Wireless. Sophos XG Firewall

PDF

Document

Advertentie

Sophos XG Firewall | Protect | 405

Traffic Shaping Default

The Traffic Shaping Default page allows you to view the list of all application categories. This page also provides the option to edit the category or application to apply a traffic shaping policy.

The applications shipped with the device are grouped into categories. These categories can be used in filtering policy and bandwidth restriction can be applied to the category or to the individual application within the category.

The categories list can be filtered based on name of the category. Use the or toggle beside the category name to expand and collapse the list of applications grouped in the respective category.

Configure Traffic Shaping Policy for Category or Application

Use this page to configure traffic shaping policy.

This page allows you to configure traffic shaping policy for category or application.

Go to Protect > Applications > Traffic Shaping Default and click .

2. Enter the details.

Name

Displays the name of the Application Filter Category or Application.

Traffic Shaping Policy

Select a policy or click Create new to create a new traffic shaping policy for the application/ application category.

Traffic Shaping policy allocates and limits the bandwidth usage of the user, web category, application category.

3. Click Save.

Wireless

Wireless Protection allows you to configure the following:

•

Wireless Networks

: Create and manage Wireless Networks.

•

Mesh Networks

: Create and manage Mesh Networks.

•

Access Points

: Provides an overview of the access points known to the device.

•

Access Point Groups

: Allows you to organize access points in groups.

•

Hotspots

: Add/remove Hotspots and apply filtering policies.

•

Hotspot Voucher Definition

: Manage different voucher definitions for Hotspot access vouchers.

•

Rogue AP Scan

: Schedule scanning to discover authorized APs and rogue APs.

Wireless Client List

The Wireless Client List page displays a live snapshot of currently managed APs, broadcasted SSIDs (wireless networks), wireless clients connected through SSID to AP and mesh networks.

Show by SSID/Show by AP

The administrator can filter currently connected clients by Access Point or SSID

The page provides a list of wireless clients along with their name, IP address, MAC address, signal, last data transfer rate, connection time, frequency, vendor.

Sophos XG Firewall | Protect | 406

Figure 368: Wireless Client List

Wireless Networks

The Wireless Networks menu allows managing the wireless networks connected to the device.

Note: You can also view the wireless network status on the Protect > Wireless > Wireless Client List

The page provides a list of all configured wireless networks along with their name, SSID, status, client traffic mode, encryption mode used and frequency band.

Figure 369: Wireless Networks List

Add a New Wireless Network

This page describes how to add a new wireless network.

Newly created wireless networks can be used in definitions for access points and access point groups.

1. Go to Protect > Wireless > Wireless Networks and click the Add button.

2. Specify the General Settings settings.

Name

Specify a descriptive name for the network.

Description

Enter a description for the wireless network that helps you to identify it.

SSID

Enter the Service Set Identifier (SSID) for the network which will be seen by clients and allow them to identify the wireless network. The SSID may consist of 1-32

ASCII printable characters

Security Mode

Select a security mode from the drop-down list.

Default: WPA 2 Personal.

Note: We recommend to use WPA2. For security reasons, we recommend not to use

WEP unless there are clients using your wireless network that do not support one of the other methods.

When using an enterprise authentication method, you also need to configure a RADIUS server on the Configure > Authentication > Servers page. As NAS ID of the RADIUS server enter the wireless network name.

Note: Sophos XG Firewall supports the IEEE 802.11r standard in WPA2 (PSK/

Enterprise) networks to reduce roaming times. Clients also need to support the IEEE

802.11r standard.

Passphrase/PSK (available only if WPA Personal, WPA2Personal, or WPA2/WPA Personal

security mode is selected)

Sophos XG Firewall | Protect | 407

Specify the passphrase to protect the wireless network from unauthorized access and repeat it in the

Confirm Passphrase/PSK field. The passphrase may consist of 8-63 ASCII printable characters.

Key (available only if WEP Open security mode is selected)

Specify a WEP key that consists of exactly 26 hexadecimal characters.

Client Traffic

From the dropdown list select how the wireless network is to be integrated into your local network.

Available options:

• Separate Zone

• Bridge to AP LAN

• Bridge to VLAN

Default: Separate Zone.

Separate Zone

The wireless network is handled as a separate network, having an IP address range of its own. Using

this option, after adding the wireless network, proceed as described in the chapter

Next Steps for

Separate Zone Networks

Note: When switching an existing Separate Zone network to Bridge to AP LAN or

Bridge to VLAN, a previously configured WLAN interface will be deleted.

Zone

From the dropdown list select a zone where the wireless network should be broadcast.

Default: WiFi.

IP Address

Assign an IP address to the wireless network.

Netmask

Select a subnet mask for the IP address.

Bridge to AP LAN

You can bridge a wireless network into the network of an access point, which means that wireless clients share the same IP address range. Using this option, after adding the wireless network, proceed as described in the chapter

Next Steps for Bridge to AP LAN Networks

Bridge to VLAN (not available for local WiFi devices)

You can decide to have this wireless network’s traffic bridged to a VLAN of your choice. This is useful when you want access points to be in a common network separate from the wireless clients.

Bridge to VLAN ID

Specify the VLAN ID of the network that the wireless clients should be part of.

Client VLAN ID (only available with an enterprise security mode)

Select how the VLAN ID is defined.

• Static: Uses the VLAN ID defined in the Bridge to VLAN ID field.

• RADIUS & Static: Uses the VLAN ID delivered by your RADIUS server: When a user connects to one of your wireless networks and authenticates at your RADIUS server, the

RADIUS server tells the access point what VLAN ID to use for that user. Thus, when using multiple wireless networks, you can define per user who has access to which internal networks.

If a user does not have a VLAN ID attribute assigned, the VLAN ID defined in the Bridge to

VLAN ID is used.

Sophos XG Firewall | Protect | 408

Figure 370: Add Wireless Network

3. Specify the Advanced Settings.

Encryption (available only if the WPA, WPA2, or WPA2/WPA encryption mode is selected)

Select an encryption algorithm, which can be AES, TKIP or TKIP&AES.

Note: For security reasons and better performance, we recommend you to use AES.

Frequency Band

Access points assigned to this wireless network will transmit on the selected frequency band(s).

The 5 GHz band generally has a higher performance, lower latency, and is typically less disturbed.

Hence it should be preferred for e.g. VoIP communication.

Time-based Access

Select this checkbox to enable the wireless network access according to a time schedule.

Select Active Time (available only if Time-based Access is selected)

Select a schedule definition which determines when the wireless network is enabled. You can add a new schedule definition by clicking Add New Item .

Client Isolation

Clients within a network usually can communicate with one another. If you want to prevent this, for example in a guest network, select Enabled from the drop-down list.

Hide SSID

If you want to hide the wireless network’s SSID, select the Enable checkbox. Please note that this is not a security feature.

Fast Transition (available only if WPA2 Personal/Enterprise security mode is selected)

Wireless networks with WPA2 security use the IEEE 802.11r standard. If you want to prevent this, select Disabled from the drop-down list.

MAC Filtering

Sophos XG Firewall | Protect | 409

To restrict the MAC addresses allowed to connect to this wireless network, select Blacklist or

Whitelist. With Blacklist, all MAC addresses are allowed except those listed on the MAC List.

With Whitelist, all MAC addresses are prohibited except those listed on the MAC List.

MAC hosts added under System > Hosts and Services > MAC Host will be displayed in the MAC

List.

Figure 371: Wireless Network Advanced Settings

4. Click Save.

Next Steps for Separate Zone Networks

This page describes how to configure a seperate zone network.

When you add a wireless network with the option Separate Zone, a new corresponding virtual hardware interface will be added automatically, e.g., wlnet1. To be able to use the wireless network, some further manual configuration steps are required.

1. Enable DHCP for the wireless clients.

For your clients to be able to connect to Sophos XG Firewall, they need to be assigned an IP address and a default gateway. Therefore, on the Protect > Network > DHCP page, set up a DHCP server for the interface.

2. Create a network policy on the Policies page to provide Internet access to the wireless clients.

You can now assign the wireless network to the AP at Protect > Wireless > Access Points.

Bridge to AP LAN Networks with Local Devices

For Local Wi-Fi Devices you need to configure some extra settings to enable bridging for the AP LAN.

1. Edit the Local Wi-Fi Device on the Protect > Wireless > Access Points page and select the wireless network.

2. Either create a new bridge interface on the Protect > Network > Interfaces page to use the wireless interface in bridge mode or edit the interface on the Configure > Network > Interfaces page, select a zone and provide an IP address to use the interface in gateway mode.

3. If you want to use the interface in gateway mode, create a DHCP server on the Protect > Network > DHCP page so that the client can receive an IP.

Wireless clients can now connect to the wireless network.

Access Point Overview

This page provides an overview of the access points (AP) known to the system.

Sophos XG Firewall | Protect | 410

Access Point Types

Sophos XG Firewall currently provides the following types of dedicated access points:

Table 3:

Name

AP 10

AP 15

AP 15c

AP 30

AP 50

AP 55

AP 55C

AP 100

AP 100C

802.11b/g/n

802.11a/b/g/n

Sophos XG Firewall also provides the following dedicated outdoor access points:

Table 4:

Name

AP 100X

Standards

802.11a/b/g/n

802.11a/b/g/n/ac

Standards

802.11a/b/g/n/ac

Band

2.4 GHz

2.4/5 GHz dual-band/ single-radio

2.4 GHz

2.4/5 GHz dual-band/ dual-radio

Channels 1-11

Channels 1-11,

36-48, 149-165

Channels 1-11,

36-48, 149-165

2.4/5 GHz dual-band/ dual-radio

FCC regulatory domain (mainly US)

ETSI regulatory domain (mainly

Europe)

Channels 1-11,

36-48, 149-165

Channels 1-11,

36-48, 149-165

Channels 1-11,

36-48, 149-165

Channels 1-13

Channels 1–13,

36-48

Channels 1-13,

36-64, 100-116,

132-140

Channels 1-13,

36-64, 100-116,

132-140

Channels 1-13,

36-64, 100-116,

132-140

Channels 1-13,

36-64, 100-116,

132-140

Band

2.4/5 GHz dual-band/ dual-radio

FCC regulatory domain (mainly US)

Channels 1-11,

36-64, 100-116,

132-140

ETSI regulatory domain (mainly

Europe)

Channels 1-13,

100-116, 132-140

Sophos XG Firewall also provides the following Wi-Fi Remote Ethernet Devices:

Table 5:

Name

RED 15w

Standards

802.11a/b/g/n

Sophos XG Firewall also provides the following local Wi-Fi devices:

Band

2.4/5 GHz dual-band

Sophos XG Firewall | Protect | 411

Table 6:

Name

SG 105w/115w

SG 125w/135w

Standards

802.11a/b/g/n

802.11a/b/g/n/ac

Band

2.4/5 GHz dual-band

Note: Because of the bandwith on the APs with ac standard there may be an automatic channel change in some cases. For example, if you select channel 36 the AP could choose channel 40 instead because it provides a better connection. The channel shown on the Access Points page represents the primary channel. This can affect all AP 100 appliances (AP 100, AP 100C and AP 100X) and all SG appliances with integrated access

(SG 105w/115w and SG 125w/135w).

Note: *This article includes information on EOL hardware, which may continue to work but will be unsupported.

Access Points

The Access Points menu allows you to manage the access points (AP) known to the system.

Sophos XG Firewall distinguishes between active, inactive and pending APs. To make sure that only genuine APs connect to your network, APs need to be authorized first.

Access points can be temporarily disabled. When an AP is physically removed from your network, you can delete from the table by clicking the Delete button. As long as the AP remains connected to your network, it will automatically re-appear in the Pending Access Points list after deletion. Sophos XG Firewall appliances with onboard Wi-Fi cannot be deleted from the AP list.

Protect > Wireless > Access Points

This page displays a list of all the active/inactive access points as well as a lists of all the pending access points. It provides options to edit or delete access points and to accept pending access points. You can also view access points on the Protect > Wireless > Wireless Client List page.

Active/Inactive Access Points

For each access point, the list shows you:

Access point ID

Label

Label of the AP, which allows it to be identified easily in the network.

Status

Status of the access point (active/inactive). Active APs are connected, configured, and running.

Inactive APs have been configured in the past but are currently not connected to Sophos XG

Firewall. If an AP remains in this state for more than five minutes, please check the network connectivity of the AP and the configuration of your system.

Channel

Channel the AP transmits on.

Group

Access point group the AP is assigned to.

Country

Country where the AP is located.

MAC

MAC address of the AP.

IP/Last Seen

Sophos XG Firewall | Protect | 412

Type

IP address of an active AP or the last seen IP address of an inactive AP.

Type of the AP

Figure 372: Active/Inactive Access Points

Pending Access Points

Here, APs are listed that are connected to the system but not yet authorized. After receiving its configuration, the authorized access point will immediately be displayed in the above section. For each access point, the list shows:

ID of the access point.

Label

Label of the AP, which allows it to be identified easily in the network.

Channel

Channel the AP transmits on.

Group

Access point group the AP is assigned to.

MAC

MAC address of the AP.

Figure 373: Pending Access Points

Rules for Assigning Networks to APs

An access point can only be assigned to a wireless network if the client traffic option of the wireless network and the

VLAN tagging option of the access point fit together. The following rules apply:

• Wireless network with client traffic Separate Zone: VLAN tagging of the access point can be enabled or disabled.

• Wireless network with client traffic Bridge to AP LAN: VLAN tagging of the access point has to be disabled.

• Wireless network with client traffic Bridge to VLAN: VLAN tagging of the access point has to be enabled.

The respective wireless clients will use the Bridge to VLAN ID specified for the wireless network, or they will receive their VLAN ID from the RADIUS server, if specified.

Note: An AP 5 can only be assigned to one single wireless network with the Client traffic option Bridge to

AP LAN.

Edit Access Point

This page describes how to edit an access point.

1. Go to Protect > Wireless > Access Points and click Edit icon under the Manage column.

2. Specify the Access Point details.

Sophos XG Firewall | Protect | 413

Displays the ID for the access point.

Label

Specify a label for easier identification of the AP in your network.

Country

Select the country where the AP is located.

Group

Select to organize APs in groups. If a group has been created before, you can select it from the dropdown list.

Figure 374: Edit Access Point

3. Specify the Wireless Networks details.

Wireless Networks

Select the wireless networks that should be broadcasted by the AP.

Note: You can only add a wireless network if the AP is not a member of any AP

Group.

Figure 375: Edit Access Point

4. Specify the Mesh Network details.

Mesh Networks (only available for AP50)

Select the mesh networks that should be broadcasted by the AP.

You can also add APs that should broadcast mesh networks from this page by clicking Create New.

Note: This option will only be displayed if a mesh network is configured.

5. Specify the Advanced Settings details.

Bridge to Ethernet

Turn it on to bridge the local wireless access point to Ethernet. The existing DHCP server will be used for the bridge port. If a DHCP server does not exist, a new server is automatically created. If you turn it off, the bridge is deleted and all configurations are restored to the physical interface.

Note: This feature is available only for IPv4 configurations and applicable only for the SSIDs that are of type, Bridge To LAN.

Port to Bridge

Sophos XG Firewall | Protect | 414

Select the port for bridge connection.

Note: The interface must have an IP address and should not belong to the WAN port or any other bridge. Bridging between VLAN interface and local Wi-Fi is not allowed.

Zone

Select the zone for the bridge connection. You cannot select the WAN zone here.

Channel 2.4 GHz

Select a channel for your wireless network.

Default: Auto

Note: Selecting “Auto” will automatically select the least used channel for transmission.

Dyn Chan

Enable to scan for the optimal channel at regular intervals. This may result in re-connection of all connected clients.

Time-based scan (available if Dyn Chan is enabled)

Enable to set a time at which the scan should take place.

Select Scan-Time (available if Time-based scan is enabled)

Click Add New Item and select a scanning time schedule.

TX Power

Select the transmission power for the AP.

Default: 100%

Channel 5 GHz

Select a channel for your wireless network.

Default: Auto

Note: Selecting “Auto” will automatically select the least used channel for transmission.

Dyn Chan

Enable to scan for the optimal channel at regular intervals. This may result in re-connection of all connected clients.

Time-based scan (available if Dyn Chan is enabled)

Enable to set a time at which the scan should take place.

Select Scan-Time (available if Time-based scan is enabled)

Click Add New Item and select a scanning time schedule.

TX Power 5GHz

Select the transmission power for the AP.

Default: 100%

STP

Select Enabled to use Spanning Tree protocol (STP). STP prevents bridge loops.

Default: Disabled

VLAN Tagging

Select to connect the AP with an existing VLAN Ethernet interface.

Default: Disabled

AP VLAN ID (available if VLAN Tagging is enabled)

Specify the VLAN ID that will be used by the AP to connect to the device.

The VLAN ID can be any number between 2 and 4094.

Sophos XG Firewall | Protect | 415

Figure 376: Edit Access Point

6. Click Save.

Access Point Groups

The Access Point Groups page allows you to organize access points in groups.

Protect > Wireless > Access Point Groups This page provides an overview of all access point groups and Local Wi-

Fi Devices. You can add, edit or delete a group. For each group, the list shows:

Name

Name of the access point group.

Status

Status of the access point group (active/inactive). Use the toggle switch to enable/disable the access point group.

Sophos XG Firewall | Protect | 416

Wireless Networks

Wireless networks the access point group is assigned to.

Access Points

List of all the access points in this group.

Figure 377: Access Point Groups

Add Access Point Group

This page describes how to add an access point group.

1. Go to Protect > Wireless > Access Point Groups and click Add.

2. Specify the access point group details.

Name

Enter a descriptive name for the new access point group.

Wireless Networks

Search for wireless networks and select the wireless networks that should be broadcasted by the access points of this group.

Note: For an access point to broadcast a wireless network some conditions have to be fulfilled. They are explained in the chapter

Access Points

in the section Rules for

Assigning Networks to APs.

VLAN Tagging

Select Enable if you want to activate VLAN tagging.

Note: Make sure that the VLAN interface is assigned to the zone which is selected in the Allowed Zone list on the Protect > Wireless > Wireless Settings page.

Access Points

Search for access points and select the ones you want to add to this group.

Note: Local Wi-Fi devices cannot be grouped and do not appear in the Access Point list. Local Wi-Fi devices appear in the Access Point Groups list.

Figure 378: Add Access Point Group

3. Click Save.

Sophos XG Firewall | Protect | 417

Mesh Networks

The Mesh Networks menu allows you to create mesh networks and associate APs.

Protect > Wireless > Mesh Networks

In a mesh network, multiple access points communicate with each other and broadcast a common wireless network.

On the one hand, access points connected via a mesh network can broadcast the same wireless network to clients, thus working as a single access point, while covering a wider area. On the other hand, a mesh network can be used to bridge Ethernet networks without laying cables. Access points associated with a mesh network can play one of two roles: root access point or mesh access point. Both broadcast the mesh network, thus the number of other wireless networks they can broadcast is reduced by one.

Root access point

This has a wired connection to Sophos XG Firewall and provides a mesh network. An access point can be root access point for multiple mesh networks.

Mesh access point

This needs a mesh network to connect to Sophos XG Firewall via a root access point. An access point can be mesh access point for only one mesh network at a time.

A mesh network can be used to implement a wireless bridge or a wireless repeater:

Wireless bridge

Using two access points, you can establish a wireless connection between two Ethernet segments. A wireless bridge is useful when you cannot lay a cable to connect those Ethernet segments. While the first Ethernet segment with your Sophos XG Firewall is connected to the

Ethernet interface of the root access point, the second Ethernet segment has to be connected to the Ethernet interface of the mesh access point.

Using multiple mesh access points, you can connect more Ethernet segments.

Wireless repeater

Your Ethernet with your Sophos XG Firewall is connected to the Ethernet interface of a root access point. The root access point has a wireless connection via the mesh network to a mesh access point, which broadcasts wireless networks to wireless clients.

This page displays a list of all the available mesh networks. You can add, edit or delete a mesh network. For each network the list shows:

Mesh-ID

Identifier of the mesh network.

Status

Indicates the current status of the mesh network

Frequency Band

Frequency band on which the associated access points broadcast the mesh network.

Sophos XG Firewall | Protect | 418

Related tasks

Add Mesh Network

on page 418

This page describes how to create mesh networks and assign access points to them.

Add Mesh Network

This page describes how to create mesh networks and assign access points to them.

1. Go to Protect > Wireless > Mesh Networks and click Add.

2. Specify the General Settings details.

Mesh ID

Enter a unique ID for the mesh network.

Frequency Band

Select a frequency band from the available options:

• 5 GHz

• 2.4 GHz

Access points assigned to this network will transmit the mesh network on the selected frequency band. Generally, it is a good idea to use a different frequency band for the mesh network than for the broadcasted wireless networks.

Description

Enter a description or other information to identify the mesh network.

Access Point

Select one or more mesh access points.

a) Click the + icon to select access points that broadcast the mesh network.

b) Specify the Mesh Network Role details.

Access Points

Select an access point.

Note: Except for AP5 and AP10, all the APs can be used for broadcasting mesh networks.

Role

Define the access point’s role for the selected mesh network. A root access point is directly connected to Sophos XG Firewall. A mesh access point, after having received its initial configuration, once unplugged from the Sophos XG Firewall will connect to a root access point via the mesh network.

Note: An access point can be mesh access point only for one mesh network.

Sophos XG Firewall | Protect | 419

Figure 379: Add Mesh Network

c) Click Save.

The dialog window is closed and the access point is added to the Access Points list.

3. Click Save.

Note: It is crucial for the initial configuration to plug the mesh access point, like every other access point, into one of the Ethernet segments selected in the Allowed Zone box on the Protect >

Wireless > Wireless page.

Hotspots

The Hotspots menu allows you to enable the Hotspots feature and define users who are allowed to view and distribute hotspot access information.

Protect > Wireless > Hotspots

By means of hotspots cafés, hotels, companies, etc. can provide time- and traffic-restricted Internet access to guests.

The hotspot feature is available within the Wireless Protection subscription, but also works with wired networks.

Note: You can also view and manage the hotspot status on the Monitor & Analyze > Diagnostics >

Services page.

Hotspot Generation

In the first step, the administrator creates and enables a hotspot with a specific type of access. The following types are available:

• Terms of use acceptance: The guest is presented with terms of use, which you can define, and has to select a checkbox to get access.

• Password of the day: The guest has to enter a password to get access. The password changes on a daily basis.

• Voucher: The guest gets a voucher and has to enter the voucher code to get access. The voucher can be limited in the number of devices, in time, and traffic.

Distribution of Access Information to Guests

With the access types Password of the day and Voucher, the access information has to be handed out to the guests.

Therefore you can define users who are allowed to manage and distribute access information. Those users receive and distribute the access information via the Hotspot tab of the User Portal:

• Password of the day: The current password can be sent via email and the users find the password in the User

Portal. The users forward the password to the guests. They can generate or enter a new password. The former password automatically becomes invalid and active sessions will be terminated. Other potential users will be informed of the new password, either by email or via the User Portal, depending on what is configured for them.

Sophos XG Firewall | Protect | 420

• Voucher: In the User Portal, users can create vouchers, each with a unique code. Different types of vouchers can be available if specified by the administrator. The vouchers can be printed or exported and given to the guests. A list of created vouchers gives an overview of their usage and helps to manage them.

Legal Information

In many countries, operating a public wireless LAN is subject to specific national laws, restricting access to websites of legally questionable content (e.g., file sharing sites, extremist websites, etc.). To meet this requirement, you can combine the hotspot with the web protection capabilities of Sophos XG Firewall which empowers you to control web access by blocking or allowing a single URL to an entire website category type. Sophos XG Firewall puts you in control of who accesses what and when. That way you can restrict hotspot usage as national or corporate policies require you to. In addition, the current feature of Sophos XG Firewall permits advanced logging and reporting capabilities. Reporting tracks who visited which site, when, and how many times, allowing you to identify inappropriate usage in case you want to operate a hotspot without any access restrictions. Which is even more important if legal regulations require you to register your hotspot at the national’s regulatory body.

For each hotspot, the list shows:

Name

Displays the name of the hotspot.

Hotspot Type

Displays the type of the hotspot.

Note: If you have configured direct proxy settings within your web browser and using Hotspot, you need to add Device’s IP in the proxy exception list.

Related concepts

Hotspot Voucher Definition

on page 428

Hotspot voucher definitions specify network access. You can use voucher definitions to limit the validity period, time quota, and data volume for users who have access to voucher-type hotspots.

Related tasks

Add Hotspot

on page 420

This page describes how to add a hotspot.

Add Hotspot

This page describes how to add a hotspot.

Note: A hotspot has to be assigned to an existing interface, typically a WLAN interface. All hosts using this interface will automatically be restricted by the hotspot. Therefore, before you create a hotspot you would typically create a wireless network with client traffic Separate Zone, then create an interface for the respective WLAN interface hardware.

1. Go to Protect > Wireless > Hotspots and click Add.

2. Specify the followings:

Name

Enter a unique name for the hotspot.

Description

Enter a description or other information to identify the Hotspot.

Interfaces

Select or add the interfaces which are to be restricted by the hotspot. An interface can only be used by one hotspot.

Note: Hotspots will work only on LAN and DMZ member interfaces of the bridge.

You should not select an uplink interface here because traffic to the Internet will be completely blocked afterwards. Additionally, we strongly advise not to use interfaces

Sophos XG Firewall | Protect | 421 applied by servers which provide essential services like authentication. You may irreversibly lock yourself out of Sophos XG Firewall.

Application Filter Policy

Select or add an application filter policy for the hotspot.

Web Policy

Select or add a web policy for the hotspot.

IPS Policy

Select or add IPS policy for the hotspot.

Traffic Shaping Policy

Select or add a traffic shaping policy for the hotspot.

Redirect to HTTPS

Enable this option to redirect users to HTTPS.

Hostname Type (available only if Redirect to HTTPS is enabled)

Select the hostname type for the hotspot.

Available Options:

• None (IP Address)

• Custom hostname

Hostname (available only if Custom hostname is selected)

Add a hostname for the redirection.

Hotspot Type

Select a hotspot type for the selected interfaces.

• Terms of Use Acceptance - Customers can access the Internet after accepting the terms of use.

Session Expires

Select the time span after which the access will be denied. After that, with the hotspot type Terms of

Use Acceptance, the users have to accept the terms of use again to log in.

Terms of Use

Add the text to be displayed as terms of use. Simple HTML markup and hyperlinks are allowed.

• Password of the Day - A new password will be created automatically once a day. This password will be available in the User Portal on the Hotspots tab which is available to all users specified for this hotspot. Additionally it will be sent to the specified email address(es).

Password Creation Time

Select the time of the day at which the new password will be created. At this time the former password will immediately become invalid and current sessions will be terminated.

Send Password by email to

Add email addresses to which the password will be sent.

Synchronize password with PSK of wireless networks

Select this option to synchronize the new generated/saved password with wireless PSK.

Note: With the new PSK all APs that are configured with a separate zone wireless network that is also used as a hotspot interface will be reconfigured and restarted. This means all connections will be dropped.

Administrative Users

Select or add users for administrative settings. Administrative users are allowed to create vouchers or change the password of the day in the User Portal. By default nobody is allowed to enter administrative settings.

Sophos XG Firewall | Protect | 422

• Voucher With this hotspot type, tokens with different limitations and properties can be generated in the User Portal, printed and given to customers. After entering the code, the customers can then access the Internet directly.

Voucher Definitions

Add or select the voucher definitions you want to use for the hotspot. How to add a voucher definition is explained on the Add Hotspot Voucher page.

Devices per voucher

Enter the number of devices which are allowed to log in with one voucher during its lifetime. It is not recommended to use the “unlimited” option.

Administrative Users

Users Have to Accept Terms of Use (not available with hotspot type Terms of Use Acceptance)

Enable this option if you want the hotspot users to accept your terms of use before accessing the

Internet.

Terms of Use

Add the text to be displayed as terms of use. Simple HTML markup and hyperlinks are allowed.

Redirect to URL after login

Enable this so that users will be redirected automatically to a particular URL after entering password or voucher data. The URL could, for example, be your hotel’s website or a web page stating your portal system policies.

URL

Enter the URL to which the user will be redirected .

Sophos XG Firewall | Protect | 423

Sophos XG Firewall | Protect | 424

3. Specify the Hotspot Customization details.

Enable Customization

Enable to use a customized HTML file with your own images and stylesheets. Additionally, you can customize the voucher layout.

Customization Type

Select the customization type.

• Basic Uses the default login page template. If required, change logo, title, and text.

Logo

Upload a logo for the login page. Supported image file types are jpg, jpeg, png and gif. A maximum image width of 300 px and height of 100 px is recommended (depending on the title length).

Scale logo to recommended size

If selected, a logo exceeding the recommended width or height will be scaled down and displayed in the recommended size. If it is not selected, the logo will be displayed in the original size.

Title

Add a title for the login page. Simple HTML markup and hyperlinks are allowed.

Custom Text

Add additional text for the login page. You can, for example, enter the SSID of the wireless network to be used. Simple HTML markup and hyperlinks are allowed.

• Full Select an individual login HTML page.

Login Page Template

Select the HTML template you want to use for your individual login page. Browse to select and upload the file. In this template, you can use variables that can insert information for each hotspot dynamically. For example, you can add the company name and administrator information, the terms of use and the login form. See detailed information in the chapter Login Page Template.

Images/Stylesheet

Add files that are referenced in your login page template, e.g., images, stylesheets, or JavaScript files. Browse to select and upload the files.

Voucher Template (only available for the hotspot type Voucher)

Browse to select and upload a PDF file with the voucher layout. By default, a default template is used. The voucher PDF file has to be of PDF version PDF 1.5 or lower. It may have any page size and format—both size and format will be adjusted during voucher creation in the User Portal, depending on page size and number of vouchers per page specified there.

The PDF file may contain the following variables that will be replaced with the respective values during voucher generation in the User Portal:

• Wireless network name (SSID): <?ssid0?> (and <?ssid1?>, <?ssid2?> and so on, if the

WLAN has more than one SSIDs)

• Wireless network password: <?psk0?> (and <?psk1?>, <?psk2?> and so on, if the WLAN has more than one SSIDs)

• Voucher code: <?code?>

• Voucher validity time:

<?validity?>

• Voucher data limit: <?datalimit?>

• Voucher time limit: <?timelimit?>

• Comment: <?comment?>

• QR code with the hotspot access data encoded:

<?qrX?>. The upper left corner of the QR code will be placed on the lower left corner of the variable.

Note: When using variables, the PDF file must include the entire character sets of the fonts used. When a variable is replaced by its value, and one of the substitute characters is not available, it

Sophos XG Firewall | Protect | 425 will be displayed incorrectly. We recommend to add the string

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789?

> (for English usage) to your PDF file, which will be removed automatically during voucher generation. If you use another language, you can include any other character set you want. Additionally, we recommend to use a separate line for the variables as the layout could get corrupted if the substituted text is too long.

Figure 380: Hotspot Customization

4. Click Save.

You can see if the hotspot is running on the Configure > System Services > Services page. There you can also stop or start the hotspot.

Related concepts

Services

on page 301

Services page allows you to view and manage the status of configured services.

Login Page Template

on page 425

This page gives an overview of possible variables of the hotspot login template.

Related tasks

Add Hotspot Voucher Definition

on page 428

Create a voucher definition.

Login Page Template

This page gives an overview of possible variables of the hotspot login template.

The HTML template for the login page may contain various variables that can insert information for the hotspot login page dynamically. When the device processes a template in order to display a login page, it replaces any template variables with the relevant value.

General variables

•

<?company_text?>: Default company text

• <?company_logo?>: Default company logo (Sophos logo). The variable will be replaced by the path of the logo file, usage e.g., <img src="<?company_logo?>">

• <?admin_contact?>: Administrator name or address as defined on System > Administration > Notification

Settings (Send Notifications to Email Address field)

Sophos XG Firewall | Protect | 426

•

<?admin_message?>: Administrator information label (default: For administrative questions please contact:)

• <?error?>: Error message that arose while trying to log in.

Variables used for all hotspot types

• <?terms?>: Terms of use (as defined on the Add Hotspot page)

•

<?redirect_host?>: Redirect URL that is specified for the hotspot (as defined on the Add Hotspot page)

• <?location?>: URL the user requested

• <?location_host?>: Hostname of the URL the user requested

• <?login_form?>: Login form suitable for the respective hotspot type: Password text box, Token text box,

Username and Password text boxes, or Accept checkbox, and Login button.

Note: For creating customized login forms, see section User Specific Login Form below.

• <?asset_path?> (only important for customization mode Full): Hotspot specific directory for storage of images or stylesheets (example usage: <img src="<?asset_path?>/logo.png">)

Variables only used for hotspot type Voucher

•

<?maclimit?> Number of allowed devices per voucher of this hotspot (as defined on the Add Hotspot page)

• <?numdevices?>: Number of devices used for this voucher

• <?timeend?>: Validity period (as defined on the Add Hotspot Voucher page)

• <?time_total?>: Total time quota allowed (as defined on the Add Hotspot Voucher page)

•

<?traffic_total?>: Total data volume allowed (as defined on the Add Hotspot Voucher page)

Templates can contain if variables that make up sections like the ones shown below. Each section has an opening and a closing variable. The contents of an if section is only displayed on a specific condition.

If Section Meaning

Section is displayed when the user has successfully logged in.

<?if_loggedin?>

<?if_loggedin_end?

<?if_notloggedin?>

if_notloggedin_end?

Section is displayed when the user has not yet logged in, e.g., because terms of use have to be accepted or because an error occurred.

if_authtype_password?

Section is displayed when hotspot type is Password of the Day.

if_authtype_password_end?

if_authtype_disclaimer?

Section is displayed when hotspot type is Terms of Use Acceptance.

if_authtype_disclaimer_end?

Sophos XG Firewall | Protect | 427

If Section Meaning

if_authtype_token?>

if_authtype_token_end?

Section is displayed when hotspot type is Voucher.

<?if_location?>

<?if_location_end?>

Section is displayed when the user has been redirected.

<?if_redirect_url?>

if_redirect_url_end?

Section is displayed when the checkbox Redirect to URL After Login is enabled.

if_not_redirect_url?

Section is displayed when the checkbox Redirect to URL after login is disabled.

if_not_redirect_url_end?

Section is displayed when a validity period is set for a voucher.

<?if_timelimit?>

<?if_timelimit_end?

<?if_trafficlimit?>

if_trafficlimit_end?>

Section is displayed when a data volume is set for a voucher.

<?if_timequota?>

<?if_timequota_end?

Section is displayed when a time quota is set for a voucher.

Section is displayed when a Devices per voucher value is specified.

<?if_maclimit?>

<?if_maclimit_end?

<?if_terms?>

<?if_terms_end?>

Section is displayed when Terms of Use are defined and enabled.

<?if_error?>

<?if_error_end?>

Section is displayed when an error occurred while trying to log in.

User-Specific Login Form

If you want to create your own login form instead of using the pre-defined <?login_form?> variable, consider the following:

• Enclose the form in the following tags:

• For a Terms of Use Acceptance hotspot, add a checkbox named "accept":

Sophos XG Firewall | Protect | 428

• For Password of the Day or Voucher hotspots, add a text box named "token":

• Add a means to submit the form, e.g., a "Login" button:

Hotspot Voucher Definition

Hotspot voucher definitions specify network access. You can use voucher definitions to limit the validity period, time quota, and data volume for users who have access to voucher-type hotspots.

Related concepts

Hotspot Settings

on page 432

The Hotspot Settings page allows you to make additional hotspot settings.

Related tasks

Add Hotspot Voucher Definition

on page 428

Create a voucher definition.

Add Hotspot Voucher Definition

Create a voucher definition.

1. Go to Protect > Wireless > Hotspot Voucher Definition and click Add.

2. Specify the voucher definition details.

Name

Specify a descriptive name for the voucher definition.

Description

Specify a description or other information.

Validity period

Specify the time for which vouchers of this type will be valid. The validity period starts from the first login.

Acceptable range: 1 minute to 730 days

Time quota

Specify the maximum connectivity time for vouchers of this type. The time quota starts at login and stops at logout. Counting stops after 5 minutes of inactivity.

Acceptable range: 1 minute to 500 hours

Data volume

Specify the maximum volume of data to be transmitted for vouchers of this type.

Acceptable range: 1 MB to 100 GB

Sophos XG Firewall | Protect | 429

Figure 381: Add Hotspot Voucher

3. Click Save.

Rogue AP Scan

This section is applicable to Wi-Fi models only.

A Rogue Access Point (AP) is any Wi-Fi access point connected to your network without authorization. It can be a setup used by an attacker for the purpose of sniffing wireless network traffic and can be used to conduct a man-in-themiddle attack. It allows anyone with a Wi-Fi-equipped device to connect to your corporate network, leaving your IT assets wide open for the casual snooper or criminal hacker.

Device can alleviate this by recognizing rogue access points potentially attempting to gain access to your network.

General Settings

Click Schedule system-triggered scan to enable a scheduled scan to discover authorized APs and rogue APs. You can select from the pre-defined schedules or create a custom schedule from System > Profiles > Schedule.

Figure 382: General Settings

Discover Access Points

To increase the security capabilities and identify unauthorized APs, Sophos Wireless Devices provide scanning capability by which nearby APs can be discovered and an administrator can take countermeasures against the most common types of illicit wireless activity.

To manually scan for the automatic discovery of APs, click Scan Now.

All the Access Points discovered are regarded as unrecognized until they are identified as authorized or rogue . To authorize an access point, click the icon against it in the Unrecognized AP table. To mark an access point as rogue, click the icon against it in the Unrecognized AP table.

If you are scanning for the first time after enabling Wireless LAN, all the discovered APs will be listed in the

Unrecognized Access Points table. The scanning result is displayed in the form of 3 tables:

Unrecognized Access Points table

The table lists all the nearby APs discovered and displays the following information:

Channel

Sophos XG Firewall | Protect | 430

The radio channel used by the access point.

BSSID

The MAC Address of the radio interface of the detected access point.

SSID

The radio SSID of the access point.

Signal Strength

The strength of the detected radio signal

Security Mode

Mode for encrypting the wireless traffic

Wireless Mode

Wireless protocol

Action

Click the icon to mark the AP as an authorized AP and move it to the Authorized AP table. Click the icon to mark the AP as a rogue AP and move it to the Rogue AP table.

Figure 383: Unrecognized Access Points

Rogue Access Points table

The table lists all the APs marked as “Rogue” and displays the following information:

Channel

The radio channel used by the access point.

BSSID

The MAC Address of the radio interface of the detected access point.

SSID

The radio SSID of the access point.

Signal Strength

The strength of the detected radio signal

Security Mode

Mode for encrypting the wireless traffic

Wireless Mode

Wireless protocol

Action

Click the icon to mark the AP as an authorized AP and move it to the Authorized AP table. Click the icon to mark the AP as an unrecognized AP and move it to the Unrecognized AP table.

Figure 384: Rogue Access Points

Authorized Access Points table

Sophos XG Firewall | Protect | 431

The table lists all the APs marked as “Authorized” and displays the following information:

Channel

The radio channel used by the access point.

BSSID

The MAC Address of the radio interface of the detected access point.

SSID

The radio SSID of the access point.

Signal Strength

The strength of the detected radio signal

Security Mode

Mode for encrypting the wireless traffic

Wireless Mode

Wireless protocol

Action

Click the icon to mark the AP as an unrecognized AP and move it to the Unrecognized AP table.

Click the icon to mark the AP as a rogue AP and move it to the Rogue AP table.

Figure 385: Authorized Access Points

Wireless Settings

The Wireless Settings page allows general configuration of wireless networks.

1. Go to Protect > Wireless > Wireless Settings.

2. Specify the Global Settings.

Enable Wireless Protection

Click the toggle switch to enable Wireless Protection.

Allowed Zone

Select network zones that are to be allowed for access point connectivity. These are the zones where access points are deployed to.

Note: If the wireless network uses WPA/WPA2 Enterprise Authentication as encryption mode then a RADIUS server needs to be specified.

Figure 386: Global Settings

3. Specify the Advanced Settings.

Notification Timeout

Sophos XG Firewall | Protect | 432

If an access point goes offline you get a notification. The Notification Timeout lets you configure a timeout for the notification. This means, if you set a delay of 2 minutes, the notification will be sent only if the access point is offline for at least 2 minutes. After the specified time, the AP will be considered inactive.

Timeout (in minutes)

The notification timeout requires an integer.

Default: 5 minutes.

Enterprise Authentication

For enterprise authentication, you need to provide some information of your RADIUS server. Note that access points do not communicate with the RADIUS server for authentication but only the

Sophos Firewall OS. Port 414 is used for the RADIUS communication between the Sophos Firewall

OS and the access points.

RADIUS Server

Select the required RADIUS server from the drop-down list. Servers can be added and configured on Configure > Authentication > Servers.

Note: When your RADIUS server is connected to the Sophos Firewall OS via an IPsec tunnel, you have to configure an additional SNAT rule to ensure that the communication works correctly. On the System > Profiles > Network Address

Translation page, add the following SNAT rule: For traffic from the APs’ network(s), using service RADIUS, and going to the RADIUS server, replace the source address with the IP address of Sophos Firewall OS used to reach the RADIUS server.

Figure 387: Advanced Settings

4. Click Apply.

Hotspot Settings

The Hotspot Settings page allows you to make additional hotspot settings.

Use this page to configure additional hotspot settings.

General Voucher Options

Here you can decide if and after which time interval you want to delete expired vouchers from the database. In the hotspot log you will still find information about deleted vouchers.

Figure 388: General Voucher Options