Firewall. Sophos XG Firewall
إعلان
إعلان
Sophos XG Firewall | Protect | 303
Protect
Firewall
Firewall rules are security rule-sets to implement control over users, applications or network objects in an organization. Using the firewall rule, you can create blanket or specialized traffic transit rules based on the requirement. This page provides centralized management for the entire set of device firewall rules. Sophos XG
Firewall implements a single pane of management to secure all enterprise applications using configuration templates for various rule types.
Following sections provide more information on the Firewall section.
•
•
•
•
•
Understanding List of Firewall Rules
Introduction
Firewall rules are based on the following configurable templates:
1.
2.
Managing Firewall Rules
You can see the entire list of added firewall rules from the Firewall page. Using the same page, you can update existing firewall rules or add new firewall rules. To change the processing order, you can re-order firewall rules by drag and drop action.
Note: All custom firewall rules can be re-ordered. The order of processing is top to bottom.
On the Firewall page, the following action buttons can be found.
• IPv4: Select to filter only IPv4 rules
• IPv6: Select to filter only IPv6 rules
• Enable Filter: Select to open filter view and apply the following filters for IPv4 or IPv6 rules:
1. Rule Type - Select to filter rules based on Business, User or Network
2. Source Zone - Select to filter rules based on LAN, WAN, DMZ, LOCAL, VPN or WiFi
3. Destination Zone - Select to filter rules based on LAN, WAN, DMZ, LOCAL, VPN or WiFi
4. State - Select to filter rules based on Unused, Disabled, Changed, New
5. Rule ID - Specify Rule ID to see the specific rule.
• Reset Filter (Available if filter is enabled) - Select to reset all filters
• Disable Filter (Available if filter is enabled) - Select to close filter view
• + Add Firewall Rule - Select to add a new rule among Business Application Rule, or User/Network Rule.
Testing Firewall Rules
You can test and troubleshoot firewall rules using the policy tester. Click Log Viewer and then click the Policy Test tab.
Sophos XG Firewall | Protect | 304
Default Firewall Rules
At the time of deployment, Network Configuration Wizard provides an option to enable User/Network Rule for LAN to WAN traffic and automatically creates default firewall rule Default_Network_Policy. You can apply
Web filter, App filter and IPS policy through this default policy from the Wizard itself or from Web Admin console whenever required.
Understanding Icons
There are various action icons as well as symbolic icons on the Firewall page. Color codes, meanings and associated actions of icons are shown below.
Icons Meaning
Business Application Rule Enabled
Business Application Rule Disabled
User Rule Disabled + Action - Accept
User Rule Disabled + Action - Drop/Reject
User Rule Enabled + Action - Drop/Reject
User Rule Enabled
Network Rule Enabled
Network Rule Disabled + Action - Accept
Network Rule Disabled + Action - Drop/Reject
Network Rule Enabled + Action - Drop/Reject
Anti-Virus Scanning Disable
Anti-Virus Scanning Enable
Application Control Disable
Application Control Allow All
Application Control Deny All
Application Control Drop
Icons Meaning
Security Heartbeat Disable / No Restriction
Security Heartbeat Enable - Green
Security Heartbeat Enable - Yellow
Security Heartbeat - No Restriction + No Heartbeat.
Security Heartbeat - No Restriction + Green
Security Heartbeat - No Restriction + Yellow
Intrusion Prevention Disable
Intrusion Prevention Enable
NAT Disable
NAT Enable
Traffic Shaping Policy Disabled
Traffic Shaping Policy Enabled
Web Policy Disable
Web Policy Allow
Web Policy Deny
Web Policy Drop
Routing Enabled
Routing Disabled
Firewall Rule enabled. Click to disable the rule.
Firewall Rule disabled. Click to enable the rule.
Expand the rule for more information.
Collapse Rule
Edit Rule
Delete Rule (not applicable for default rules)
Dragger
Sophos XG Firewall | Protect | 305
Sophos XG Firewall | Protect | 306
Icons
Color Codes
Red
Green
Yellow
Blue
Grey
Meaning
Reject/Drop
Accept/Allow
Drop (In case of policies)
On/Enable
Off/Disable
Understanding the List of Firewall Rules
All added rules are available in the form of a list. Each rule in the list presents a quick snapshot of the rule.
Details of the rule:
• Rule Name: Name of the rule
• In/Out: Amount of traffic (in bytes) coming in or going out using the particular rule
• Firewall Rule Features: Status of schedule, Heartbeat, IPS, and traffic shaping
• Source: Source zone
• Destination: Destination zone
• What: Displays protected domains/services
• Action: Status of protected servers, status of web and application protection for user
• ID: Rule ID
• User’s Policy Applied: Status of application filter, web policy, AV and AS scanning, NAT policy and route through gateway, if configured
To view details of the Source, Destination, What (type of service) and Features, hover over the Features.
•
•
Click for the following options to appear:
• Clone Above
• Clone Below
• Add Above Network Rule
• Add Above Business Rule
• Add Below Network Rule
• Add Below Business Rule
• Add to Group: List of existing groups is displayed. You can edit the groups or create a new group.
• Delete
• Detach: To detach a firewall rule from a group.
User / Network Rule
User/Network Rule is used to define access rights and protection to the network objects/hosts. In a nutshell, if you want to control traffic by source, service, destination, zone, then use a Network Rule. Additionally, the administrator has the option to attach user identity to a rule in order to customize access of assorted hosts/servers. Such an identity based rule is considered a User Rule.
You can view or add a User/Network Rule for IPv4 and IPv6 traffic.
Sophos XG Firewall | Protect | 307
1.
Add User / Network Rule (IPv4)
2.
Add User / Network Rule (IPv6)
Add User/Network Rule (IPv4)
This page allows you to create firewall rules to control traffic that uses the IPv4 protocol. The firewall rules control traffic between internal and external networks and protect the network from unauthorized access. The device determines the rule to be applied based on the source and destination zone you configure in the firewall rule. Use this page to create identity-based firewall rules by applying them to users.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and User/Network Rule.
3. Enter the rule introduction details.
Rule Name
Enter a name for the rule.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule from the available options.
Available Options:
Top Bottom
Action
Specify an action for the rule traffic from the available options. Accept – Allow accessDrop –
Silently discardReject – Deny access (“ICMP port unreachable” message is sent to the source)
When sending a response it might be possible that the response is sent using a different interface than the one on which the request was received. This may happen depending on the routing configuration done on the device.
For example: If the request is received on the LAN port using a spoofed IP address (public IP address or the IP address not in the LAN zone network) and no specific route is defined, the device will send a response to these hosts using the default route. Hence, the response will be sent through the WAN port.
Figure 233: About This Rule
4. Enter the Source details.
Source Zones
Select the source zones allowed to the user.
A new zone can be created directly from this page itself or from Configure > Network > Zones page.
Source Networks and Devices
Select the source networks/devices allowed to the user.
A new network host can be created directly from this page itself or from System > Hosts and
Services.
During Scheduled Time
Select the schedule allowed to the user.
Sophos XG Firewall | Protect | 308
A new schedule can be created directly from this page itself or from the System > Profiles >
Schedule page.
Figure 234: Source
5. Enter the Destination and Services details.
Destination Zones
Select the destination zones allowed to the user.
Destination Networks
Select the destination networks allowed to the user.
A new network host can be created directly from this page itself or from System > Hosts and
Services.
Services
Select the services allowed to the user.
A new service can be created directly from this page itself or from the System > Hosts and
Services > Services page.
Figure 235: Destination
6. Enter Identity details. Follow this step if you want to configure a User Rule.
Match known users
Select to enable a rule based on the user identity.
Show captive portal to unknown users (available only if Match known users is selected)
Select the check box to accept traffic from unknown users. Captive portal page is displayed to the user where the user can login to access the Internet.
Clear the check box to drop traffic from unknown users.
User or Groups(available only if Match known users is selected)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting. (only available if Match known users is selected)
Select to exclude user traffic activity from data accounting. In other words, the traffic allowed through this rule will not be accounted towards data transfer for the user.
By default, user’s network traffic is considered in data accounting.
Sophos XG Firewall | Protect | 309
Figure 236: Identity
7. Enter Web Malware and Content Scanning details (available only if Action selected for the traffic is Accept).
Scan HTTP
Enable HTTP traffic scanning.
Decrypt & Scan HTTPS
Enable HTTPS traffic decryption and scanning.
Detect zero-day threats with Sandstorm
Send files downloaded using HTTP or HTTPS for analysis by Sandstorm. Sandstorm protects your network against unknown and unpublished threats (“zero-day” threats).
Scan FTP for Malware
Enable FTP traffic scanning.
8. Enter Advanced settings details (available only if Action selected for the traffic is Accept).
a) Specify policies for User Applications.
Intrusion Prevention
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from Protect > Intrusion Prevention > IPS Policies page.
Traffic Shaping Policy
User’s traffic shaping policy will be applied automatically if Match known users is selected.
You need to select traffic shaping policy for the rule if Match known users is not selected.
Web Policy
Select a web policy for the rule.
A new web policy can be created directly from this page itself or from the Protect > Web > Policies page.
Apply Web Category based Traffic Shaping Policy
Click to restrict bandwidth for the URLs categorized under the Web category.
A three step configuration is required as follows:
1. Create a traffic shaping policy from the System > Profiles > Traffic Shaping page. Here, specify the Policy Association as Web Categories.
2. Now, on this page assign the created policy to Web Policy.
3. Select Apply Web Category based Traffic Shaping Policy to apply the rule.
Application Control
Select an application filter policy for the rule. A new application filter policy can be created directly from this page itself or from the Protect > Applications > Application Filter page.
Apply Application-based Traffic Shaping Policy
Click to restrict bandwidth for the applications categorized under the Application category.
Sophos XG Firewall | Protect | 310
A three step configuration is required as follows:
1. Create a traffic shaping policy from the System > Profiles > Traffic Shaping page. Here, specify the Policy Association as Applications.
2. Now, on this page assign the created policy to Application Control.
3. Select Apply Application-based Traffic Shaping Policy to apply the rule.
Figure 237: User Applications
b) Configure Synchronized Security settings.
Minimum Source HB Permitted
Select a minimum health status that a source device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this rule will not be granted to the user.
Block clients with no heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a source device’s access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Destination HB Permitted (not available if the only Destination Zone selected is WAN)
Select a minimum health status that a destination device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this rule will not be granted to the user.
Note: You can use the option if you have selected multiple zones along with WAN.
Block request to destination with no heartbeat (not available if the only Destination Zone selected is
WAN)
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can block requests to destinations not sending heartbeat.
Sophos XG Firewall | Protect | 311
Enable/disable the option to require the sending of heartbeats.
Note: You can use the option if you have selected multiple zones along with WAN.
Figure 238: Synchronized Security
c) Enter NAT and Routing details.
Rewrite source address (Masquerading)
Select if you want to re-write the source address or specify a NAT policy.
Default: Disabled
Use Gateway Specific Default NAT Policy (available only if Masquerading is selected)
Select to override the default NAT policy with a gateway specific policy.
Override default NAT policy for specific Gateway (available only if Use Gateway Specific Default
NAT Policy is selected)
Select to specify gateway and corresponding NAT policy. Multiple gateways and NAT policies can be added.
Use Outbound Address (available only if Rewrite source address is selected)
Select the NAT policy to be applied from the list of available NAT policies.
A new NAT policy can be created directly from this page itself or from the System > Profiles >
Network Address Translation page.
Default: MASQ.
MASQ (Interface Default IP)
• IP Address of the Destination Zone as configured in Configure > Network > Interfaces will be displayed instead of (Interface Default IP) when single Destination Zone is selected.
• (Interface Default IP) will be displayed when multiple Destination Zones are selected.
Primary Gateway
Specify the Primary Gateway. This is applicable only if more than one gateway is defined.
Note: On deletion of the gateway, Primary Gateway will display WAN Link Load
Balance for WAN Destination Zone and None for other zones. In such case, firewall rule will not make routing decisions.
Backup Gateway
Specify the Backup Gateway. This is applicable only if more than one gateway is defined.
Note: On deletion of the gateway, Backup Gateway will display None.
DSCP Marking
Sophos XG Firewall | Protect | 312
Select the DSCP Marking.
DSCP (DiffServ Code Point) classifies flow of packets as they enter the local network depending upon QoS. Flow is defined by 5 elements; source IP address, destination IP address, source port, destination port and the transport protocol.
For available options, refer to
Figure 239: NAT & Routing
9. Define logging option for the user application traffic.
Log Firewall Traffic
Select to enable logging of permitted and denied traffic.
Figure 240: Log Traffic
10. Click Save.
Add User / Network Rule (IPv6)
This page allows you to create firewall rules to control traffic that uses the IPv6 protocol. The firewall rules control traffic between internal and external networks and protect the network from unauthorized access. The device determines the rule to be applied based on the source and destination zone you configure in the firewall rule. Use this page to create identity-based firewall rules by applying them to users.
1. Go to Protect > Firewall and select IPv6. using the filter switch.
2. Click +Add Firewall Rule and User/Network Rule.
3. Specify the policy introduction details.
Rule Name
Enter a name for the rule.
Description
Specify a description for the rule.
Rule Position
Specify the position of the rule from the available options.
Available Options:
Top Bottom
Action
Sophos XG Firewall | Protect | 313
Specify an action for the rule traffic from the available options. Accept – Allow accessDrop –
Silently discardReject – Deny access (“ICMP port unreachable” message is sent to the source)
When sending a response it might be possible that the response is sent using a different interface than the one on which the request was received. This may happen depending on the routing configuration done on the device.
For example: If the request is received on the LAN port using a spoofed IP address (public IP address or the IP address not in the LAN zone network) and no specific route is defined, the device will send a response to these hosts using the default route. Hence, the response will be sent through the WAN port.
Figure 241: About This Rule
4. Specify Source details.
Source Zones
Select the source zones allowed to the user.
Source Networks and Devices
Select the source networks/devices allowed to the user.
A new network host can be created directly from this page itself by clicking Create new or from
System > Hosts and Services.
During Scheduled Time
Select the schedule allowed to the user.
A new schedule can be created directly from this page itself or from the System > Profiles >
Schedule page.
Figure 242: Source
5. Specify Destination and Services details.
Destination Zones
Select the destination zones allowed to the user.
Destination Networks
Select the destination networks allowed to the user.
A new network host can be created directly from this page itself by clicking Create new or from
System > Hosts and Services.
Services
Select the services(s) allowed to the user.
A new service can be created directly from this page itself or from the System > Hosts and
Services > Services page.
Sophos XG Firewall | Protect | 314
Figure 243: Destination
6. Specify Identity details.
Match known users
Select to enable a rule based on the user identity.
Show Captive Portal to unknown users
Select the check box to accept traffic from unknown users. Captive portal page is displayed to the user where the user can login to access the Internet.
Clear the check box to drop traffic from unknown users.
User or Groups(available only if Match known users is selected)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting (only available if Match known users is selected)
Select to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic user data accounting. The traffic allowed through this rule will not be accounted towards data transfer for the user.
Figure 244: Identity
7. Specify Web Malware and Content Scanning details. (available only if Action for the traffic is Accept)
Scan HTTP
Enable HTTP traffic scanning.
Decrypt & Scan HTTPS
Enable HTTPS traffic decryption and scanning.
Detect zero-day threats with Sandstorm
Send files downloaded using HTTP or HTTPS for analysis by Sandstorm. Sandstorm protects your network against unknown and unpublished threats (“zero-day” threats).
8. Specify Advanced settings details (available only if Action for the traffic is Accept) a) Specify policies for user applications.
Intrusion Prevention (IPS)
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from Protect > Intrusion Prevention > IPS Policies page.
Traffic Shaping Policy
User’s traffic shaping policy will be applied automatically if Match known users is selected.
Sophos XG Firewall | Protect | 315
You need to select traffic shaping policy for the rule if Match known users is not selected.
Web Policy
Select a web policy for the rule.
A new web policy can be created directly from this page itself or from the Protect > Web > Policies page.
Apply Web Category based Traffic Shaping Policy
Click to restrict bandwidth for the URLs categorized under the Web category.
A three step configuration is required as follows:
1. Create a traffic shaping policy on the System > Profiles > Traffic Shapingpage. Here, specify the Policy Association as Web Categories.
2. Now, on this page assign the created policy to Web Policy .
3. Select Apply Web Category based Traffic Shaping Policy to apply the policy.
Application Control
Select an application filter policy for the rule. A new application filter policy can be created directly from this page itself or from the Protect > Applications > Application Filter page.
Apply Application-based Traffic Shaping Policy
Click to restrict bandwidth for the applications categorized under the Application category.
A three step configuration is required as follows:
1. Create a traffic shaping policy from the System > Profiles > Traffic Shaping page. Here, specify the Policy Association as Applications.
2. Now, on this page assign the created policy to Application Control.
3. Select Apply Web based Traffic Shaping Policy to apply the policy.
Figure 245: User Applications
b) Specify Routing details.
Rewrite source address (Masquerading)
Disable if you do not want to re-write the source address or specify a NAT policy.
Sophos XG Firewall | Protect | 316
Default - Enabled
Use Gateway Specific Default NAT Policy (only if Masquerading is selected)
Click to override the default NAT policy with a gateway specific policy.
Override default NAT policy for specific Gateway (only if Use Gateway Specific Default NAT Policy
is selected )
Enable to specify gateway and corresponding NAT policy. Multiple gateways and NAT policies can be added.
Use Outbound Address (only if Rewrite source address is selected)
Select the NAT policy to be applied from the list of available NAT policies.
A new NAT policy can be created directly from this page itself or from the System > Profiles >
Network Address Translation page.
Default: MASQ.
MASQ (Interface Default IP)
• IP Address of the Destination Zone as configured in Configure > Network > Interfaces will be displayed instead of (Interface Default IP) when single Destination Zone is selected.
• (Interface Default IP) will be displayed when multiple Destination Zones are selected.
Primary Gateway
Specify the primary gateway. This is applicable only if more than one gateway is defined.
Note: On deletion of the gateway, Primary Gateway will display WAN Link Load
Balance for WAN Destination Zone and None for other zones. In such case, firewall rule will not make routing decisions.
Backup Gateway
Specify the backup gateway. This is applicable only if more than one gateway is defined.
Note: On deletion of the gateway, Backup Gateway will display None.
DSCP Marking
Select the DSCP Marking.
DSCP (DiffServ Code Point) classifies flow of packets as they enter the local network depending upon QoS. Flow is defined by 5 elements; Source IP Address, Destination IP Address, Source port,
Destination port and the transport protocol.
For available options, refer to
Sophos XG Firewall | Protect | 317
Figure 246: NAT & Routing
9. Define logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 247: Log Traffic
10. Click Save.
DSCP Value
DiffServ Code Point (DSCP) uses the 6 bits, thereby giving 2^6 = 64 different values (0 to 63). describes the standard
DSCP values. Remaining DSCP values can be customized as per the QoS requirement.
Decimal
22
24
26
28
30
32
14
16
18
20
0
8
10
12
DSCP
AF23
CS3
AF31
AF32
AF33
CS4
Default
CS1
AF11
AF12
AF13
CS2
AF21
AF22
Description
Best Effort
Class 1 (CS1)
Class 1, Gold (AF11)
Class 1, Silver (AF12)
Class 1, Bronze (AF13)
Class 2 (CS2)
Class 2, Gold (AF21)
Class 2, Silver (AF22)
Class 2, Bronze (AF23)
Class 3 (CS3)
Class 3, Gold (AF31)
Class 3, Silver (AF32)
Class 3, Bronze (AF33)
Class 4 (CS4)
Sophos XG Firewall | Protect | 318
Decimal
46
48
56
34
36
38
40
DSCP
AF41
AF42
AF43
CS5
EF
CS6
CS7
Description
Class 4, Gold (AF41)
Class 4, Silver (AF42)
Class 4, Bronze (AF43)
Class 5 (CS5)
Expedited Forwarding (EF)
Control (CS6)
Control (CS7)
Business Application Rule
Business Application Rule is used to protect internally or publicly hosted business applications or servers like
SalesForce, Sharepoint etc.
Using Business Application Rule, the administrator can configure protection of the http and non-http web servers from unauthorized access over the Internet. You can also control access of protected server or services through a
Business Application Rule.
Several templates are available that cover protection configuration for a variety of different types of http and non-http web servers and application. A list of these application templates appear on the Business Application Rule page.
Adding a Business Application Rule
Go to Protect > Firewall and select IPv4. using the filter switch. Now, click on +Add Firewall Rule and select
Business Application Rule. You can then select the Application Template from the list of available templates.
The application template allows you to choose the rule which suits the configuration of the required business application. Once you select the template, you can see the configuration page with few fields pre-populated. The prepopulated values eliminate the need to manually specify the configuration for securing your business application, but you may customize the settings according to your network setup or other requirements.
1.
DNAT/Full NAT/Load Balancing rule
- It is used to protect Non-Web servers, like mail or other servers hosted
inside the network (LAN or DMZ). Using this template, you can define access rights of such servers to users who require access over the WAN or Internet. Additionally, you can use the following Non-web application template:
2.
: Email Server (SMTP) rule is used to protect mail servers which are hosted internally in a
network and require protection.
3.
- Email Clients (POP and IMAP) rule is used to protect mail servers which are
hosted publicly (WAN) and require protection.
Note:
If you delete Email Clients rule, the Emails which are under process by this rule will be queued but will not be delivered.
We recommend to follow below given steps so that you do not lose all the emails processed by this rule:
1. Before deleting this rule, clone this rule by choosing Clone Above option and change the Action to
Drop. This cloned rule will hold all the incoming emails.
2. Go to Email > Mail Spool and check if spool is empty.
3. Once the spool is empty, delete both the firewall rules.
Application Protection Templates for common HTTP-based Applications
SF-OS offers several pre-configured templates to create a protection rule for commonly used HTTP-based applications. You can use a pre-configured template to create a rule for the web application that is close to your configuration, then modify it to fit your needs.
Pre-configured templates for common HTTP applications include:
Sophos XG Firewall | Protect | 319
1.
- Web Server Protection is used to protect HTTP or generic web application servers
hosted in the network. This template is essentially WAF implementation but with additional benefit of defining
WAF objects, rules, exceptions from the same page.
2.
3.
4.
5.
6.
Microsoft Remote Desktop Gateway 2008 and R2
7.
Microsoft Remote Desktop Web 2008 and R2
8.
Microsoft Sharepoint 2010 and 2013
Add Web Server Protection (WAF) Rule
This page allows you to control HTTP traffic flowing to and from a web application. Use this page to create a Web
Server Protection (WAF) rule for traffic that uses the IPv4 protocol.
1. Go to Protect > Firewall and make sure that IPv4 is selected.
2. Click +Add Firewall Rule and Business Application Rule.
3. Enter the general rule details.
Application Template
Select Web Server Protection (WAF) to define an application filter policy for HTTP-based applications.
Rule Name
Enter a name for the rule.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options:
• Top
• Bottom
Figure 248: About this Rule
4. Enter the Hosted Server details.
Hosted Address
Select the interface of the hosted server to which the rule applies. It is the public IP address through which Internet users access the internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Listening Port
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Sophos XG Firewall | Protect | 320
Select to enable or disable scanning of HTTPS traffic.
HTTPS Certificate (available only if HTTPS is selected)
Select the HTTPS certificate to be used.
Redirect HTTP (available only if HTTPS is selected)
Select to redirect HTTP requests. Thus, users entering the URL without “https://” will be redirected automatically to the hosted server.
Note: An HTTP request requires a host header if Redirect HTTP is enabled.
Domains
Enter the FQDN of domains for which the web server is responsible. Wildcards are not allowed.
Examples:
• example.com
• www.example.com
• subdomain.example.com
(If HTTPS is enabled): Domains that are part of the selected HTTPS certificate are automatically available in the Domains box.
Figure 249: Hosted Server
5. Specify the Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (a path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (available only if Path-specific routing is selected)
Click Add Path to define a new path.
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Sophos XG Firewall | Protect | 321
Web Server (not available if Path-specific routing is selected)
With this option, you select the web servers that are to be protected. Select a web server from Web
Server list. The selected web server is displayed on the right side of the table under Selected Web
Server(s).
A new web server can be created on the Protect > Web Server > Web Servers page.
Figure 250: Protected Server(s)
6. Specify Access Permission details (not available if Path-specific routing is selected).
Allowed Client Networks
Select or add the allowed networks that should be able to connect to the hosted web server.
Blocked Client Networks
Select or add the denied networks that should be blocked to your hosted web server.
Authentication
Select a web app authentication profile or click Create new to create a new authentication profile.
You can also create an authentication profile from the Protect > Web Server > Authentication
Policies page.
Figure 251: Access Permission
7. Add path Exceptions for the web servers.
Click Add New Exception to specify a new exception.
Figure 252: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Sophos XG Firewall | Protect | 322
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 253: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request’s encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local but the hosted web server’s hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft’s Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (available only if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Sophos XG Firewall | Protect | 323
Figure 254: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The business application rule has been created and appears on the Firewall page when the IPv4 filter is set.
Related tasks
(only available for the HTTP based business application rules) This page describes how to define a path to which real web servers incoming requests are forwarded.
This page describes how to add a web app authentication policy.
on page 353
(only available for the HTTP based business application rules) This page describes how to specify path exceptions for the web servers.
Add Rule for Exchange Autodiscover
(Only available for IPv4 policy) This page describes how to configure a rule for Exchange Autodiscover.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general rule details.
Application Template
Select Exchange Autodiscover to configure a policy for an Exchange Autodiscover environment.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options:
• Top
• Bottom
Rule Name
Specify a name for the rule.
Figure 255: About This Rule
Sophos XG Firewall | Protect | 324
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access an internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Listening Port
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Select this option to enable or disable HTTPS traffic.
HTTPS Certificate (available only if HTTPS is selected)
Select the HTTPS certificate to be used.
Redirect HTTP (available only if HTTPS is selected)
Select this option to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 256: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (the path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is
Sophos XG Firewall | Protect | 325 not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Default: Enabled
Add New Path (available only if Path-specific routing is selected)
Click Add New Path to define a new path.
Note: Add New Path will only be active only after at least one web server and one hosted web server have been created.
Default: /autodiscover, /Autodiscover, /AutoDiscover
Web Server (not available if Path-specific routing is selected)
Web servers are the application servers to be protected. Select a web server from the list of web servers or enter a web server and click Create to add a web server.
A new web server can be created directly from this page or from the Protect > Web Server > Web
Servers page.
Figure 257: Protected Server(s)
6. Specify Access Permission details (not available if Path-specific routing is selected).
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles.
You can also create a new authentication profile on this page or on the Protect > Web Server >
Authentication Policies page.
Figure 258: Access Permission
7. Add path Exceptions for the web servers.
Click Add New Exception to specify new exception.
Sophos XG Firewall | Protect | 326
Default: /autodiscover/*,/Autodiscover/*
Figure 259: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 260: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request’s encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local but
Sophos XG Firewall | Protect | 327 the hosted web server’s hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft’s Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (available only if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Figure 261: Advanced
9. Click Save.
Note: As soon as a new HTTP based policy configuration has been created and saved or an existing
HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The firewall rule for Microsoft Remote Desktop Gateway 2008 and R2 has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Exchange Outlook Anywhere
(only available for IPv4 policy) This page describes how to configure a rule for Exchange Outlook Anywhere.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general policy details.
Application Template
Select Exchange Outlook Anywhere to configure rule for Exchange Outlook Anywhere.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Rule Name
Specify a name for the rule.
Sophos XG Firewall | Protect | 328
Figure 262: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access an internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Listening Port
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Select to enable or disable of HTTPS traffic.
HTTPS Certificate (available only if HTTPS is selected)
Select the HTTPS certificate to be used.
Redirect HTTP (available only if HTTPS is selected)
Select to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 263: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping
Sophos XG Firewall | Protect | 329 session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (available only if Path-specific routing is selected)
Click Add New Path to define a new path.
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Default: /rpc, /RPC
Web Server (not available if Path-specific routing is selected)
Web servers are the application servers that are to be protected. Select a web server from the list of web servers or click Add New Item to add a web server.
A new web server can be created directly from this page or from the Protect > Web Server > Web
Servers page.
Figure 264: Protected Server(s)
6. Specify Access Permission details. (not available if Path-specific routing is selected).
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles. You can also create a new authentication profile from this page or from the Protect > Web Server >
Authentication Policies page.
Figure 265: Access Permission
Sophos XG Firewall | Protect | 330
7. Add path Exceptions for the web servers.
Click Add New Exception to specify new exception.
Default: /rpc/*,/RPC/*.
Figure 266: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 267: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request’s encoding parameter.
Sophos XG Firewall | Protect | 331
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local but the hosted web server’s hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft’s Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (available only if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Figure 268: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The Exchange Outlook Anywhere rule has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Exchange General
(only available for IPv4 policy) This page describes how to configure a rule for Exchange General.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general policy details.
Application Template
Select Exchange General to configure a rule for Exchange General.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Rule Name
Specify a name for the rule.
Sophos XG Firewall | Protect | 332
Figure 269: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access an internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Listening Port
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Select to enable or disable of HTTPS traffic.
HTTPS Certificate (available only if HTTPS is selected)
Select the HTTPS certificate to be used.
Redirect HTTP (available only if HTTPS is selected)
Select to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 270: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping
Sophos XG Firewall | Protect | 333 session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (available only if Path-specific routing is selected)
Click Add New Path to define a new path.
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Default: /owa, /OWA, /ecp, /ECP, /oab, /OAB, /ews, /EWS, /oma, /OMA, /Microsoft-Server-
ActiveSync
Web Servers (not available if Path-specific routing is selected)
Web servers are the application servers that are to be protected. Select a web server from the list of web servers or click Add New Item to add a web server.
A new web server can be created directly from this page or from the Protect > Web Server > Web
Servers page.
Figure 271: Protected Server(s)
6. Specify Access Permission details. (not available if Path-specific routing is selected)
Sophos XG Firewall | Protect | 334
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles. You can also create new authentication profile on this page or on the Protect > Web Server > Authentication
Policies page.
Figure 272: Access Permission
7. Add path Exceptions for the web servers.
Click Add New Exception to specify a new exception.
Default: /owa/*,/OWA/*,/ews/*,/EWS/*,/ecp/*,/ECP/*,/oab/*,/OAB/*,/oma/*,/OMA/*,/Microsoft-Server-
ActiveSync?*, /owa/ev.owa*
Figure 273: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Sophos XG Firewall | Protect | 335
Figure 274: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request’s encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local but the hosted web server’s hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft’s Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (available only if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Sophos XG Firewall | Protect | 336
Figure 275: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The Exchange General rule has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Microsoft Lync
(only available for IPv4 policy) This page describes how to configure a rule for Microsoft Lync.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general rule details.
Application Template
Select Microsoft Lync to define Application filter policy for HTTP based applications.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options:
• Top
• Bottom
Rule Name
Specify a name to identify the rule.
Figure 276: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Listening Port
Sophos XG Firewall | Protect | 337
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Click to enable or disable of HTTPS traffic.
HTTPS Certificate (available if HTTPS is enabled)
Select the HTTPS certificate to be used.
Redirect HTTP (available if HTTPS is enabled)
Click to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 277: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (the path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (available if Path-specific routing is enabled)
Click Add Path to define a new path.
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Web Server (available if Path-specific routing is disabled)
Hosts are the web servers that are to be protected. Select a web server from the list of web servers or click Add New Item to add a web server.
Sophos XG Firewall | Protect | 338
A new web server can be created directly from this page or from the Protect > Web Server > Web
Servers page.
Figure 278: Protected Application Server(s)
6. Specify Access Permission details (not available if Path-specific routing is selected).
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles.
You can also create a new authentication profile on this page or on the Protect > Web Server >
Authentication Policies page.
Figure 279: Access Permission
7. Specify path Exceptions for the web servers.
Click Add New Exception to specify a new exception.
Figure 280: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Sophos XG Firewall | Protect | 339
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 281: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request’s encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local but the hosted web server’s hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft’s Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (available only if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Sophos XG Firewall | Protect | 340
Figure 282: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The Microsoft Lync rule has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Microsoft Remote Desktop Gateway 2008 and R2
(only available for IPv4 policy) This page describes how to configure a rule for Microsoft Remote Desktop Gateway
2008 and R2.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general rule details.
Application Template
Select Microsoft Remote Desktop Gateway 2008 and R2 to configure a rule for Microsoft
Remote Desktop Gateway 2008 and R2.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options:
• Top
• Bottom
Rule Name
Specify a name to identify the rule.
Figure 283: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access an internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Sophos XG Firewall | Protect | 341
Listening Port
Enter a port number on which the hosted web server can be reached externally, over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Click to enable or disable of HTTPS traffic.
HTTPS Certificate (available if HTTPS is enabled)
Select the HTTPS certificate to be used.
Redirect HTTP (available if HTTPS is enabled)
Click to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 284: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (a path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (available if Path-specific routing is enabled)
Click Add New Path to define a new path.
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Web Server (available if Path-specific routing is disabled)
Sophos XG Firewall | Protect | 342
Web servers are the application servers that are to be protected. Select from the list of web servers or click Add New Item to add a web server.
A new web server can be created directly from this page or from the Protect > Web Server > Web
Servers page.
Figure 285: Protected Server(s)
6. Specify access permission details. (Available if Path-specific routing is disabled)
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles. You can also create a new authentication profile from this page or from the Protect > Web Server >
Authentication Policies page.
Figure 286: Access Permission
7. Specify path Exceptions for the web servers.
Click Add New Exception to specify new exception.
Figure 287: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Sophos XG Firewall | Protect | 343
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 288: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request’s encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local but the hosted web server’s hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft’s Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (available only if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Sophos XG Firewall | Protect | 344
Figure 289: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The rule for Microsoft Remote Desktop Gateway 2008 and R2 has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Microsoft Remote Desktop Web 2008 and R2
(only available for IPv4 policy) This page describes how to configure a rule for Microsoft Remote Desktop Web 2008 and R2.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general rule details.
Application Template
Select Microsoft Remote Desktop Web 2008 and R2 to configure a rule for Microsoft Remote
Desktop Web 2008 and R2.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Rule Name
Specify a name to identify the rule.
Figure 290: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access an internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Listening Port
Sophos XG Firewall | Protect | 345
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Click to enable or disable of HTTPS traffic.
HTTPS Certificate (available if HTTPS is enabled)
Select the HTTPS certificate to be used.
Redirect HTTP (available if HTTPS is enabled)
Click to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 291: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (the path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (available if Path-specific routing is enabled)
Click Add New Path to define a new path.
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Web Server (available if Path-specific routing is disabled)
Web servers are the application servers that are to be protected. Select a web server from the list of web servers or click Add New Item to add a web server.
Sophos XG Firewall | Protect | 346
A new web server can be created directly on this page or on the Protect > Web Server > Web
Servers page.
Figure 292: Protected Server(s)
6. Specify Access Permission details (available if Path-specific routing is disabled).
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles.
You can also create new authentication profile on this page or on the Protect > Web Server >
Authentication Policies page.
Figure 293: Access Permission
7. Add path Exceptions for the web servers.
Click Add New Exception to specify new exception.
Figure 294: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Traffic Shaping
Sophos XG Firewall | Protect | 347
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 295: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request’s encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local but the hosted web server’s hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft’s Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (available only if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Sophos XG Firewall | Protect | 348
Figure 296: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The rule for Microsoft Remote Desktop Web 2008 and R2 has been created and appears on the Firewall page when the IPv4 filter is set.
Add Rule for Microsoft Sharepoint 2010 and 2013
(only available for IPv4 policy) This page describes how to configure a rule for Microsoft SharePoint 2010 and 2013.
1. Go to Protect > Firewall and select IPv4. using the filter switch.
2. Click +Add Firewall Rule and Business Application Rule.
3. Specify the general rule details.
Application Template
Select Microsoft Sharepoint 2010 and 2013 to configure a rule for Microsoft Sharepoint 2010 and
2013.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options:
• Top
• Bottom
Rule Name
Specify a name to identify the rule.
Figure 297: About This Rule
4. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which Internet users access an internal server/host.
Note: When a client establishes a connection and accesses the web server, the web server does not obtain the client’s real IP address. The server obtains the address of the interface used by the Web Application Firewall (WAF) since the connection is made through the WAF. The client’s real IP address is available in the HTTP header
Sophos XG Firewall | Protect | 349
Listening Port
Enter a port number on which the hosted web server can be reached externally over the Internet.
Default is port 80 for plaintext communication (HTTP) and port 443 for encrypted communication
(HTTPS).
HTTPS
Click to enable or disable of HTTPS traffic.
HTTPS Certificate (available if HTTPS is enabled)
Select the HTTPS certificate to be used.
Redirect HTTP (available if HTTPS is enabled)
Click to redirect HTTP requests.
Domains
Use FQDN when you enter the domains the web server is responsible for, for example, shop.example.com.
Figure 298: Hosted Server
5. Specify Protected Server(s) details.
Path-specific routing
You can enable path-specific routing to define (a path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server. On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (available if Path-specific routing is enabled)
Click Add New Path to define a new path.
Note: Add New Path will only be active after at least one web server and one hosted web server have been created.
Web Server (available if Path-specific routing is disabled)
Sophos XG Firewall | Protect | 350
Web servers are the application servers that are to be protected. Select a web server from the list of web servers or click Add New Item to add a web server.
A new web server can be created directly from this page or from the Protect > Web Server > Web
Servers page.
Figure 299: Protected Application Server(s)
6. Specify Access Permission details (available if Path-specific routing is disabled).
Allowed Client Networks
Select the allowed host(s)/network(s).
Blocked Client Networks
Select the blocked host(s)/network(s).
Authentication
Select the web application authentication profile from the list of available profiles.
You can also create new authentication profile from this page or from the Protect > Web Server >
Authentication Policies page.
Figure 300: Access Permission
7. Add path Exceptions for the web servers.
Click Add New Exception to specify new exception.
Figure 301: Exceptions
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Protection
Select an application protection policy for the server or create a new one. A new application protection policy can be created directly from this page or from the Protect > Web Server >
Protection Policies page. You can also choose to have None application protection.
Intrusion Prevention
Sophos XG Firewall | Protect | 351
Select an Intrusion Prevention policy for the rule or create a new one. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention > IPS Policies page.
You can also choose to have None intrusion prevention.
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly from this page or from the System > System Services > Traffic Shaping page. You can also choose to have None traffic shaping.
Figure 302: Policies for Business Applications
b) Specify Additional Options for the added server.
Disable Compression Support
By default, this check box is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, if websites are displayed incorrectly or users experience content-encoding errors when accessing your web servers, it may be necessary to disable compression. When the check box is enabled, the
WAF will request uncompressed data from the web servers of this hosted web server and will send it uncompressed to the client, independent of the HTTP request’s encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid. Example: One of your web server instances has the hostname yourcompany.local but the hosted web server’s hostname on the device is yourcompany.com. Thus, absolute links like
[a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http:// yourcompany.com/"] before delivery to the client. However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft’s Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (available only if Rewrite HTML is selected)
Select this option to have the device rewrite cookies of the returned web pages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Sophos XG Firewall | Protect | 352
Figure 303: Advanced
9. Click Save.
Note: As soon as a new HTTP based rule configuration has been created and saved or an existing HTTP based rule configuration has been altered and saved, all HTTP based business rules will be restarted. Any underlying client connection using a HTTP based business rule will get lost and has to be re-established.
The rule for Microsoft Sharepoint 2010 and 2013 has been created and appears on the Firewall page when the IPv4 filter is set.
Add Path
(only available for the HTTP based business application rules) This page describes how to define a path to which real web servers incoming requests are forwarded.
1. Enable path-specific routing and click Add New Path.
2. Specify the path details.
Path
Enter the path for which you want to create the site path route.
Example: /products/.
Web Server
Select the web servers which are to be used for the specified path.
Authentication
Select the web app authentication profile. Select Create new to create a new authentication profile.
You can also create an authentication profile from the Protect > Web Server > Authentication
Policies page.
on page 494
Allowed Client Networks
Select or add the allowed networks that should be able to connect to the hosted web server.
Blocked Client Networks
Select or add the denied networks that should be blocked to your hosted web server.
Sticky session cookie
Ensures that each session is bound to one web server. If enabled, a cookie is passed to the user’s browser, which causes Sophos XG Firewall to route all requests from this browser to the same real web server. If the server is not available, the cookie will be updated, and the session will switch to another web server.
Hot-standby mode
Enable if you want to send all requests to the first selected web server, and use the other web servers only as a backup. The backup servers are only used in case the main server fails.
As soon as the main server starts functioning, the sessions will switch back - unless you have selected the Sticky session cookie option.
WebSocket passthrough
Sophos XG Firewall | Protect | 353
If enabled, applications hosted on the defined site path are allowed to use the WebSocket protocol.
WebSocket traffic will be just passed through, it will not be protected in any way.
Figure 304: Add New Path
3. Click Save.
Add Exception
(only available for the HTTP based business application rules) This page describes how to specify path exceptions for the web servers.
1. Click Add New Exception.
2. Specify exception details.
Path
Specify the path which you want to exclude.
Operation
Sophos XG Firewall | Protect | 354
Select the operation among AND or OR for Path and Source.
Source
Specify the source networks where the client request comes from and which are to be exempted from the selected check(s).
Skip these Checks
Cookie Signing
Click to skip cookie signing. Cookie signing protects a web server against manipulated cookies.
When the web server sets a cookie, a second cookie is added to the first cookie containing a hash built of the primary cookie’s name, its value and a secret, where the secret is only known by the WAF. Thus, if a request cannot provide a correct cookie pair, there has been some sort of manipulation and the cookie will be dropped.
Static URL Hardening
Protects against URL rewriting. When a client requests a website, all static URLs of the website are signed. The signing uses a similar procedure as with cookie signing. Additionally the response from the web server is analyzed in respect to the links that can be validly requested next.
Form Hardening
Click to skip form hardening. Form hardening protects against web form rewriting. Form hardening saves the original structure of a web form and signs it. Therefore, if the structure of a form has changed when it is submitted the WAF rejects the request.
Anti-virus
Select this option to protect a web server against viruses.
Block clients with bad reputation
Based on GeoIPClosed and RBLClosed information you can block clients which have a bad reputation according to their classification.
Skip these categories
Protocol Violations
Enforces adherence to the RFC standard specification of the HTTP protocol. Violating these standards usually indicates malicious intent.
Protocol Anomalies
Searches for common usage patterns. Lack of such patterns often indicates malicious requests.
These patterns include, among other things, HTTP headers like ‘Host’ and ‘User-Agent’.
Request Limits
Enforces reasonable limits on the amount and ranges of request arguments. Overloading request arguments is a typical attack vector.
HTTP Policy
Narrows down the allowed usage of the HTTP protocol. Web browsers typically use only a limited subset of all possible HTTP options. Disallowing the rarely used options protects against attackers aiming at these often less well supported options.
Bad Robots
Checks for usage patterns characteristic of bots and crawlers. By denying them access, possible vulnerabilities on your web servers are less likely to be discovered.
Generic Attacks
Searches for attempted command executions common to most attacks. After having breached a web server, an attacker usually tries to execute commands on the server like expanding privileges or manipulating data stores. By searching for these post-breach execution attempts, attacks can be detected that might otherwise have gone unnoticed, for example because they targeted a vulnerable service by the means of legitimate access.
Sophos XG Firewall | Protect | 355
SQL Injection Attacks
Checks for embedded SQL commands and escape characters in request arguments. Most attacks on web servers target input fields that can be used to direct embedded SQL commands to the database.
XSS Attacks
Checks for embedded script tags and code in request arguments. Typical cross-site scripting attacks aim at injecting script code into input fields on a target web server, often in a legitimate way.
Tight Security
Performs tight security checks on requests, like checking for prohibited path traversal attempts.
Trojans
Checks for usage patterns characteristic of trojans, thus searching for requests indicating trojan activity. It does not, however, prevent the installation of such trojans as this is covered by the antivirus scanners.
Outbound
Prevents web servers from leaking information to the client. This includes, among other things, error messages sent by servers which attackers can use to gather sensitive information or detect specific vulnerabilities.
Advanced
Never change HTML during static URL hardening or form hardening
If selected, no data matching the defined exception settings will be modified by the WAF engine.
With this option, e.g., binary data wrongly supplied with a text/html content type by the web server will not be corrupted. On the other hand, web requests may be blocked due to activated URL hardening, HTML rewriting, or form hardening. Those three features use an HTML parser and therefore to some extent depend on the modification of web page content. To prevent undesired blocking, skip URL hardening and/or form hardening for requests affected by blocking; you might need to do this in another/new exception to reflect dependencies between web servers and/or web pages.
Accept unhardened form data
Even though having an exception for form hardening, it is possible that form data will not be accepted if the form hardening signature is missing. With this option, unhardened form data will be accepted anyway.
Figure 305: Add New Exception
Sophos XG Firewall | Protect | 356
Sophos XG Firewall | Protect | 357
3. Click Save.
Application Protection Templates for common non-HTTP Applications
SF-OS offers several pre-configured templates to create a protection rule for commonly used non-HTTP applications and services. You can use these templates to create a rule for the web application, that is close to your configuration, then modify it to fit your needs.
Pre-defined templates include:
1.
2.
Add DNAT/Full NAT/Load Balancing Rule
A DNAT/Full NAT/Load Balancing based rule is used to protect non-web servers, like mail or other servers hosted inside the network (LAN or DMZ). Using this rule, you can define access rights of such servers to users who require access over the WAN or Internet.
1. Go to Protect > Firewall and select between IPv4 or IPv6 using the default filter.
2. Now, click +Add Firewall Rule and select Business Application Rule.
3. Specify the general rule details.
Application Template
Select DNAT/Full NAT/Load Balancing to configure a rule for generic Non-Web based applications.
Description
Enter a description for the rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Rule Name
Specify a name to identify the rule.
Figure 306: About This Rule
4. Specify Source details.
Source Zones
Select a source zone or click Add New Item to define a new LAN or DMZ zone.
Allowed Client Networks
Select the allowed host(s) or add a new one by clicking Add New Item.
Blocked Client Networks
Select the blocked host(s)/network(s).
Figure 307: Source
5. Specify Destination & Service details.
Sophos XG Firewall | Protect | 358
Destination Host/Network
Select the destination host/network to apply rule. It is the public IP address through which users access an internal server/host over the Internet.
Available Options: IP Address: Specified IP address is mapped to a corresponding mapped single
IP address or a range of IP addresses. If a single IP address is mapped to a range of IP addresses, the device uses a sticky IP algorithm to load balance the requests.IP Range : Specified IP address range is mapped to a corresponding range of mapped IP addresses. The IP range defines the start and end of an address range. The start of the range must be lower than the end of the IP. Select when any of the device port, alias or virtual LAN (VLAN) sub-interface is required to be mapped to the destination host or network.
Services
Select the services allowed to the user. You can directly add a new service here.
Add new item
Name: Enter a name to identify the service.
Type: Select a protocol for the service.
Available Options:TCP/UDP: Enter Source and Destination port. You can enter multiple ports for the same service. The number of source and destination ports must not exceed 16.IP: Select
Protocol Number for the service. You can select multiple ports for the same service.ICMP: Select
ICMP Type and Code. You can enter multiple types and codes for the same service. Use Add icon and Remove icon to add and delete the parameters respectively. ICMPv6: Select ICMPv6
Type and Code. You can enter multiple types and codes for the same service. Use Add and
Remove to add and delete the parameters.
Figure 308: Add Service
Figure 309: Destination and Service
6. Specify Forward To details.
Protected Server(s)
From the available options, select the application servers on which the web server is to be hosted.
Available options: IP Address: External IP address is mapped to the specified IP address.IP Range:
External IP address range is mapped to the specified IP address range.IP List: External IP address is mapped to the specified IP list.FQDN(available only for IPv4 virtual hosts): External IP address is mapped to the specified FQDN. Internal mapped server can be accessed by FQDN.
Sophos XG Firewall | Protect | 359
Note: For IP Range and IP List, you can also use a single external IP address. The device will then use load balancing for handling the requests.
Mapped Port (available only if Change Destination Port(s) is selected)
Specify the mapped port number on the destination network to which the public port number is mapped. Mapped port must have the same number of ports as specified in the public service, or at least have one port. Mapped Port is disabled if:
• No TCP/UDP service is selected.
• Multiple services are selected.
• Service group is selected.
• Selected service is with TCP/UDP combination.
Protected Zone
Select the zone to apply web server rule.
Change Destination Port(s)
Select the check box to specify different mapped port. Clear the check box to use the same Service
Port(s) Forwarded as mapped port.
Figure 310: Forward To
7. Specify Load balancing details.
Load Balancing (available only if selected Protected Server is IP Range or IP List or selected Destination
Host/Network is IP Address)
Select the method for load balancing from the available options.
Available Options:Round Robin: In this method, requests are served in a sequential manner where the first request is forwarded to the first server, second request to the second server and so on. When a request is received, the device checks to see which was the last server that was assigned a request.
It then assigns this new request to the next available server. This method can be used when equal distribution of traffic is required and there is no need for session-persistence.First Alive: In this method, all incoming requests are served by the first server (the first IP address that is configured in the IP range). This server is considered as the primary server and all others are considered as backup. Only when the first server fails, the requests are forwarded to the next server in line. This method is used for failover scenarios. Random: In this method, the requests are forwarded to the servers randomly. Nevertheless, the device makes sure that all configured servers receive equally distributed load. Hence, this method is also called uniform random distribution. This method can be used when equal distribution of traffic is required and there is no need for session-persistence or order of distribution.Sticky IP: In this method, along with the Round Robin distribution of traffic, the device forwards incoming traffic according to the combination of source and destination IP address. All traffic from a particular source is forwarded only to its mapped server. This means that all requests for a given source IP are sent to the same application server instance. This method is useful in cases where all requests or sessions are required to be processed by the same server. For example: banking websites, E-Commerce websites.
Health Check (available only if Load Balancing is enabled)
Sophos XG Firewall | Protect | 360
Click to enable a health check for failover and specify the parameters based on the description shown below.
Port (available only if selected Health Check Method is TCP Probe)
Specify the port number on the server health is monitored.
Acceptable range: 1 to 65535
Interval
Specify the time interval in seconds after which the health will be monitored.
Acceptable range: 5 to 65535 seconds
Default: 60
Probe Method
Select the probe method to check the health of the server from the available options.
Available Options:ICMP TCP
Timeout
Specify the time interval in seconds within which the server must respond.
Acceptable range: 1 to 10 seconds
Default: 2
Retries
Specify the number of tries to probe the health of the server, after which the server will be declared unreachable.
Acceptable range: 1 to 10
Default: 3
Figure 311: Load Balancing
8. Specify Identity details.
Match known users
Match rule based on user identity allows you to check whether the specified user/user group from the selected zone is allowed to access the selected service or not.
Click to attach the user identity.
Enable check identity to apply the following policies per user.
Show Captive Portal to unknown users
Select the check box to accept traffic from unknown users. Captive portal page is displayed to the user where the user can login to access the Internet.
Sophos XG Firewall | Protect | 361
Clear the check box to drop traffic from unknown users.
User or Groups (available if Match known users is selected)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting (available if Match known users is selected)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic from user data accounting. The traffic allowed through this firewall rule will not be accounted towards data transfer for the user.
Figure 312: Identity
9. Specify Advanced settings details.
a) Specify Polices for Business Applications.
Intrusion Prevention
Select the required IPS policy. If Match rule based on user identity is enabled, user’s IPS policy will be applied automatically, but will not be effective till the respective module is subscribed. A new IPS policy can be created directly from this page or from the Protect > Intrusion Prevention >
IPS Policies page.
Traffic Shaping Policy
Select the required traffic shaping policy. If Match rule based on user identity is enabled, user’s traffic shaping policy will be applied automatically.
You need to select traffic shaping policy for the rule if Match known users is not selected.
A new traffic shaping policy can be created directly from this page or from the System > Profiles >
Traffic Shaping page.
Figure 313: Policies for Business Applications
b) Specify Security Heartbeat details (available only if IPv4 is selected).
Minimum Source HB Permitted
Select a minimum health status that a source device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this rule will not be granted to the user.
Sophos XG Firewall | Protect | 362
Block clients with no heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a source device’s access to certain services and networks.
Enable the option to require the sending of heartbeats.
Block request to destination with no heartbeat (not available if Protected Zone selected is WAN)
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can block requests to destinations not sending heartbeat.
Enable/disable the option to require the sending of heartbeats.
Figure 314: Synchronized Security
c) Specify Routing details.
Rewrite source address (Masquerading)
Enable/disable to re-write the source address or specify a NAT policy.
Use Outbound Address (available only if Rewrite source address is enabled)
Select the NAT policy to be applied from the list of available NAT policies.
A new NAT policy can be created directly from this page or from the System > Profiles > Network
Address Translation page.
The default NAT policy is Masquerade.
MASQ (Interface Default IP): IP Address of the selected Protected Zone as configured in
Configure > Network > Interfaces will be displayed instead of (Interface Default IP).
Create Reflexive Rule
Enable to automatically create a reflexive firewall rule for the protected host.
A reflexive rule has the same policies as those rules configured for the hosted server but instead of source zone to destination zone, this rule is applicable on traffic from destination zone to source zone.
By default, the reflexive rule is not created.
Sophos XG Firewall | Protect | 363
Figure 315: Routing
10. Specify the logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 316: Log Traffic
11. Click Save.
The non-web based rule has been created and appears on the Firewall page when the appropriate filter is set.
Add Rule for Email Clients (POP and IMAP)
Email Clients (POP and IMAP) rule is used to protect mail servers which are hosted publicly (WAN). This page describes how to configure a protection rule and control access of mail servers using application template - Email
Clients .
Note:
If you delete Email Clients rule, the Emails which are under process by this rule will be queued but will not be delivered.
We recommend to follow below given steps so that you do not lose all the emails processed by this rule:
1. Before deleting this rule, clone this rule by choosing Clone Above option and change the Action to Drop.
This cloned rule will hold all the incoming emails.
2. Go to Email > Mail Spool and check if spool is empty.
3. Once the spool is empty, delete both the firewall rules.
1. Go to Protect > Firewall and select between IPv4 or IPv6 using the default filter.
2. Now, click +Add Firewall Rule and select Business Application Rule.
3. Specify the general rule details.
Application Template
Select Email Clients (POP & IMAP) to define a application filter policy for POP and IMAP based email clients.
Description
Specify the rule description.
Rule Position
Specify the position of the rule.
Available Options:TopBottom
Rule Name
Specify a name to identify the rule.
Sophos XG Firewall | Protect | 364
Figure 317: About This Rule
4. Specify Source details.
Zone
Select the allowed source zone(s).
Networks
Select the allowed source network(s) . A new network host can be created directly from this page or from the System > Hosts and Services > IP Host page.
Figure 318: Source
5. Specify Destination details.
Zone
Select the zone to which the rule applies.
Networks
Select the network(s) to be protected.
A new network host can be created directly from this page or from the System > Hosts and
Services > IP Host page.
Figure 319: Destination
6. Specify Identity details.
Match rule based on user identity
Click to enable a rule based on the user identity.
Show Captive Portal to unknown users
Select the check box to accept traffic from unknown users. Captive portal page is displayed to the user where the user can login to access the Internet.
Clear the check box to drop traffic from unknown users.
User or Groups (available only if Match rule based on user identity is enabled)
Select the user(s) or group(s) from the list of available options.
Sophos XG Firewall | Protect | 365
Exclude this user activity from data accounting (only available if Match rule based on user identity is
enabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic from user data accounting. The traffic allowed through this rule will not be accounted towards data transfer for the user.
Figure 320: Identity
7. Specify Malware Scanning details.
Scan IMAP/IMAPS/POP3/POP3S/SMTP/SMTPS
Click to enable/disable scanning of IMAP/IMAPS/POP3/POP3S/SMTP/SMTPS traffic.
Figure 321: Malware Scanning
8. Specify Advanced settings.
a) Specify Policies for Business Applications.
Intrusion Prevention
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from the Protect > Intrusion Prevention > IPS Policies page.
Traffic Shaping (Not available if Match rule based on user identity is selected)
Select a traffic shaping policy for the rule.
A traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
A new traffic shaping policy can be created directly from this page or from the System > Profiles >
Traffic Shaping page.
Figure 322: Policies for Business Applications
b) SpecifySecurity Heartbeat settings (available only if IPv4 is selected).
Minimum Source HB Permitted
Sophos XG Firewall | Protect | 366
Select a minimum health status that a source device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this rule will not be granted to the user.
Block clients with no heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a source device’s access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Destination HB Permitted (Not available if the only Destination Zone selected is WAN)
Select a minimum health status that a destination device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this policy will not be granted to the user.
Note: You can use the option if you have selected multiple zones along with WAN.
Block request to destination with no heartbeat (Not available if the only Destination Zone selected is WAN)
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can block requests to destinations not sending heartbeat.
Enable/disable the option to require the sending of heartbeats.
Note: You can use the option if you have selected multiple zones along with WAN.
Figure 323: Security Heartbeat
c) Specify Routing details.
Rewrite source address (Masquerading)
Enable/disable to re-write the source address or specify a NAT policy.
Use Gateway Specific Default NAT Policy (only if Masquerading is selected)
Select to override the default NAT policy with a gateway specific policy.
Override default NAT policy for specific Gateway (only if Use Gateway Specific Default NAT Policy
is selected )
Select to specify gateway and corresponding NAT policy. Multiple gateways and NAT policies can be added.
Use Outbound Address (available only if Rewrite source address is enabled and Use Gateway
Specific Default NAT Policy is disabled )
Sophos XG Firewall | Protect | 367
Select the NAT policy to be applied the list or available NAT policies.
A new NAT policy can be created directly from this page or from the System > Profiles > Network
Address Translation page.
The default NAT policy is Masquerade.
MASQ (Interface Default IP)
• IP Address of the Destination Zone as configured in Configure > Network > Interfaces will be displayed instead of (Interface Default IP) when single Destination Zone is selected.
• (Interface Default IP) will be displayed when multiple Destination Zones are selected.
Primary Gateway
Select the primary gateway to route the request. You can create new gateway from this page itself or from Configure > Routing > Gateways.
Note: On deletion of the gateway, Primary Gateway will display WAN Link Load
Balance for WAN Destination Zone and None for other zones. In such case, firewall rule will not make routing decisions.
Backup Gateway
Select the backup gateway to route the request. You can create new gateway from this page itself or from Configure > Routing > Gateways.
Note: On deletion of the gateway, Backup Gateway will display None.
Figure 324: Routing
9. Specify logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 325: Log Traffic
Add Rule for Email Servers (SMTP)
This page describes how to configure a rule for email servers (SMTP).
1. Go to Protect > Firewall and select between IPv4 or IPv6 using the default filter.
2. Now, click +Add Firewall Rule and select Business Application Rule.
3. Specify the general rule details.
Application Template
Select Email Servers (SMTP) to configure a rule for SMTP based email applications.
Description
Sophos XG Firewall | Protect | 368
Specify the policy description.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Rule Name
Specify a name to identify the policy.
Figure 326: About This Rule
4. Specify Source details.
Source Zones
Click to select the source zone. Click Add New Item to define a new LAN or DMZ zone.
Allowed Client Networks
Select the allowed host(s) or add a new one by clicking Add New Item.
Blocked Client Networks
Select the blocked host(s)/network(s).
Figure 327: Source
5. Specify Destination & Service details.
Destination Host/Network
Select the destination host/network to apply rule. It is the public IP address through which users access internal server/host over the Internet.
Available Options:IP Address – Specified IP address is mapped to a corresponding mapped single or range of IP addresses. If a single IP address is mapped to a range of IP addresses, the device uses a sticky IP algorithm to load balance the requests.IP Range – Specified IP address range is mapped to a corresponding range of mapped IP addresses. The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP (only
available for IPv4) – Select when any of the device port, alias or virtual LAN (VLAN) sub interface is required to be mapped to the destination host or network.
Services
Select the services allowed to the user. A new service can be directly created from this page.
Add new item
Name: Enter a name to identify the service.
Type: Select a protocol for the service.
Available Options:TCP/UDP: Enter Source and Destination port. You can enter multiple ports for the same service. The number of source and destination ports must not exceed 16.IP: Select
Protocol Number for the service. You can select multiple ports for the same service.ICMP: Select
ICMP Type and Code. You can enter multiple types and codes for the same service. Use Add icon and Remove icon to add and delete the parameters respectively. ICMPv6: Select ICMPv6
Sophos XG Firewall | Protect | 369
Type and Code. You can enter multiple types and codes for the same service. Use Add and
Remove to add and delete the parameters.
Figure 328: Add Service
Figure 329: Destination and Service
6. Specify Forward To details.
Protected Server(s)
Select from the available options on which the email server is to be hosted.
Available options: IP Address – External IP address is mapped to the specified IP address.IP
Range – External IP address range is mapped to the specified IP address range.IP List – External IP address is mapped to the specified IP list.FQDN (available only for IPv4 virtual hosts) – External
IP address is mapped to the specified FQDN. Internal mapped server can be accessed by FQDN.
Note: For IP Range and IP List, you can also use a single external IP address. The device will then use load balancing for handling the requests.
Mapped Port (available only if Change Destination Port(s) is selected)
Specify mapped port number on the destination network to which the public port number is mapped.
Mapped port must have the same number of ports as specified in the public service, or at least have one port. Mapped Port is disabled if:
• No TCP/UDP service is selected.
• Multiple services are selected.
• Service group is selected.
• Selected service is with TCP/UDP combination.
Protected Zone
Select the zone to which the email server rule applies.
Change Destination Port(s)
Select the check box to specify different mapped port. Clear the check box to use the same Service
Port(s) Forwarded as mapped port.
Sophos XG Firewall | Protect | 370
Figure 330: Forward To
7. Specify Load balancing details.
Load Balancing (available only if selected Protected Server is IP Range or IP List and selected
Destination Host/Network is IP Address)
Select the method for load balancing from the available options.
Available Options:Round Robin - In this method, requests are served in a sequential manner where the first request is forwarded to the first server, second request to the second server and so on. When a request is received, the device checks to see which the last server that was assigned a request was.
It then assigns this new request to the next available server. This method is can be used when equal distribution of traffic is required and there is no need for session-persistence.First Alive - In this method, all incoming requests are served by the first server (the first IP address that is configured in the IP range). This server is considered as the primary server and all others are considered as backup. Only when the first server fails, the requests are forwarded to the next server in line. This method is used for failover scenarios. Random -In this method, the requests are forwarded to the servers randomly. Although, the device makes sure that all configured servers receive equally distributed load. Hence, this method is also called uniform random distribution. This method can be used when equal distribution of traffic is required and there is no need for session-persistence or order of distribution.Sticky IP - In this method, along with Round Robin distribution of traffic, the device forwards incoming traffic according to the combination of source and destination IP address. All traffic from a particular source is forwarded only to its mapped server. This means that all requests for a given source IP are sent to the same application server instance. This method is useful in cases where all requests or sessions are required to be processed by the same server. For example: Banking websites, E-Commerce websites.
Health Check (available only if Load Balancing is enabled)
Click to enable health check for failover and specify the parameters based on the description shown below.
Port (available only if selected health check method is TCP Probe)
Specify the port number on the server health is monitored.
Acceptable range: 1 to 65535
Interval
Specify the time interval in seconds after which the health will be monitored.
Acceptable range: 5 to 65535 seconds
Default: 60
Probe Method
Select the probe method to check the health of the server from the available options.
Available Options:ICMP TCP
Timeout
Specify the time interval in seconds within which the server must respond.
Acceptable range: 1 to 10 seconds
Sophos XG Firewall | Protect | 371
Default: 2
Retries
Specify the number of tries to probe the health of the server, after which the server will be declared unreachable
Acceptable range: 1 to 10
Default: 3
Figure 331: Load Balancing
8. Specify Identity details.
Match known users
Match known users allows you to check whether the specified user/user group from the selected zone is allowed to access the selected service or not.
Click to attach the user identity.
Show Captive Portal to unknown users
Select the check box to accept traffic from unknown users. Captive portal page is displayed to the user where the user can login to access the Internet.
Clear the check box to drop traffic from unknown users.
User or Groups (available only if Match known users is enabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting (available only if Match known users is enabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic from user data accounting. The traffic allowed through this firewall rule will not be accounted towards data transfer for the user.
Figure 332: Identity
Sophos XG Firewall | Protect | 372
9. Specify Scanning details.
Scan SMTP
Click to enable/disable scanning of SMTP traffic.
Scan SMTPS
Click to enable/disable scanning of SMTPS traffic.
Figure 333: Scanning
10. Specify Advanced settings details.
a) Specify Polices for Business Applications.
Intrusion Prevention
Select the required IPS policy. If Match rule based on user identity is enabled, user’s IPS policy will be applied automatically, but will not be effective till the respective module is subscribed.
A new IPS policy can be created directly from this page or from the Protect > Intrusion
Prevention > IPS Policies page.
Traffic Shaping Policy (not available if Match known users is selected)
Select the required IPS policy. If Match rule based on user identity is enabled, user’s QoS policy will be applied automatically.
A new traffic shaping policy can be created directly from this page or from the System > Profiles >
Traffic Shaping page.
Figure 334: Policies for Business Applications
b) Specify Security Heartbeat settings (available only if IPv4 is selected).
Minimum Source HB Permitted
Select a minimum health status that a source device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this rule will not be granted to the user.
Block clients with no heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a source device’s access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Destination HB Permitted (not available if Protected Zone selected is WAN)
Select a minimum health status that a destination device must have to conform to this rule. Health status can be either Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this rule will not be granted to the user.
Sophos XG Firewall | Protect | 373
Block request to destination with no heartbeat (not available if Protected Zone selected is WAN)
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can block requests to destinations not sending heartbeat.
Enable/disable the option to require the sending of heartbeats.
Figure 335: Security Heartbeat
c) Specify Routing details.
Rewrite source address (Masquerading)
Enable/disable to re-write the source address or specify a NAT policy.
Use Outbound Address (available only if Rewrite source address is enabled)
Select the NAT policy to be applied from the list of available NAT policies.
A new NAT policy can be created directly from this page or from the System > Profiles > Network
Address Translation page.
The default NAT policy is Masquerade.
MASQ (Interface Default IP): IP Address of the selected Protected Zone as configured in
Configure > Network > Interfaces will be displayed instead of (Interface Default IP).
Create Reflexive Rule
Select ON to automatically create a reflexive firewall rule for the protected host.
The reflexive rule has the same policies as those configured for the hosted server but instead of source zone to destination zone, this rule is applicable on traffic from destination zone to source zone.
By default, the reflexive rule is not created.
Figure 336: Routing
11. Specify the logging option for the user application traffic.
Log Firewall Traffic
تنزيل
تم تحديث الرابط العام
رابط عام للمستند
إعلان
