contain up to 400
MAC addresses.
Tunnel Compression
Select to compress all traffic sent through the RED tunnel. Data compression can increase the throughput of the RED device deployed in regions with very slow Internet connection such as
1-2 MBps. However, performance increase depends on the data’s potential to be compressed (for example, data that is already compressed such as HTTPS or SSH cannot be compressed further). In some circumstances enabling data compression can actually reduce throughput of the RED device.
In such case, disable data compression.
Note: Tunnel compression is not available for RED 10 rev.1.
Figure 97: RED Network Settings
6. Enter the details of Switch Settings (available only if client Type is RED 50).
Switchport Mode
RED 50 offers four LAN ports that can be configured either as simple switches or for intelligent
VLAN usage. When set to Switch, all the traffic is sent to all ports. When set to VLAN, traffic can be filtered according to the Ethernet frames’ VLAN tag, thus allowing the tunneling of more than one network into the RED tunnel.
Select the switchport mode for the switch settings
• Switch: RED 50 uses the switch by default.
Sophos XG Firewall | Configure | 125
• VLAN: Select the LAN port(s) and enter the LAN VID(s).
When using the VLAN switch port configuration, you can configure each LAN port separately. For each LAN port, the following options are available:
• Untagged (Hybrid Port): Ethernet frames with the VLAN IDs specified in the LAN VID(s) field below will be sent to this port. The frames are sent without tags, thus the end devices do not have to support VLAN. This port allows just one VLAN ID.
• Untagged, drop tagged (Access port): Ethernet frames with the VLAN IDs specified in the
LAN VID(s) field below will not be sent to this port. The frames are sent without tags, thus the end devices do not have to support VLAN.
• Tagged (Trunk Port): Ethernet frames with the VLAN IDs specified in the LAN VID(s) field below will be sent to this port. The frames are sent with tags, and the end devices have to support VLAN. Frames without VLAN IDs will not be sent to this port. This port allows up to
64 different VLAN ID(s) separated by comma.
• Disabled: This port is closed. No frames with or without VLAN IDs specified in the LAN
VID(s) will be sent to this port.
7. Click Save.
Note: If the message “Registering with RED service failed. Please make sure that this device can connect to the Internet on port 3400” appears, a network problem has occurred. Check if you can reach red.astaro.com through port 3400 (via console command telnet red.astaro.com 3400). If you can, the error could be due to high network load. Retry to connect later.
Related tasks
This page describes how to configure RED.
Related information
RED Supported 3G/4G/LTE USB Dongles
Manage RED Interface
This chapter describes the functions of the icon of RED interfaces on the Configure > Network > Interfaces page.
The following options are available:
Activate/deactivate
The toggle switch next to the branch name shows the status of the interface. Click it to turn it on/off.
Note: The RED interface is deactivated and can not be edited if the RED device is bound to another system.
Download Provisioning file
This option is available only if the RED interface is in offline provisioning mode (if Device Deployment is set to
Manually via USB Stick).
Clicking on the link will download the provisioning file for the RED device. Save the file to the root directory of a USB stick. Then plug the USB stick into the RED appliance before turning it on. The RED will fetch its configuration from the USB stick. After that the connection between your appliance and the RED appliance is going to be established.
Note: It is crucial that you keep the unlock code, which is emailed instantly to the address provided on the
RED Configuration page as soon as the RED appliance receives its configuration. (In case of switching between manual and automatic deployment, make sure to keep both unlock codes.) You need the unlock code when you want to use the RED appliance with another Sophos XG Firewall. If you then do not have the unlock code ready, the only way to unlock the RED appliance is to contact the Sophos Support. The Support
Sophos XG Firewall | Configure | 126 however can only help you if you deployed the configuration automatically, via the RED Provisioning
Service.
3G/UMTS Failover
Displays if the 3G/UMTS Failover function is enabled or disabled.
Configure RED Site-to-Site Tunnel
This page describes how to set up a RED Site-to-Site Tunnel.
For such a connection, you need a RED server and a RED client. RED Site-toSite connection is also possible between
Sophos XG Firewall and Sophos UTM using the RED server legacy and RED client legacy. For more information,
RED Site-to-Site between Sophos XG Firewall and Sophos UTM
on page 126.
1. Configure the Firewall RED Server on the server machine.
How to configure RED is described in chapter
on page 286.
2. Add a RED interface on the Interfaces page.
How to add a RED interface is described in chapter
3. Go to Configure > Network > Interfaces.
4.
On the required RED interface, click the icon towards the right and select Download Provisioning File.
5. Configure the Firewall RED Client on the client machine and upload the provisioning file you downloaded from the server machine.
The RED Site-to-Site tunnel has been established and is active. You can control the RED connection status on both machines in the Network Security Control Center in the section User Threat Quotient.
RED Site-to-Site between Sophos XG Firewall and Sophos UTM
RED Site-toSite connection is also possible between Sophos XG Firewall and Sophos UTM. Select interface type
RED Server Legacy if you want to use Sophos XG Firewall as a RED firewall server for a Sophos UTM client. The provisioning file needs to be uploaded in the Sophos UTM client management. When you use Sophos UTM as RED firewall you need to upload the provisioning file from the Sophos UTM in a Sophos XG Firewall interface with type
RED Client Legacy.
Sophos XG Firewall as RED Firewall server
This page describes how to set up a RED Site-to-Site Tunnel between Sophos XG Firewall as RED firewall server legacy and Sophos UTM as RED client.
1. Ensure that RED on Sophos XG Firewall is activated. This can be done from Configure > System Services >
RED.
2. Go to Configure > Network, click Add Interface on the upper right and select Add RED from the drop-down list.
3. Create a RED interface with type RED Firewall Server Legacy.
How to create a RED interface is described in chapter
on page 119.
4. Download the provisioning file.
5. Log in to Sophos UTM.
6. Ensure that RED on Sophos UTM is activated. This can be done from RED Management > Global Settings.
7. Go to RED Management > [Client] Tunnel Management, click New Tunnel.
8. Create a tunnel and upload the provisioning file from Sophos XG Firewall.
How to create a tunnel is described in
Sophos UTM Administration Guide
(Chapter 15.5 Tunnel Management).
9. Go to Interface & Routing > Interfaces, click New Interface.
10. Create a interface with the RED tunnel.
How to create a RED interface is described in
Sophos UTM Administration Guide
(Chapter 6.1 Interfaces).
The Site-to-Site connection between Sophos XG Firewall and Sophos UTM is now activated and can be seen in SF-
OS under Configure > Network > Interfaces and in the Control Center.
Sophos XG Firewall | Configure | 127
Sophos UTM as RED Firewall Server
This page describes how to set up a RED Site-to-Site Tunnel between Sophos UTM as RED firewall server and
Sophos XG Firewall as RED client legacy.
1. Ensure that RED on Sophos UTM is activated. This can be done from RED Management > Global Settings.
2. Go to RED Management > [Server] Client Management, click New RED.
3. Create a RED.
How to create a RED is described in
Sophos UTM Administration Guide
(Chapter 15.3 Client Management).
4. Download the provisioning file.
5. Go to Interface & Routing > Interfaces, click New Interface.
6. Create an interface with the RED server.
How to create a RED interface in Sophos UTM is described in
Sophos UTM Administration Guide
(Chapter 6.1
Interfaces).
7. Ensure that RED on Sophos XG Firewall is activated. This can be done from Configure > System Services >
RED.
8. Go to Configure > Network, click Add Interface on the upper right and select Add RED from the drop-down list.
9. Create a RED interface with type RED Firewall Client Legacy and upload the provisioning file from Sophos
UTM.
How to create a RED interface is described in chapter
on page 119.
The Site-to-Site connection is between Sophos XG Firewall and Sophos UTM is now activated and can be seen in SF-
OS under Configure > Network > Interfaces and in the Control Center.
Tap
The device provides seamless proof of concept through the Discover Mode, allowing you to evaluate its security performance prior to purchase. Through the Tap interface, Discover Mode enables you to monitor network traffic without making any change in the current network schema.
Connect the device to a switch through which all the network traffic passes. Configure the switch to forward a copy of every packet passing through it to the device. The device monitors the traffic passively and generates a Security
Assessment Report (SAR) from the gathered data. SAR provides visibility into potential risks within the network, including application and web risks, risky users, intrusion risks, and more.
Note:
• When deployed in Discover Mode, the device functions in listening mode. Hence, no firewall rule is applied.
• Only unbound physical interfaces can be configured in Discover mode.
• For interfaces configured in Discover Mode, the Interfaces page displays the zone name as Discover.
• The Tap interface cannot be updated or deleted.
• Subscription to Network Protection and Web Protection modules is required for the analysis of IPS, Web
Filter and Application Filter policies.
• Pre-requisites for Discover Mode:
• The device must be connected to the Internet for web classification, IPS updates and SAR generation in the cloud.
• The device must be integrated with external authentication servers, such as Active Directory,
RADIUS, LDAP etc., for the SAR to provide user-specific data.
Enable Discover Mode
This page allows you to enable the Discover Mode through the Tap interface.
1. Access the CLI console by clicking admin on the upper right-hand corner of the Admin Console screen.
2. Select the option Console.
Sophos XG Firewall | Configure | 128
3. Provide the admin password.
4. Select the option 4. Device Console.
5. Execute the following command to enable discover mode: console> system discover-mode tap add
<Port>
Figure 98: Enable Discover Mode
The message “Discover Interface added successfully” is displayed on the CLI. Additionally, the interface configured in Discover Mode displays the message “Discover, Physical (Tap)” on the Interfaces page.
Zones
This page displays a list of all the zones including system zones and lets you manage the zones.
A zone is a logical grouping of ports/physical interfaces and/or virtual sub-interfaces if defined.
Zones provide a flexible layer of security for the firewall. With the zone-based security, the administrator can group similar ports and apply the same policies to them instead of writing the same policy for each interface.
Next to the Name of the zone type, the list displays the Members belonging to the specific zone, the zone Type, the kind of Device Access and, optionally, a Description.
Default Zone Types
• LAN - Depending on the device in use and network design, you can group one to six physical ports in this zone.
Group multiple interfaces with different network subnets to manage them as a single entity. Group all the LAN networks under this zone.
• By default the traffic to and from this zone is blocked and hence, it is the most secured zone. However, traffic between ports belonging to same zone with different networks will be allowed if the policy is applied for LAN to
LAN.
• DMZ (DeMilitarized Zone) – This zone is normally used for publicly accessible servers. Depending on the device in use and network design, you can group multiple physical ports in this zone.
• WAN - This zone is used for Internet services. It can also be referred to as Internet zone.
• VPN – This zone is used for simplifying secure, remote connectivity. It is the only zone that does not have an assigned physical port/interface. Whenever the VPN connection is established, the port/interface used by the connection is automatically added to this zone and on disconnection; the port is automatically removed from the zone. Like all other default zones, scanning and access policies can be applied on the traffic for this zone.
• WiFi - This zone is used for wireless Internet services.
The device is shipped with a single zone for LAN, WAN, DMZ, VPN and WiFi. These zones are called system zones.
Additionally, you can define LAN and DMZ zone types.
Add Zone
1. Go to Configure > Network > Zonesand click Add.
2. Enter the zone details.
Name
Enter a name to identify the zone.
Description
Enter the description for the zone.
Type
Select the type of zone from the available options. LAN - Depending on the device in use and network design, you can group one to six physical ports in this zone. Group multiple interfaces with
Sophos XG Firewall | Configure | 129 different network subnets to manage them as a single entity. Group all the LAN networks under this zone.
By default the traffic to and from this zone is blocked and hence, it is the highest secured zone.
However, traffic between ports belonging to the same zone will be allowed.
DMZ (DeMilitarized Zone) - This zone is normally used for publicly accessible servers.
Depending on the device in use and network design, you can group one to five physical ports in this zone.
Note: By default, the entire traffic will be blocked except LAN to Local zone services like administration, authentication, and network.
Members
Displays all the member ports.
Click the checkbox to select the ports. All the selected ports are moved to the ‘Selected port’ list.
Device Access
Device access defines the type of administrative access permitted to a zone.
Admin Services - Enable administrative services that should be allowed through this zone:
• HTTPS - Allow secure HTTPS connection to the admin console through this zone
• Telnet – Allow Telnet connection to CLI through this zone
• SSH – Allow SSH connection to CLI through this zone
Authentication Services – Enable authentication services that should be allowed through this zone:
• Client Authentication
• Captive Portal
• NTLM
• Radius SSO
Network Services - Enable network services that should be allowed through this zone:
• DNS – Allow this zone to respond to DNS requests
• Ping/Ping6 – Allow this zone to respond to pings
Other Services - Enable other services that should be allowed through this zone:
• Web Proxy
• SSL VPN Tunnel
• Wireless Protection
• User Portal
• Dynamic Routing
• SNMP
• SMTP Relay
Sophos XG Firewall | Configure | 130
Figure 99: Add Zone
3. Click Save.
Note:
• If DMZ uses a private IP address, use NATing to make them publicly accessible.
• Local and VPN zones cannot be updated or deleted.
The new zone has been created and appears on the Zones page.
WAN Link Manager
A gateway routes traffic between the networks, and if the gateway fails, communication with an external network is not possible.
By default, the device supports only one gateway. However, to cope with gateway failure problems, the device provides an option to configure multiple gateways. But simply adding one more gateway is not an end to the problem.
Optimal utilization of all the gateways is also necessary. The device’s WAN Link Manager provides link failure protection by detecting the dead gateway and switching over to an active link. It also offers a mechanism to balance traffic between various links.
At the time of deployment, you have configured the IP address for a default gateway through the Network
Configuration Wizard. You can change this configuration any time and configure additional gateways. You can use the WAN Link Manger to configure multiple gateways for load balancing and failover.
By default, all the gateways defined through the Network Configuration Wizard will be defined as “Active” gateway.
The device provides a powerful solution for routing and managing traffic across multiple Internet connections.
Designed to provide business continuity for an organization of any size, the WAN Link Manager optimizes the use of multiple Internet links, such as T1s, T3s, DSL and cable connections from one or multiple Internet service providers.
Capable of automatic failover in the event of link failure, it helps to assure that your network is always connected to the Internet.
It also gives you an option to configure multiple WAN interfaces to allow connecting your device to more than one
Internet service provider (ISP).
Sophos XG Firewall | Configure | 131
When you configure multiple external interfaces, you even have an option to control which interface an outgoing packet uses.
Load Balancing
Load balancing is a mechanism that permits to balance traffic between various links. It distributes traffic among various links, optimizing utilization of all the links to accelerate performance and cut operating costs. The device employs weighted round robin algorithm for load balancing to reach maximum utilization of the capacities across the various links.
Using link load balancing gives organizations the possibility to achieve:
• Traffic distribution that does not overburden any link
• Automatic ISP failover
• Improved user performance because of no downtime
• Increased bandwidth scalability
To achieve outbound traffic load balancing between multiple links:
• Configure links in active-active setup, defining gateways as Active
• Assign an appropriate weight to each gateway. Traffic is distributed across the links in proportion to the ratio of weights assigned to individual links.
How it works
Load balancing is determined by the load metric. The load metric is weight. Each link is assigned a relative weight and the device distributes traffic across links in proportion to the ratio of weights assigned to individual links. This weight determines how much traffic will pass through a particular link in relation to the other link(s).
The administrator can set the weight and define how the traffic will be directed to providers to best utilize their bandwidth investments. Weight can be selected based on:
• Link capacity (for links with different bandwidths)
• Link/Bandwidth cost (for links with varying costs)
A weighted load balancing feature enables network managers to optimize network traffic and balance the load between multiple links/interfaces.
Gateway failover
Gateway failover provides link failure protection so that when one link goes down; the traffic is switched over to the active link. This safeguard helps to provide uninterrupted, continuous Internet connectivity to users. The transition is seamless and transparent to the end user with no disruption in service and without downtime.
To achieve WAN failover between multiple links:
• Configure links in active-backup setup
• Define Active gateway/interface
• Define backup gateway/interface – Traffic through this link is routed only when the active interface is down
• Define failover rule
In the event of Internet link failure, the WAN Link Manager automatically sends traffic to available Internet connections without administrator intervention. If more than one link is configured as backup link, traffic is distributed among the links in the ratio of the weights assigned to them. On failover, the backup gateway can inherit the parent gateway’s (active gateway) weight or can be configured.
The transition from the dead link to the active link is based on the failover rule defined for the link. The failover rule specifies:
• how to check whether the link is active or dead
• what action to take when a link is not active
Sophos XG Firewall | Configure | 132
The failover rule has the form:
IF Condition 1 AND/OR Condition 2 then Action
Depending on the outcome of the condition, traffic is shifted to any other available gateway.
A ping rule is automatically created for every gateway. The device periodically sends the ping request to check health of the link and if link does not respond, traffic is automatically sent through another available link. The selection of the gateway and how much traffic is to be routed through each gateway depends on the number of configured active and backup gateways.
Gateway Failback
During a link failure, the device regularly checks the health of a given connection, assuring a fast reconnection as soon as the Internet service is restored. When the connection is restored and the gateway is up again, without the administrator’s intervention, traffic is again routed through the active gateway. In other words, the backup gateway fails back on the active gateway.
WAN Link Manager
The WAN Link Manager page displays a list of configured IPv4 and IPv6 gateways. The page also displays the status
Active or Deactive for each gateway and failover rule in case multiple gateways are configured. You can change the gateway parameters, change the gateway status, add or remove the failover rule, and view the data transfer passed through the gateway.
For the backup gateway, the weight is NA while for the active gateway, the configured weight is displayed.
Click the data transfer icon under the Manage column of the corresponding gateway to view the total data transferred through the gateway in graphical as well as in tabular form.
Gateway Failover Timeout Configuration
Gateway Failover Timeout
Configure the gateway failover timeout in seconds.
This is the time period the device waits before the gateway failover occurs.
Default: 60 seconds
Acceptable Range: 1 to 65535
Figure 100: Gateway Failover Timeout Configuration
Update Gateway Configuration
1. Go to Configure > Network > WAN Link Manager, click the gateway’s Name hyperlink or click the edit icon under the Manage column to edit its settings.
2. Enter the gateway details.
Name
Enter the name of the gateway.
IP Address
Enter the IP address assigned to the gateway.
Interface
Sophos XG Firewall | Configure | 133
Specify the IP address of the interface.
Type
Specify the type of the gateway.
Available Options: Active - Traffic will route through the active gateway(s). If more than one active gateway is configured then the traffic will be load balanced between these gateways depending on the weight assigned to the each gateway.Backup – A gateway used in an active/ passive setup, where traffic is routed through the backup gateway only when the active gateway is down.
Weight
Depending on the weight, the gateway is selected for load balancing. The device distributes traffic across links in proportion to the ratio of weights assigned to individual links.
This weight determines how much traffic will pass through a particular link relative to the other link(s).
Gateways can be assigned a weight from 1 to100.
Note: When multiple gateways are configured and one gateway goes down, the traffic is switched over to the available gateways according to the ratio of the weights assigned to the available gateways.
Default NAT Policy
Select the NAT policy to be used as default for a particular gateway.
By default, the MASQ NAT policy is configured.
Select None, if NAT should not be applied on that particular gateway.
Figure 101: Update Active Gateway Configuration
3. Enter the backup gateway details (Only available, if the type is Backup)
Activate This Gateway
Select gateway activation condition: automatically or manually.
Automatic failover
For automatic failover, activate the option If ... Active gateway fails.
From the dropdown list, specify when the backup gateway should take over from the active gateway. This takeover process will not require the administrator’s intervention.
Available Options:
• Specific Gateway - The dropdown list displays all configured gateways. The backup gateway will take over and traffic will be routed through the backup gateway only when the selected gateway fails.
Sophos XG Firewall | Configure | 134
• ANY – The backup gateway will take over and traffic will be routed through the backup gateway when any of the active gateway fails.
• ALL – The backup gateway will take over and traffic will be routed through the backup gateway when all the configured active gateways fail.
Manual failover
If you select Manually, the administrator will have to change the gateway manually when the active gateway fails.
Action on Activation
Configure weight for the backup gateway. The device distributes traffic across links in proportion to the ratio of weights assigned to individual link. This weight determines how much traffic will pass through a particular link relative to the other link.
Inherit weight of the failed active gateway
If this option is selected, the backup gateway will inherit the parent gateway’s (active gateway) weight
Use configured weight
If this option is selected, the weight specified in the Weight field will be used for the backup gateway.
Figure 102: Backup Gateway Details
4. Click Save.
The gateway details have been updated.
5. Configure the Failover Rules.
IF Then Condition
From the dropdown list, select the communication protocol, such as TCP or PING (ICMP). Select the protocol depending on the service to be tested on the host.
Port: For TCP communication, specify the port number for communication.
on IP Address: Specify the IP address of the computer or the network device which is permanently running or most reliable.
Condition
• AND - All the conditions must be satisfied before the specified action is taken
• OR - At least one condition must be satisfied before the specified action is taken.
A request is sent to an IP address. If the IP address does not respond to the request, the device considers the IP address as unreachable.
Sophos XG Firewall | Configure | 135
Figure 103: Configure Failover Rules
6. Click Save.
The failover rule has been updated.
Add Failover Rule
1. Go to Configure > Network > WAN Link Manager, click the gateway’s Name hyperlink or click the edit icon under the Manage column and click Add under the Failover Rules section.
2. Configure the failover rules.
IF Then Condition
From the dropdown list, select the communication protocol, such as TCP or PING (ICMP). Select the protocol depending on the service to be tested on the host.
Port: For TCP communication, specify the port number for communication.
on IP Address: Specify the IP address of the computer or the network device which is permanently running or most reliable.
Condition
• AND - All the conditions must be satisfied before the specified action is taken
• OR - At least one condition must be satisfied before the specified action is taken.
A request is sent to an IP address. If the IP address does not respond to the request, the device considers the IP address as unreachable.
Figure 104: Configure Failover Rules
3. Click Save.
The failover rule has been added.
Network Traffic Report for Default Gateway
Click the data transfer icon under the Manage column of the corresponding gateway to view the total data transferred through the gateway in graphical as well as in tabular form.
Network Traffic Report for Default Gateway
Period
From the available options, select the period for the report of the network traffic that passed through the gateway.
Available Options:
• Weekly
• Monthly
Sophos XG Firewall | Configure | 136
• Custom
The graph displays the upload, download and total data transfer through the gateway.
• X-axis: Date (depending on the period selected)
• Y-axis: KB/MB/GB used
Legend
• Orange Color – Upload Network Traffic (MB)
• Purple Color – Download Network Traffic (MB)
• Green Color – Total Network Traffic (MB)
Note: When the selected period is Custom, then the user can select to view data of not more than the last six (06) months. At one time, only thirty (30) days data will be displayed.
Figure 105: Network Transfer Report
DNS
Use this page to configure the DNS settings of the device.
The DNS server is configured at the time of installation. You can add additional DNS servers to which the device can connect for name resolution. If multiple DNS are defined, they are queried in the order as they are entered.
Note: You can also view and manage the DNS server status on the Monitor & Analyze > Diagnostics >
Services page.
Sophos XG Firewall supports static DNS host entry where the device acts as a DNS Name Server that provides the requesting client with A records to resolve their requested URL.
You can manually add static DNS host entries for a particular domain name. Sophos XG Firewall checks DNS host entries for the requested domain name. If the domain name requested by the user matches the DNS host entry then the device performs DNS resolution and replies to the client with the IP address found in the static DNS host entry. DNS requests do not need to be redirected to the Local/Authoritative DNS server any longer. This facilitates faster data
Sophos XG Firewall | Configure | 137 transfer and avoids multiple DNS resolution cycles for every client request. You can also add multiple IP addresses for a single website hosted behind Sophos XG Firewall.
When you want external domains names to be resolved through internal DNS servers in your network, you can add
DNS request routes to such servers. This will decrease the Internet traffic over the network and speed up DNS client requests as queries will not be forwarded outside the network. Also, DNS information would be less exposed on the
Internet thus enhancing security.
IPv4
Obtain DNS from DHCP
Click to override the device DNS with the DNS address received from the DHCP server.
The option is available if enabled from the Network Configuration Wizard or if a DHCP interface is configured.
Obtain DNS from PPPoE
Click to override the device DNS with the DNS address received from the PPPoE server.
The option is available if enabled from the Network Configuration Wizard or if a DHCP interface is configured.
Static DNS
Select to provide a static IPv4 DNS server address.
A maximum of three static DNS IPv4 addresses can be provided.
Figure 106: IPv4 DNS Settings
IPv6
Obtain DNS from DHCP
Click to override the device DNS with the DNS address received from the DHCP server.
The option is available if enabled from the Network Configuration Wizard or if a DHCP interface is configured.
Static DNS
Select to provide a static IPv6 DNS server address.
A maximum of three static DNS IPv6 addresses can be provided.
Sophos XG Firewall | Configure | 138
Figure 107: IPv6 DNS Settings
DNS Query Configuration
Choose server based on incoming requests record type
Select to choose the DNS server to be used for resolving the domain name on the basis of the incoming requests record type. Incoming request can be of A or AAAA type.
Choose IPv6 DNS server over IPv4
Select to first choose the IPv6 DNS server for resolving the DNS and then the IPv4 DNS server.
If both IPv6 and IPv4 DNS servers are configured, then it first selects the IPv6 DNS server for all requests followed by the IPv4 DNS server.
Choose IPv4 DNS server over IPv6
Select to first choose the IPv4 DNS server for resolving the DNS and then the IPv6 DNS server.
If both IPv6 and IPv4 DNS servers are configured, then it first selects the IPv4 DNS server for all requests followed by the IPv6 DNS server.
Choose IPv6 if request originator address is IPv6, else IPv4
Select to choose the IPv6 DNS server if a request is received from an IPv6 source or choose the
IPv4 DNS server, if a request is received from an IPv4 source.
Apply
Click to save the configuration.
Test Name Lookup
Click and provide an IP address or host name for testing the connectivity with the DNS server.
Figure 108: DNS Query Configuration
Sophos XG Firewall | Configure | 139
DNS Host Entry
The DNS Host Entry section displays the list of all the configured host entries. You can filter the list based on the host/domain name. This section provides the option to add, update, or delete entries.
DNS Request Route
This section displays a list of all the configured DNS request routes. You can filter the list based on the name or the target. Additionally, you can add, update and delete routes.
Add DNS Host Entry
1. Go to Configure > Network > DNS and click Add under DNS Host Entry section.
2. Enter the host entry details.
Host/Domain Name
Provide a fully qualified domain name (FQDN) for the host/domain.
Address
Enter the address details for the host entry.
Entry Type
Select the DNS host entry type.
Available Options:
• Manual – Enter the IP address for the host manually
• Interface IP – Configure an interface as host
IP Address
Specify the IP address of the host/domain or select an interface IP depending on the option selected for the entry type.
Maximum entries per host: 8
Time to Live (seconds)
Specify the TTL in seconds.
Default: 60 seconds
Weight
Specify the weight for load balancing the traffic. The device distributes traffic across the links in proportion to the ratio of weights assigned to individual links.
This weight determines how much traffic will pass through a particular link relative to the other link(s).
Default: 1
Publish on WAN
Enable to publish the DNS host entry on WAN.
Default: Disabled
Reverse DNS Lookup
Reverse DNS lookup is the resolution of an IP address to its designated domain name. Enable to allow reverse DNS lookup.
Note: If there are multiple hosts resolving to the same IP address then Reverse DNS
Lookup can only be configured for one of the IP addresses.
• Only A, AAAA, and PTR type of DNS records are supported.
• Address (A) record points a hostname to an IP address and returns a 32-bit IPv4 address.
Sophos XG Firewall | Configure | 140
• AAAA record points a hostname to an IP address and returns a 128-bit IPv6 address.
• Pointer records (PTR) are just the reverse of A records and are used for reverse lookups. They map the IP address to a hostname.
• Maximum DNS entries supported: 1024
• If the device interface is used as a DNS in the client system then a query is sent to the configured DNS servers prior to querying the ROOT severs.
Figure 109: DNS Host Entry
3. Click Save.
The DNS host entry has been created and appears on the DNS page.
Add DNS Request Route
1. Go to Configure > Network > DNS and click Add under DNS Request Route section.
2. Enter DNS request route details.
Host/Domain Name
Specify the domain for which you want to use the internal DNS server.
Target Servers
Select a DNS server(s) to resolve the domain specified above.
You can also add IP address to the DNS from this page by entering it in the entry field. Up to eight
IP addresses can be added.
Figure 110: Add DNS Request Route
3. Click Save.
Sophos XG Firewall | Configure | 141
The DNS request route has been created and appears on the DNS page.
DHCP
The DHCP section allows you to configure DHCP for your network.
On a network, the dynamic host configuration protocol (DHCP) automatically assigns IP addresses to the hosts on a network, thus reducing the administrator’s configuration task. Instead of requiring administrators to assign, track and change (when necessary) IP addresses for every host on a network, DHCP settles it automatically. Furthermore,
DHCP ensures that duplicate addresses are not used.
The DHCP section covers the following topics:
Server
The device acts as a DHCP server: it assigns a unique IP address to a host and releases the address when the host leaves and re-joins the network. Each time, when the host connects to the network, it can have another IP address. In other words, the device provides a mechanism for allocating the IP address dynamically so that addresses can be reused.
An interface having static IP assignment can also act as a DHCP server. You can disable or change this DHCP server configuration. You can configure IPv4 and IPv6 DHCP servers.
Using the Server section, you can configure, manage, and enable/disable DHCP servers on the device. It displays a list of all configured DHCP servers, and you can filter the list based on the IP family.
Note:
• The device cannot act as DHCPv6 server and DHCPv6 relay agent simultaneously.
• DHCPv4 Server and DHCPv4 Relay cannot be configured using the same Interface.
Relay
Deploying DHCP in a single segment network is easy. All DHCP messages are IP broadcast messages, and therefore all the computers on the segment can listen and respond to these broadcasts. But things get complicated when there is more than one subnet on the network. The reason is that the DHCP broadcast messages do not cross the router interfaces by default. The DHCP relay agent makes it possible to place DHCP clients and DHCP servers on different networks. The relay agent allows DHCP broadcast messages to be sent over routers that do not support forwarding of these types of messages. The DHCP relay agent enables DHCP clients to obtain IP addresses from a DHCP server on a remote subnet, or from a server which is not located on the local subnet. If the DHCP relay agent is not configured, clients would only be able to obtain IP addresses from the DHCP server which is on the same subnet.
Using the Relay section, you can configure and manage DHCP relay agents on the device. It displays a list of all interfaces configured as a relay agent, and you can filter the list based on the relay agent name and the IP family.
Lease
The device acting as a DHCP server assigns or leases an IP address from an address pool to a host DHCP client. The
IP address is leased for a determined period of time or until the client relinquishes the address. The IPv4/IPv6 Lease section displays a list of all IPv4 and IPv6 addresses leased dynamically, and you can filter the lists based on the leased IP, or the client’s physical address.
IPv4 Lease
For each IPv4 address, the list displays the following:
• Leased IP address
• Leased start and end time
• Client physical address
• Client host name
• Lease type
Sophos XG Firewall | Configure | 142
IPv6 Lease
For each leased IPv6 address the list displays the following:
• Leased IP address
• Leased start and end time
• Client physical address
• DUID
Related information
Configure DHCP Options
Configure Interface as DHCPv4 Server
1. Go to Configure > Network > DHCP, click Add in the Server section and select IPv4 using the default filter.
2. Specify the General Settings details.
Name
Enter a name to identify the DHCPv4 server uniquely.
Interface
Select an interface to set it as DHCPv4 server. DHCP service can be configured on a virtual interface but not on an interface alias.
Note: DHCPv4 Server and DHCPv4 Relay cannot be configured using the same
Interface.
Accept Client request via Relay
Select this to accept client requests through DHCP Relay.
Note: If you select this option, Use Interface IP as Gateway is disabled.
Dynamic IP Lease
Specify the range of IP addresses from which the DHCP server must assign an IP address to the clients and set a subnet mask for the IP address range. You can configure multiple IP ranges for the same interface. Furthermore, you can provide multiple IP ranges for the DHCP server.
Click and to add or delete a range.
Static IP MAC Mapping
If you want to assign specific IP addresses to some or all clients permanently, you can define static
MAC address-to-IP address mappings. To define a MAC-IP mapping, you should know the MAC address of the client’s network card. The MAC address is usually specified in hexadecimal digits separated by colons (for example, 00:08:76:16:BC:21). Specify the host name, the MAC address and the IP address. You can provide multiple MAC-IP mappings for the DHCP server.
Use and to add or delete a MAC-IP mapping.
Subnet Mask
Select a subnet mask for the server.
Domain Name
Specify the domain name that the DHCP server will assign to the DHCP clients.
Gateway
Use this option to apply an interface IP as gateway.
Specify the IP address to be used as default gateway or select Use Interface IP as Gateway to use the IP address entered for Interface
Default Lease Time
Specify the default lease time.
Sophos XG Firewall | Configure | 143
Acceptable range: 1 to 43200 minutes (30 days)
Default: 1440 minutes
Max Lease Time
Specify the maximum lease time. The DHCP client must ask the DHCP server for new settings after the specified maximum lease time has expired.
Acceptable range: 1 to 43200 minutes (30 days)
Default: 2880 minutes
Conflict Detection
Enable IP conflict detection to check the IP address before leasing. If enabled, the already leased IP address will not be leased again.
Figure 111: General Settings
3. Specify the DNS Server details.
Use Device’s DNS Settings
Click to use the device’s DNS server. In this case, the first two configured DNS will be used.
If not enabled, provide a primary and secondary DNS to be used.
Primary DNS (available only if Use Device’ DNS Settings is disabled)
Specify the IP address of the primary DNS server.
Secondary DNS (available only if Use Device’ DNS Settings is disabled)
Specify the IP address of the secondary DNS server.
Sophos XG Firewall | Configure | 144
Figure 112: DNS Server details
4. Specify WINS Server details.
Primary WINS Server
Specify the IP address of the primary WINS server.
Secondary WINS Server
Specify the IP address of the secondary WINS server.
Figure 113: WINS Server details
5. Click Save.
6. To enable or disable the DHCP server, go to Configure > Network > DHCP and turn the Status On or Off.
Related information
Configure DHCP Options
Configure Interface as DHCPv6 Server
1. Go to Configure > Network > DHCP, click Add in the Server section and select IPv6 using the default filter.
2. Specify the General Settings details.
Name
Enter a name to identify the DHCPv6 server uniquely.
Interface
Select an interface to set it as DHCPv6 server. DHCP service can be configured on a virtual interface but not on an interface alias.
Accept Client request via Relay
Select this to accept client requests through DHCP Relay.
Dynamic IP Lease
Specify the range of IPv6 addresses from which the DHCP server must assign an IP address to the clients and set a subnet mask for the IPv6 address range. You can configure multiple IPv6 range for the same interface.
Furthermore, you can provide multiple IP ranged for the DHCP server.
Click and to add and delete a range.
Static IP DUID Mapping
If you want to assign specific IP addresses to some or all clients permanently, you can define static
DUID address-to-IP address mappings. To define DUID-IP mapping, you should know the DHCP
Unique Identifier (DUID) of the client. The DUID address is usually specified in groups of two hexadecimal digits separated by colons.
Sophos XG Firewall | Configure | 145
*Each DHCP client and server has a DUID. DHCP servers use DUIDs to identify clients for the selection of configuration parameters. DHCP clients use DUIDs to identify a server in messages where a server needs to be identified.
Specify the host name, DUID and the IP address. You can provide multiple DUID-IP mappings for the DHCP server.
Click and to add or delete a DUID-IP mapping.
Preferred Time
Specify the preferred time.
Acceptable range: 1 to 43200 minutes (30 days)
Default: 540 minutes
Note: Preferred time should be less than valid time.
Valid Time
Specify the valid time.
Acceptable range: 1 to 43200 minutes (30 days)
Default: 720 minutes
Figure 114: General Settings
3. Specify the DNS Server details.
Use Device’s DNS Settings
Click to use the device’s DNS server. In this case, the first two configured DNS will be used.
If not enabled, provide a primary and secondary DNS to be used.
Primary DNS (available only if Use Device’ DNS Settings is disabled)
Specify the IPv6 address of the primary DNS server.
Secondary DNS (available only if Use Device’ DNS Settings is disabled)
Specify the IPv6 address of the secondary DNS server.
Sophos XG Firewall | Configure | 146
Figure 115: DNS Server details
4. Click Save.
5. To enable or disable the DHCP server, go to Configure > Network > DHCP and turn the Status On or Off.
Related information
Configure DHCP Options
* RFC 3315 (Dynamic Host Configuration Protocol for IPv6 (DHCPv6)
Add DHCP Relay Configuration
1. Go to Configure > Network > DHCP and click Add in the Relay section.
2. Enter the DHCP relay configuration details.
Name
Provide a name to identify the DHCP relay agent.
IP Family
Select the IP family for the DHCP relay agent.
Available Options:
• IPv4
• IPv6
Interface
Select an interface on which your client network is configured. Device listens for DHCP queries on this interface and is used to forward packets between client and server.
Interfaces having a static IP assignment can act as a DHCP relay agent.
The DHCP relay agent can be configured on a virtual interface but not on an interface alias.
Note:
• The device cannot act as DHCPv6 server and DHCPv6 relay agent simultaneously.
• DHCPv4 Server and DHCPv4 Relay cannot be configured using the same
Interface.
DHCP Server IP
Specify the DHCP server IP address. You can also configure multiple DHCP servers. This facilitates deploying DHCP servers in high availability environment. The DHCP relay will forward packets to all configured DHCP servers, and the active server will serve the request. In case the active server goes down, the backup server serves the request. The DHCP server takes care of leasing the IP address to a client.
Maximum DHCP servers configurable per DHCP relay: 8
Relay through IPSec (Only availabe if IP family is IPv4)
Select to relay DHCP messages through an IPSec VPN tunnel.
Sophos XG Firewall | Configure | 147
Figure 116: Add DHCP Relay Configuration
3. Click Save.
The DHCP relay agent has been created and appears on the DHCP page.
IPv6 Router Advertisement
Address Assignment for IPv6 Devices
IPv6 clients are assigned an IP address through:
• DHCP for IPv6
• Stateless address auto configuration (SLAAC)
DHCP for IPv6
Similar to IPv4, IPv6 can use DHCP to assign IP addresses to any clients. The device can be configured to be a stateful DHCP server. The DHCP server is responsible for assigning the IP address to the client and for keeping a record of all clients and the IPv6 addresses assigned to them.
Stateless Address Auto Configuration
The IPv6 protocol supports address auto configuration for stateless addresses. IPv6 devices automatically create unique link-local addresses for IPv6 enabled interfaces, and clients use router advertisement messages to configure their own IP address automatically.
Router Advertisement
The device acting as a router has the ability to participate in stateless auto configuration (SLAAC) and by default provides a IPv6 address and a default gateway to the client.
When the device interface is connected to a network and enabled, the host may send out an ICMPv6 (type 135)
Router Solicitation (RS) message that requests the device to generate Router Advertisement (RA) immediately instead of waiting until their next scheduled time. On receiving the RS message, the device immediately sends an ICMPv6
(type 134) router advertisement (RA) message announcing the state of its availability. Router advertisements include information about which method to be used for address assignment, prefixes used for on-link determination and/or address configuration, hop limit value, several flag status, etc. The critical parameters can be administered centrally and if necessary, can be propagated automatically to all hosts on the network. The device advertises information about various interfaces and Internet parameters either periodically or in response to the RS message, informing all the nodes on the network about any modification regarding addressing information. Thus, Router advertisement (along
Sophos XG Firewall | Configure | 148 with prefix flags) permits simple stateless auto configuration and guides a host in generating an address using autoconfiguration.
Note: You can also view and manage the router advertisement service status on the Monitor & Analyze >
Diagnostics > Services page.
Configure IPv6 Router Advertisement settings
1. Go to Configure > Network > IPv6 Router Advertisement and click Add.
2. Enter details for the General Settings.
Interface
Select an interface for router advertisement.
All IPv6 enabled physical interfaces, LAG, VLAN and bridge interfaces can be selected.
Description
Enter a description for the interface to be selected for router advertisement.
Min Advertisement Interval
Specify the minimum time interval in seconds between two consecutive unsolicited router advertisement messages sent to the clients.
Acceptable range: 3 to 1350 seconds
Default: 198 seconds
If the Max Advertisement Interval is 9 seconds or above, then the Min Advertisement Interval must be: 0.75 * maximum advertisement interval.
Max Advertisement Interval
Specify the maximum time interval in seconds between two consecutive unsolicited router advertisement messages sent to the clients.
Acceptable Range: 4 to 1800 seconds
Default: 600 seconds
Managed Flag
Select to set the managed flag. When this flag is set, IPv6 addresses are obtained from the DHCPv6 server.
By default, this flag is not selected.
Note: The option must be selected only if a DHCPv6 Server is available else IPv6 clients would not get IPv6 addresses
Other Flag
Select to set the other flag. When this flag is set, the DHCPv6 client obtains other network parameters such as DNS server, domain name, NIS, NISP, SIP, SNTP, and BCMS servers from the
DHCPv6 server.
Note: This option must be selected only if a DHCPv6 server is available.
Default Gateway
Select to use the device as default gateway for communication with the client.
Life Time
Specify the time in seconds to be used for router advertisement as a default gateway at the client end.
The value specified should be between the value specified for Max Advertisement Interval and
9000 seconds.
Default: 1800 seconds
Sophos XG Firewall | Configure | 149
Prefix Advertisement Configuration
Prefix Advertisement includes zero or more prefix options containing information that the default gateway advertises. This information is used by stateless address auto configuration to auto-generate a global IPv6 address. Prefix advertisement has its own list of attributes:
Prefix / 64
Provide the first 64 bits of the IPv6 address.
The interface uses this prefix information from the router advertisement message to determine the last 64 bits (interface identifier) of its 128-bit IPv6 address.
The first 64 bits (higher order bits) of the IPv6 address so provided, specify the network, while the remaining specify a particular address in the network. Hence, IPv6 addresses in one network have the same first 64 bits and are called “prefix”.
On-link
Select to set the prefix to be “On-link”. With the attribute On-link set, the devices with IPv6 addresses that are within this prefix are reachable on the subnet without a need of a router.
By default, this flag is set.
Autonomous
Select to set the prefix attribute Autonomous. On being set, the global IPv6 address is automatically generated by appending the 64 bit interface identifier to the prefix (prefix /64) advertised in the prefix information.
Only those prefixes that has the Autonomous flag set gets a stateless address auto configuration
(SLAAC) IPv6 address.
By default, the flag is set.
Preferred Life Time
Specify the time in minutes for a valid address to remain in the preferred state. The use of the preferred address is unlimited.
On expiry of the valid life time, the preferred address becomes deprecated. The use of the deprecated address must be avoided, however, it is not forbidden and can be continued to be used as source address for an existing communication.
The IPv6 address will continue to remain in the preferred state as long as it is refreshed by prefixes in the router advertisement or by any other means or are renewed by DHCPv6.
Acceptable values: 0 to 71582789 minutes
Default: 240 minutes
Specify the attribute value as “-1” for an infinite preferred life time.
Valid Life Time
Specify the time in minutes for an address to remain in the valid state.
This value determines the time for an address to be in the valid state. Until the time expires, the prefix is considered to be on-link and auto-configured addresses using the prefix can be used.
On expiry of the valid life time, the IPv6 address becomes invalid and cannot be used to send or receive traffic.
Acceptable range: 0 to 71582789 minutes
Default: 1440 minutes
Specify the attribute value as “-1” for an infinite valid life time.
Use the and icons to add or remove a prefix.
Note: The value of attribute Valid Life Time must be greater than or equal to value of Preferred Life Time.
Sophos XG Firewall | Configure | 150
Figure 117: General Settings
3. Enter the details for the Advanced Settings
Using the network discovery protocol (NDP) devices on the same interface discover the presence of each other and the respective link-layer addresses, find gateway routers and maintain the reachability information about the active paths to the peers.
Link MTU
Specify the Maximum Transmission Unit (MTU) in bytes for the packets sent on this interface.
Specify the Maximum Transmission Unit (MTU) in bytes for the packets sent on this interface.
Default: 0
Acceptable range: 1280 to 1500 bytes
If Link MTU is set to zero, the information will not be advertised by the interface.
Reachable Time
Specify the reachable time in seconds that the client will use to assume a neighbor is reachable after having received a reachability confirmation message.
Default: 0
Acceptable range: 0 to 3600 seconds
Retransmit Time
Specify the retransmission time in seconds that the client will use to determine how long it should wait before retransmitting neighbor solicitation messages.
Default: 0
Acceptable range: 0 to 4294968 seconds
Hop Limit
Specify the hop limit value.
This value determines the number of hops that a packet is limited to. The hop value is decremented by each router along the route. On reaching zero, the packet is destroyed.
Default: 64
Acceptable range: 0 to 255 seconds
Sophos XG Firewall | Configure | 151
Figure 118: Advanced Settings
4. Click Save.
The IPv6 router advertisement settings have been updated.
Cellular WAN
This feature is not supported in Sophos Virtual Security Devices.
Cellular WAN is a wide area network (WAN) for data that is typically provided by the cellular carriers to transmit a wireless signal over a range of several miles to a mobile device. Cellular WAN connectivity allows a user with a laptop and a Cellular WAN support to use the web, or connect to a VPN from anywhere within the regional boundaries of a cellular service.
Cellular WAN are popularly known as “wireless broadband”.
To configure Cellular WAN:
1. Enable Cellular WAN. You can also enable from CLI with the command: system cellular_wan enable.
2. Re-login to the Admin console.
3. Edit the Cellular WAN (WWAN1) interface and configure the Cellular WAN initialization string and gateway from Configure > Network > Interfaces page.
To configure Cellular WAN settings, please refer:
Configure Cellular WAN Settings
on page 109
Once Cellular WAN is enabled, an interface named WWAN1 is created and it is the member of the WAN zone.
As Cellular WAN interface is a member of WAN zone:
• All the services enabled for the WAN zone from the Device Access page are automatically applicable on WWAN1 connection too.
• All the firewall rules applied on WAN zone will be applied on Cellular WAN (WWAN1) interface.
• A default host named ##WWAN1 is created and firewall rules and VPN policies can be created for the default host.
• WWAN1 gateway is added as backup gateway
• When the Cellular WAN is disabled from CLI in the Cellular WAN menu, default host ##WWAN1and Cellular
WAN gateway options will be removed from the Admin Console.
Note:
• Cellular WAN is not supported in bridge mode.
• DHCP server configuration is not supported for the Cellular WAN (WWAN1) interface.
• If backup of a device is taken on which Cellular WAN is enabled and restored on a device where it is not enabled, Cellular WAN configuration would still be visible.
Sophos XG Firewall | Configure | 152
Status
The Cellular WAN page displays the status of the Cellular WAN connection. Along with details of the Cellular WAN connection, the page also provides the facility to connect and disconnect the Cellular WAN connection. Below are the screen elements with their description:
Cellular WAN
Enable/Disable Cellular WAN.
Default - Disabled
Connect/Disconnect Button
Click to connect or disconnect the Cellular WAN connection. This process may take some time.
Status
Displays the status of the connection. Status messages can be of the following types:
Possible Status:
• Modem not supported
• No Modem plugged-in
• Connecting…
• Reconnecting
• Connected
• Disconnected
Modem Name
Name of the modem.
IP Address
IP address assigned to the device.
Gateway IP
IP address assigned as the gateway.
Bytes Uploaded
Number of bytes uploaded (in KB).
Bytes Downloaded
Number of bytes downloaded (in KB).
Time Duration
Time period since Cellular WAN is connected.
Format: HH:MM::SS
Sophos XG Firewall | Configure | 153
Figure 119: Status of the cellular WAN Connection
IP Tunnels
An IP tunnel is an Internet protocol network communications path between two networks. It is used to encapsulate one network protocol as a carrier for another network protocol. It is often used by two separate networks having a router with different network addresses for communication. The device supports IPv6 tunneling. Hence, IPv6 packets can be encapsulated in IPv4 headers using the IP Tunnel feature.
This page provides a list of all configured IP tunnels. The administrator can create and manage IP tunnels from this page.
Add IP Tunnel
The Add IP Tunnel page allows you to create or edit an existing 6in4, 6to4, 6rd or 4in6 IP tunnel.
1. Go to Configure > Network > IP Tunnels and click Add.
2. Enter the tunnel details.
Tunnel Name
Enter a unique name to identify the tunnel.
Tunnel Type
Select the tunnel type from the available options.
Available Options:
• 6in4 – 6in4 uses tunneling to encapsulate IPv6 traffic over IPv4 links. This is used when IPv6 packets have to travel over IPv4 links with IPv6 networks at both endpoints..
• 6to4 – 6to4 allows encapsulation of an IPv6 packet in an IPv4 header to send it to an IPv4 destination. This is used when the local endpoint is an IPv6 host while the remote endpoint is an
IPv4 host.
• 6rd – 6rd is similar in implementation to the 6to4 tunnel. However, unlike 6to4, 6rd allows the administrator to use a native IPv6 prefix.
• 4in6 – 4in6 uses tunneling to encapsulate IPv4 traffic over configured IPv6 tunnels. This is used when IPv4 traffic is to be used in a pure IPv6 network.
6rd Prefix (available only if the tunnel type 6rd is selected)
Specify the native IPv6 prefix to be used for the tunnel.
Zone
Select the zone to create the tunnel for.
Sophos XG Firewall | Configure | 154
The tunnel is used for the traffic of the selected zone.
Available Options:
• LAN
• WAN
• DMZ
• WiFi
Local Endpoint
Specify the IP address of the local endpoint of the tunnel.
For:
• 6in4: Specify the IPv6 address of the local endpoint.
• 6to4: Specify the IPv6 address of the local endpoint.
• 6rd: Specify the IPv6 address of the local endpoint.
• 4in6: Specify the IPv4 address of the local endpoint.
Remote Endpoint (available only if the tunnel types 6in4 or 4in6 are selected)
Specify the IP address of the remote endpoint of the tunnel.
For
• 6in4: Specify the IPv4 address of the remote endpoint.
• 4in6: Specify the IPv6 address of the remote endpoint.
3. Enter the Advanced Settings.
TTL
Specify the time to live (TTL) life time for the data.
The attribute TTL defines a limit regarding the number of attempts to transmit an IP packet before discarding it.
Default: 0
Acceptable Range: 0 to 255
TOS
Specify the type of service (TOS) for the data.
The attribute TOS provides the value for an IP packet depending on the service which is provided.
The service mainly defines the packet priority, the type of route (latency, throughput, or reliable service).
Default: 0
Acceptable Range: 0 to 99
Sophos XG Firewall | Configure | 155
Figure 120: IP Tunnel
4. Click Save.
The IP tunnel has been created or updated and appears on the IP Tunnel page.
Neighbors (ARP-NDP)
From this page, view the IPv4 and IPv6 ARP-NDP neighbors, create static neighbors and flush existing neighbors.
ARP-NDP
TCP/IP uses ARP (Address Resolution Protocol) protocol to translate an IPv4 address into a MAC address (physical network address). In other words, it maps layer 3 (IPv4 addresses) to layer 2 (physical or MAC addresses) to enable communications between hosts residing on the same subnet. Similarly to translate IPv6 addresses, NDP (Neighbor
Discovery Protocol) is used.
ARP is used by hosts that are directly connected on a local network and uses either or both unicast and broadcast transmissions directly to each other. The host finds the physical address of another host on its network by sending an ARP query packet that includes the IP address of the receiver. As a broadcast protocol, it can create excessive amounts of network traffic on your network. To minimize the broadcast traffic, an ARP cache is maintained to store and reuse previously learned ARP information.
NDP in IPv6 is similar to ARP in IPv4. The main purpose of both protocols is to enable a host (node) to determine the link layer address (MAC address) of the node it wants to communicate with, in the local network and to find out the link layer address of the router through which it can access a node in an external network. Thus, the actual exchange of messages can take place between the two nodes. Apart from neighbor discovery, NDP functionality includes router discovery, neighbor presence, redirects, network options (as in DHCP options) and stateless auto-configuration.
Similar to ARP, NDP is also susceptible to flooding and poisoning attacks.
NDP has neighbor solicitations analogous to ARP request and neighbor advertisements analogous to ARP replies.
Unsolicited neighbor advertisements in IPv6 correspond to gratuitous ARP replies in IPv4. Static neighbor configuration protects the neighbor cache from trusted or vulnerable nodes in the network. Static neighbor discovery helps -to prevent solicit requests for configured entries and ignores any incoming solicit or advertised ND for configured entries.
Neighbors
ARP and NDP traffic is a vital communication on a network and is enabled on the Device interfaces by default.
A static neighbor entry allows binding the MAC address to the designated IP address and port. Once the MAC address is bound to a port and IP address, the Device will not update its neighbor table dynamically and will not respond to that IP-MAC pair on any other port. It will also remove any dynamically cached references to that IP address that might be present, and will not allow additional static mappings of that IP address.
Sophos XG Firewall | Configure | 156
These entries will be stored in the Static Neighbor Table, the IPv4 Neighbor Cache and the IPv6 Neighbor Cache.
The Device performs the neighbor lookup in the static neighbor table when it receives the request on a particular port.
If there is any mismatch in an IP address or MAC address, the Device considers it as a neighbor poisoning attempt and does not update its neighbor cache. If an entry is not available in the table, the Device will lookup in the IPv4 or
IPv6 neighbor cache and adds the MAC address to the neighbor cache if required.
Consider an example when IP1 is mapped to MAC1 and the IP1-MAC1 pair is bound to Port A. Similarly, IP2 is mapped to MAC1 and the IP2-MAC1 pair is bound to Port A
Table 1: Illustration for Neighbor Poisoning
IP Address
IP1
IP1
IP1
IP1
IP3
IP2
IP2
MAC Address
MAC1
MAC1
MAC2
MAC2
MAC1
MAC1
MAC1
Port
A
Any other port than A
A
Any other port than A
No static ARP
A
Any other port than A
Neighbor Poisoning Attempt
No
Yes
Yes
Yes
No
No
Yes
Neighbors (ARP-NDP)
The device maintains three types of table for neighbor entries: Static Neighbor Table, IPv4 Neighbor Cache and IPv6
Neighbor Cache.
IPv4/IPv6 Neighbor Cache table
The IPv4/IPv6 neighbor cache table stores static and dynamic neighbor entries. Static neighbor entries are defined by administrators and are permanent while dynamic neighbor entries are learned entries and are updated dynamically.
Such dynamic entries can be flushed by clicking Flush.
Go to Configure > Network > Neighbors (ARP-NDP) and select IPv4 Neighbor Cache or IPv6 Neighbor Cache to view the large number of neighbor entries. This page allows navigating and managing the neighbor entries in all three tables. Select the table type from the drop-down list to view the neighbor entries in the respective table. It lists IP address, MAC address, interface and type of the entry. Entry type can be static or dynamic. If everything is working properly with the neighbor, the dynamic neighbor entry will be displayed as “Complete, Dynamic”.
“Complete, Dynamic” means both MAC and IP values are there in the table while “Incomplete, Dynamic” means that the neighbor request was sent but no reply has yet been received.
Neighbor Configuration
Neighbor cache entry timeout
Specify time interval after which the entries in the cache should be flushed.
Default: 2 minutes
Input range: 1 to 500 minutes
Flush the IPv4/IPv6 neighbor cache whenever the host IP address on the network changes. As the
IP address is linked to a physical address, it can change but can still be associated with the physical address in the IPv4/IPv6 Neighbor Cache. Flushing the IPv4/IPv6 Neighbor Cache allows new information to be gathered and stored in the IPv4/IPv6 Neighbor Cache.
Log Possible Neighbor Poisoning Attempts
Enable to log the poisoning attempts.
Sophos XG Firewall | Configure | 157
Figure 121: Neighbor Configuration
Flushing Neighbor Table and Cache
The neighbors page displays a list of all the IP address-and-MAC address mappings and you can filter the list based on the IP address or the MAC address.
Select Static Neighbor Table or the required cache and click the Flush button to empty the cache or click Add to add a new entry.
Figure 122: Neighbors
Add Static Neighbor
1. Go to Configure > Network > Neighbors (ARP-NDP). In Show section select Static Neighbor Table and click
Add.
2. Specify the details.
IP Family
Select the IP Family for the static neighbor.
Sophos XG Firewall | Configure | 158
Available Options:
• IPv4
• IPv6
IPv4/IPv6 Address
Specify a IPv4/IPv6 address of the host outside the firewall.
MAC Address
Specify a MAC address of the host.
Interface
Select the physical interface on which the binding is to be done.
Add as a Trusted MAC Address to prevent a spoofing attempt
On enabling this option, the IP-MAC pair is added to the Trusted MAC list. If disabled, the IP-MAC pair will not be included in the Trusted MAC list.
By default, this option is enabled.
Figure 123: Static Neighbor
3. Click Save.
The static neighbor is created and appears in the Static Neighbor Table on the Neighbors (ARP-NDP) page.
Dynamic DNS
This section allows you to configure Dynamic DNS settings for your device.
Dynamic DNS (Domain Name Service) is a method of keeping a static domain/host name linked to a dynamically assigned IP address allowing your server to be more easily accessible from various locations on the Internet.
Powered by Dynamic Domain Name System (DDNS), you can access your device by the domain name, not the dynamic IP address. DDNS will tie a domain name (for example, mydevice.com, or mycompany.mydevice.com) to your dynamic IP address.
The device supports the following Dynamic DNS providers:
1. DynDNS
2. ZoneEdit
3. EasyDNS
4. DynAccess
5. Sophos
The page displays a list of all the configured DDNS, along with their names, interfaces, service providers, the last updated IP, status and time as well as the reason for failure. In addition it provides the option to add, update or delete a configuration.
Sophos XG Firewall | Configure | 159
Add Dynamic DNS
This page describes how to either add details of a third-party DDNS provider or to configure the device itself to act as a DDNS.
Dynamic DNS cannot be configured from Sophos Firewall Manager (SFM).
1. Go to Configure > Network > Dynamic DNS and click Add.
2. Specify the DDNS parameter details.
Note: For configuring a third-party service provider, you need a registered account with any of the supported Dynamic DNS service providers:
1. DynDNS
2. ZoneEdit
3. EasyDNS
4. DynAccess
5. Sophos
Hostname
Specify a name to identify the host that you want to use on the DDNS server. It is the domain name that you registered with your DDNS service provider, for example sophos.com.
In case you are configuring DynAccess as a service provider, provide the host name in the following format: <accountname>.dynaccess.com.
In case you are configuring Sophos as a service provider, provide the host name in the following format:
<host name>.myfirewall.co.
Note: You cannot add DDNS provider as <host>.ddns.cyberoam.com.
Interface
Select the external interface. The IP address of the selected interface will be bound to the specified hostname.
IPv4 Address
Select the IPv4 address source.
Available Options:
• Use Port IP: Select to use the IP address of the selected port or interface.
• NATed Public IP: Select to use the public IP address assigned to the selected port.
IP Edit Checking Interval
Specify the time interval after which the device should check and edit the IP address of your server, if changed.
Acceptable range: 4 - 60 minutes
Default: 20 minutes
For example, if the time interval is set to 10 minutes, after every 10 minutes, the device will check for any changes in your server IP address.
Stiahnuť
Verejný odkaz bol aktualizovaný
Verejný odkaz na váš chat bol aktualizovaný. You may view and manage your chat links after registration here.
Verejný odkaz na dokument
Reklama
