
## Sophos Firewall - Updates, new features and more

Here we inform you about important updates of the firewall hardware (SG, XG)
from Sophos.


sophos-firewall

Here we inform you about important updates of the firewall hardware (SG, XG) from Sophos.

Sophos Firewall - Updates, new features and more

Sophos Firewall


## Sophos Central - Updates, new features and more

Here we'll keep you informed about important updates, new features or new
products that have been added to Sophos Central.


sophos-central

Here we'll keep you informed about important updates, new features or new products that have been added to Sophos Central.

Sophos Central - Updates, new features and more

Sophos Central


## Avanet Shop - Price changes, updates and much more

Do you regularly shop at our Sophos store and use our dashboard to keep track of
your purchased hardware and licenses? Here you stay informed about changes.


avanet-shop

Do you regularly shop at our Sophos store and use our dashboard to keep track of your purchased hardware and licenses? Here you stay informed about changes.

Avanet Shop - Price changes, updates and much more

Avanet Shop


## Security Life - Current topics for everyday life

Here we'll tell you about the latest threats, new viruses, security gaps and
give advice on how to protect yourself with Sophos.


security-life

Here we'll tell you about the latest threats, new viruses, security gaps and give advice on how to protect yourself with Sophos.

Security Life - Current topics for everyday life

Security Life

In this blog post, I would like to introduce you to [Managed Threat Detection](https://www.avanet.com/en/shop/sophos-central-managed-threat-detection/) (MTD), which has been available for purchase since the end of July 2021. With MTD, Sophos primarily targets customers who are not (yet) ready to replace their existing third-party endpoint and server solution with the Sophos agent. For all other customers who already have a Sophos agent installed on their computers and servers and are running at least Intercept X Essentials, Managed Threat Detection is not relevant.

## The Managed Threat Response (MTR) success story.
Recently, Sophos announced that **Managed Threat Response** (MTR) now protects more than [one million devices](https://news.sophos.com/en-us/2021/10/26/another-milestone-for-sophos-managed-detection-and-response-mdr-service/). The [**Managed Threat Response**](https://www.avanet.com/en/shop/sophos-central-intercept-x-advanced-with-xdr-and-mtr/) Standard and Advanced products are the two most expensive options to protect computers and servers, but also offer the highest security and detection. You get an expert team of analysts, programmers, and threat hunters who work around the clock (24/7) to keep you and your employees safe from cyberattacks.

## Parallel operation with third-party vendors so far not possible
“Sophos Managed Threat **Response**” requires the MTR client, which cannot be run in parallel with third-party solutions such as Microsoft, Symantec, Kaspersky, McAfee, or others. The new “Managed Threat **Detection**” service, on the other hand, was developed especially for parallel use with third-party solutions. It is intended to appeal to a further target group to get a foot in the door with the Sophos brand.

But anyone who thinks they can keep their third-party protection with Managed Threat Detection and get the same benefits without the MTR client as customers with Managed Threat Response is unfortunately wrong.

## Limitations
The lack of Sophos's powerful MTR client understandably brings a few limitations. The following comparison table shows which features you are missing here:

<single-image url="/assets/img/blog/2022/sophos-central-mtr-mtd-comparison-en@2x.jpg" alt="Sophos Central MTR & MTD comparison chart"></single-image>

## Notification as the only action step
For [Managed Threat **Response**](https://www.avanet.com/en/shop/sophos-central-intercept-x-advanced-with-xdr-and-mtr/) Standard and Advanced, you can choose between three levels of response:

1. **Notification**: When the Sophos MTR team detects a threat event or attack, it will notify, but will not act on its own. You get a report on the cause and detection, with actionable steps to remediate the threat on your own.
2. **Collaboration**: The Sophos MTR team works with your own IT team, or with an external IT company if desired, to respond to the appropriate threats.
3. **Authorization**: The MTR team takes care of containment and neutralization actions completely independently and only informs about the measures taken.

With Managed Threat **Detection**, on the other hand, only the “**Notification**” response option is available. This means that although you receive an alert via the Central Dashboard or via email when a threat has been detected by the MTR team, you must neutralize and eliminate it on your own responsibility. If it is an active threat, where every second counts, the MTR team will at least briefly inform you by phone (but really only for active threats).

## Sophos Rapid Response as a last resort
In the event of an active threat, Managed Threat Detection leaves you on your own to stop an attack. Unfortunately, the MTR team cannot provide support here, as the computers and servers do not have the in-house Sophos MTR client installed. This is beyond question where the third-party protection software used should actually shine. If it does not, there is always the option of using the [Sophos Rapid Response Service](https://www.avanet.com/en/blog/sophos-rapid-response-immediate-help-for-active-threats/). This will provide you with lightning-fast assistance from a team of Sophos experts, who will disable the existing protection software on all computers and servers and install the MTR client.

<alertmessage icon="danger" >
 **Attention!** Sophos Rapid Response is not part of Managed Threat Detection and must be purchased additionally at a fixed price.
</alertmessage>

## Final words
Sophos has created a service, Managed Threat Detection, that makes the expertise of its MTR team available to customers who have not built their network security on Sophos solutions. And that makes perfect sense from a strategic perspective. Even if an IT administrator makes the decision today to roll out Sophos solutions to the corporate network in the future, it can't always be done in the short term. There may be ongoing contracts that get in the way or active licenses that have already burned up the budget for the next 3 years.

With Managed Threat Detection, Sophos has created a kind of “**add-on service**” for exactly such scenarios, which can be considered to strengthen the security concept in the short term. It makes the MTR team's threat detection resources available to a much larger audience, which is something Sophos can only gain from. The more data available for analysis, the better the algorithms can be tuned, and it doesn't matter whether that data is contributed by customers using an MTR or MTD Agent.

In principle, we would always advise all customers who want to protect their endpoints and servers with Sophos to use the MTR version. But we also understand that this solution is not designed for every budget. However, it is better to start from the most expensive product with the highest security and work your way down because security solutions are like insurance – you only regret having saved once the damage has been done. 😜

For everyone else who, for whatever reason, doesn't want to or can't yet throw the entire infrastructure overboard, **Sophos Central Managed Threat Detection** for endpoints and servers is certainly a strong addition. It's strongly recommended to have a team of experts monitors network activity.

In this blog post, I would like to introduce you to Managed Threat Detection (MTD), which has been available for purchase since the end of July 2021.

managed-threat-detection-24-7-monitoring-and-detection

Managed Threat Detection - 24/7 monitoring and detection

I don't know about you, but when it comes to products, that I use every day and are indispensable to me, I'm always up-to-date with the latest updates. This concerns mostly technical devices, but I'm still a geek. 😄

With all these devices, I follow a clear strategy when it's time to replace the product with its successor. I apply this strategy to the Sophos Firewall in this blog post to find out if it's worth switching to the new XGS hardware or not.

> Spoiler: In most cases, it actually doesn't. 🤐

## 4 Reasons to Think About Buying a New XGS Firewall
The new XGS hardware has now been on the market since April 2021. There are several factors when it is really worth buying XGS hardware. In the following section, we take a look at 4 signs that can justify a purchase decision:

### 1. Breakdown
When a device breaks down and the warranty has expired, it often has to happen quickly and there is no time for in-depth research. In this case, you should know in advance how to get the infrastructure up and running again and what the delivery times of a replacement device are, if any.
The firewall is the heart of the network. Very few can afford a longer interruption. However, companies with more than 20 employees typically have an HA solution, which can alleviate the situation somewhat in the event of an outage.

- [Which types of Sophos Firewall HA clusters are available?](https://www.avanet.com/en/kb/which-types-of-sophos-firewall-ha-clusters-are-available/)

#### **SG Firewall with UTM OS 🤕**
Unfortunately, we regularly see that it hits customers with SG hardware, which still use the UTM OS. In such a situation, the purchase of an XGS firewall is not recommended. The operation should work again as soon as possible, and there is no time for a migration to the SFOS. You should therefore reorder the same model of the SG firewall as quickly as possible, to restore the configuration from the backup copy in an uncomplicated manner.

<alertmessage icon="danger">
 We generally recommend all customers who still use an SG Firewall with the UTM operating system to consider migrating to the SFOS. The migration of the license is free of charge and the runtime will be taken over 1:1. The following instructions can help you with the migration: [Install Sophos XG Firewall OS on a SG Appliance](https://www.avanet.com/en/kb/install-sophos-xg-firewall-os-on-a-sg-appliance/)
</alertmessage>

If you need assistance migrating from UTM to SFOS, we'll be happy to help. The UTM hardcore fans among you who don't want to switch to SFOS under any circumstances can simply wait until the UTM OS goes end-of-life. This will certainly not be the case before the end of 2025. However, the following two blog posts may help you to change your mind:

- [Sophos UTM - End of Support for end of 2021](https://www.avanet.com/en/blog/sophos-utm-end-of-support-for-end-of-2021/)
- [7 reasons why the XG Firewall (SFOS) is better than the UTM](https://www.avanet.com/en/blog/7-reasons-why-the-xg-firewall-sfos-is-better-than-the-utm/)

### 2. No updates anymore
When a software has not received any updates for more than a year, my feelings change. If it's been over two years (often even before), I start searching for alternatives to replace it. For this reason alone, it would be inconceivable for me to still run a Sophos Firewall with the UTM operating system today. 😜

Anyone else who has SFOS installed on their SG Firewall or has an XG Firewall should check to see if their appliance can still have SFOS v18.5+ installed. In the following post, we have described which appliances will no longer receive the latest version: [Sophos Firewall Appliances – Supported hardware for SFOS v18+](https://www.avanet.com/en/blog/sophos-firewall-appliances-supported-hardware-for-sfos-v18-plus/)

<alertmessage icon="info">
 **Note**: Sophos initially wanted to cut off SG firewalls with SFOS and older generation XG firewalls from updates as well. However, at the beginning of 2021, Sophos deviated from this plan and all current SG and XG models will still receive the latest SFOS versions.
</alertmessage>

So unless you have an older revision of an SG or XG firewall that no longer receives updates, I can't really recommend buying the XGS firewall here either.

### 3. No more warranty
Another point that plays an important role in my personal purchasing strategy is the warranty of a product. After all, once it expires, I automatically check to see if there are any options for renewal, or if it's time to replace the product.

XG Firewalls have a 5-year warranty with the appropriate license. So, if you are one of the people who bought the first revision of an XG Firewall in 2016, your firewall is no longer covered by the manufacturer's warranty at the latest. In that case, I would make the following two considerations:

- **There is a single appliance being operated:** Here the risk would be too high for me and I would replace the hardware with a new XGS model.
- **There are two appliances in an HA cluster:** Again, I would look to make a switch. If the budget is not there, you can also wait until one of the two firewalls fails and then buy two new XGS models.

### 4. Not enough performance
The last item on my list that can contribute to the decision of a new purchase is the performance of a product. It happens that firmware updates make a device slower over time as new features are packed in. Or, quite simply, one's needs change so that the original performance no longer fits.

These points can also be applied to a Sophos firewall. Just check the load of your firewall because the number of devices in your network or the number of employees might have changed over the last few years, and the original performance does not match the current requirements anymore. In such a case, switching to XGS Firewall would certainly not be a bad idea, budget permitting. The license can often be transferred to the new appliance for free.

On the other hand, do you have a current SG or XG firewall that still gets the latest updates from SFOS (SFOS 18.5+), is still covered by the manufacturer's warranty and has no performance problems? Then buying an XGS firewall is not worth it. You should only keep an eye on the end-of-life date of the XG firewalls. This date was recently postponed by Sophos from 31.12.2024 to 31.03.2025.

- [End of Sale – Sophos XG Firewall Hardware](https://www.avanet.com/en/blog/end-of-sale-xg-firewall-hardware/)

---

## Summary
If I apply the 4 key points of my personal purchase strategy to the XGS firewall, there is probably no need for action for most existing customers. For new customers, of course, the case is clear and here we would always advise the XGS hardware! Finally, I have put together a flowchart for you for the purchase decision process. Just play through it yourself, and you will get our clear recommendation at the end.

<single-image url="/assets/img/blog/2022/new-sophos-xgs-firewall-decision-flow-en@2x.png" alt="Sophos XGS Firewall Decision Flow"></single-image>

For those who have an XG firewall and are currently undecided, I recommend the following knowledge base article that describes what the difference is between an XG and an XGS firewall:

- [What is the difference between an XG and XGS firewall?](https://www.avanet.com/en/kb/what-is-the-difference-between-an-xg-and-xgs-firewall/)

## Briefly summarized: The key benefits of the new XGS hardware.
The XGS series offers massively better performance by, among other things, processing traffic intelligently and efficiently and offloading certain tasks such as TLS inspection to the hardware. The new dual-processor architecture with a multi-core CPU and an Xstream flow processor enables better hardware acceleration. In upcoming SFOS releases, more processes here will be optimized for the new hardware.

Each unit has a 64-bit CPU and a separate Xtream processor, also known as a Network Processing Unit (NPU). The new series is equipped with additional network ports, allowing optional modules to be added and flexible options for network port selection. The XGS series now offers PoE (Power over Ethernet) ports and fail-to-wire (bypass), allowing traffic to continue even if the device loses power.

### Network Flow FastPath
Unlike the virtual FastPath, which is processed by the CPU in the XG series, the FastPath in the XGS series is processed by the Xstream flow processor. This is located between the CPU and the physical ports with the PCIe (PCI Express). Thus, the data traffic outsourced to the FastPath is handled by the Xstream Flow processor and the CPU is less burdened to deal with other tasks that cannot (yet) be outsourced.

<single-image url="/assets/img/blog/2022/sophos-xgs-firewall-network-flow-fastpath@2x.png" alt="Sophos XGS - Network Flow FastPath"></single-image>

### Fail-to-Wire
Fail-to-Wire is a fault tolerance feature that protects enterprise communications in the event of a power failure. In this case, the WAN and LAN are bypassed, transparently protecting network connectivity. This relay establishes a physical connection between the two ports in the bypass pair and forwards traffic whether power is present.

<alertmessage icon="info">
 **Note**: Fail-to-Wire is not enabled by default and must be configured via the extended shell with the xgs-ftw command.
</alertmessage>

<single-image url="/assets/img/blog/2022/sophos-xgs-firewall-fail-to-wire@2x.png" alt="Sophos XGS - Fail-to-Wire"></single-image>

## Promos
You have come to a decision and want to purchase a new XGS Firewall? Then don't forget to visit our [promo page](https://www.avanet.com/en/shop/promotions/) first. The discounter Sophos has a suitable promo for almost every scenario. 😅

This blog post is intended to help you decide whether it is worth replacing your existing Sophos Firewall with its successor.

is-it-worth-buying-the-new-xgs-hardware

Is it worth buying the new XGS hardware?

Sophos decided in October 2021 to stop charging for WLAN management in the Central console. Until now, you had to pay an annual license fee (per device) to manage a Sophos access point in Central. This made the solution not very interesting for many of our customers, as the management of access points via an XG or XGS firewall has always been free of charge.

<cta title="Use Sophos Central free of charge!" icon="wifi" button-text="Creat Account Now" button-url="https://secure2.sophos.com/de-en/lp/sophos-central/free-trial.aspx?id=0013000001EjyeY" theme="light">
Create a free Sophos Central account now and start managing your Sophos access points.
</cta>

When Sophos introduced the new XGS series in April 2021, it was announced that the new firewalls would only support APX series management. This suddenly made the paid management of AP series access points via Central Wireless the only option if one wanted to switch to the new XGS series. We suspect that this circumstance was a showstopper for some customers and prevented them from switching to the new XGS firewalls.

To chase this fat elephant out of the china store, Sophos probably felt compelled to stop charging for Central WLAN Management. Of course, this has made the solution more attractive, and it will probably become the most widely used option for Sophos customers to manage access points in a central console in the future.

In this blog post, we briefly summarize what you can expect from Central Wireless and what features are offered.

## Central WLAN management
With Sophos Central Wireless, you can easily configure your Sophos Access Points from your Central Account. Connect an access point to the Internet and register it by entering the serial number in your Sophos Central account. Then you can start configuring and create a secure wireless network. As soon as the access point is in operation, you will see the status of your WiFi and all connected clients.

<videoblock video-id="178242075" provider="vimeo">
</videoblock>

If you wish, you can also set up a separate guest network with a daily password for visitors or external staff.

## Simple configuration
After you register one or more Sophos Access Points in Sophos Central Wireless, you will need to configure a new network. But Sophos Central Wireless does it all with just a few clicks. You simply create a new SSID, name your network, choose a secure encryption method (WPA / WPA2 / WEP), define an encryption algorithm (AES TKIP/AES) and determine the desired frequency band (2.4 and / or 5 GHz). Of course, the setting of a secure password must not be missing at the end. This configuration then only needs to be assigned to one access point.

<single-image url="/assets/img/screenshots/sophos-central-wireless-ssids-settings@2x.jpg" alt="Sophos Central Wireless - SSID settings"></single-image>

If you don't want the WiFi to be available at all times, you can also set a time limit.

## Manage locations
Keeping track of multiple access points quickly becomes a challenge. With Sophos Central Wireless, you'll never reach your limits when it comes to keeping track of your network. Simply enter a location description for each access point. If there are several branch offices, you can even add the address to see the distribution on Google Maps.

<single-image url="/assets/img/screenshots/sophos-central-wireless-sites@2x.jpg" alt="Sophos Central Wireless - manage sites"></single-image>

Aren't you sure two access points on your floor are enough? Just upload a floor plan and simulate the distribution of your devices.

## Create guest networks
Sophos Central Wireless gives you the ability to create guest networks. This will create a secure area for visitors or devices that you don't want to have on your corporate network. Authentication can be done with daily, weekly or monthly passwords generated according to a fixed schedule. Once a new password has been created, you can notify your administrators or selected users by email.

<single-image url="/assets/img/screenshots/sophos-central-wireless-enable-guest-network@2x.jpg" alt="Sophos Central Wireless - Enable Guest Network"></single-image>

Another way to authenticate is to use the voucher codes. This generates different codes that can be used indefinitely or have a certain validity period.

## Increase the range of coverage
Sophos Access Points and Sophos Wireless allow you to connect APs without an Internet connection. With the so-called "mesh mode" the WiFi area can be enlarged in a very uncomplicated way. The SSID is passed on to each access point. The advantage of this is that the wireless network can also be expanded without cables. The access point gets the network from the nearest access point and passes it on to a smartphone, tablet, laptop or other device.

<single-image url="/assets/img/screenshots/sophos-central-wireless-mesh-network@2x.jpg" alt="Sophos Central Wireless - Mesh Network"></single-image>

---

## More information

### Data sheets
- [Sophos Wireless Datasheet](https://www.avanet.com/assets/pdf/sophos-wireless-en.pdf)
- [Sophos Wireless DeskAid](https://www.avanet.com/assets/pdf/sophos-wireless-deskaid-en.pdf)

### Videos
- [Getting Started with Sophos Wireless](https://vimeo.com/178242075)
- [Sophos Wireless - From Unboxed to Connected in Two Minutes](https://vimeo.com/288766707)
- [Sophos Wireless - How to Register an Access Point](https://vimeo.com/282003121)

### Blog
- [Sophos Wireless - Cloud-based centralized WLAN management](https://www.avanet.com/en/blog/sophos-wireless-cloud-based-centralized-wlan-management/)
- [Managing wireless networks - Three choices with Sophos](https://www.avanet.com/en/blog/managing-wireless-networks-three-choices-with-sophos/)

Sophos has decided not to charge for WLAN management in the Central Console in the future. This makes the solution much more attractive.

sophos-wireless-wlan-management-in-central-becomes-free-of-charge

Sophos Wireless - WLAN management in Central becomes free of charge

Still in December, it is possible to download the update for SFOS v19 EAP1. In this post, I will give you an overview of what new features are included in EAP1.

<alertmessage icon="danger" >
 **Attention!** Upcoming new features will probably tempt you to install SFOS v19 EAP1 on your firewall. Among the new features are some enhancements that we have been waiting for a long time, and the impatience to install this release can be high.
</alertmessage>

## EAP — Early Access Program
What does EAP actually mean, and should one install such a version on a productive firewall? In itself, there is nothing to be said against it because an EAP version is also supported by Sophos. The version is considered stable by the majority and has also been widely tested. Nevertheless, an EAP version is not as stable as an MR release, which is directly pointed out in the firewall. An EAP version, on the other hand, must be downloaded manually from the Sophos website for installation. I would therefore use EAPs rather cautiously and not install them immediately on every environment. The final SFOS v19 will be released around Q2 2022.

## Search

### Search window in the navigation
The navigation in the upcoming SFOS v19 will include a search bar to search for configuration areas. This is certainly a help for UTM newcomers. But this can also help existing SFOS admins, as Sophos has also modified the navigation at times in recent versions.

<single-image url="/assets/img/blog/2021/sophos-sfos-v19-navigation-search@2x.jpg" alt="New search bar in the navigation">

A search bar in the navigation makes it easier to find the desired settings.

</single-image>

The search is actually also supposed to “think” and make intelligent suggestions. For example, if you search for “multipath”, as it used to be called on the UTM, SD-WAN is suggested. 🙂

### Object search 🔥🔥🔥
The object search has been greatly improved. Finally! For me, personally, by far the hottest feature in v19. I claim that even now, although I do not yet know all the features that are yet to come.

Well, so far, when searching for an object, you had to know exactly how the name starts. For firewalls, which we have set up ourselves, we naturally stick to a scheme for this, e.g., “IP + hostname”. However, if we had to configure something on a firewall that we didn't set up, it was incredibly tedious. For this, we often had to leave the firewall rule, search for the object, remember the name, go back into the firewall rule and create everything from scratch. When multiple admins were working on the same system, it also happened that duplicate objects were created.

To better understand the difference, take a look at the following graphic. This is how it used to look in version 18.5 and earlier versions:

<single-image url="/assets/img/blog/2021/sophos-sfos-v18-search-object@2x.gif" alt="SFOS v18.5 Object search">

The object search in SFOS 18.5 and earlier versions.

</single-image>

With the new full-text object search in version 19, many things are now easier. I also noticed small UI improvements. More objects are displayed and the unnecessary links, which didn't work anyway, have been removed.

<single-image url="/assets/img/blog/2021/sophos-sfos-v19-search-object@2x.gif" alt="SFOS v19 Object search">

This is how the object search now looks in SFOS v19.

</single-image>

<single-image url="/assets/img/blog/2021/sophos-sfos-v19-search-network-object@2x.jpg" alt="SFOS v19 Search network object"></single-image>

It is also possible to search for a port directly, even if it is not in the name.

<single-image url="/assets/img/blog/2021/sophos-sfos-v19-search-service-object@2x.jpg" alt="SFOS v19 Search service object"></single-image>

---

## VPN
There is no longer a VPN item in the menu; instead, the settings have been divided into two categories:

- Remote access VPN
- Site-to-site VPN

### Better VPN logs in Logviewer
For troubleshooting SSL VPN, IPsec or RED, you can now find much more information in Logviewer without having to check the logs on the console.

### AES-GCM
A new addition is the “AES-GCM” encryption for SSL VPN and IPsec VPN. AES-GCM is an authenticated encryption mode that offers better performance than the previously used AES-CBC.

---

## SD-WAN SLA Profile
The SD-WAN functionality allows dealing with multiple WAN connections.
- Route networks, IPs, or users across different WAN links based on ports or applications.

With SFOS v19, not only the availability of the connection can be checked, but now also its quality. You can use one of the three predefined profiles or create your own.

<single-image url="/assets/img/blog/2021/sophos-sfos-v19-sd-wan-sla-profiles@2x.jpg" alt="SFOS v19 SD WAN SLA Profiles"></single-image>

This allows you to define rules such as: If the latency on line 1 is too high, then use another line for the traffic, e.g., VoIP (as long as it has a lower latency, of course).

<single-image url="/assets/img/blog/2021/sophos-sfos-v19-sd-wan-performance-graph@2x.jpg" alt="SFOS v19 SD WAN Performance Graph"></single-image>

In the diagnosis, the collected line values are also displayed as a chart.

Already in December you can download and try out the SFOS v19 EAP1. You can expect features that people have been waiting for a long time.

sophos-sfos-v19-eap1-alle-neuerungen-im-uberblick

Sophos SFOS v19 EAP1 - Overview of all new features

In this blog post, you can read all about the changes that await you in the latest firewall update SFOS 18.5 MR2.

<alertmessage icon="info" >
 ## Important: SFOS 17.5 EoL
 Before we come to the latest SFOS release 18.5 MR2, short information for all who still use the SFOS version 17.5. This version is end-of-life since November 30, 2021. With the exception of the XG 85(w) and XG 105(w) appliances, as this hardware does not support v18 and is EoL in August 2022 anyway. For all others keep updating, otherwise there will be no support or security updates.
</alertmessage>

## VPN AES-GCM and AES-GMAC
For site-to-site VPN connections, there is a new encryption mode in phase 2.

<single-image url="/assets/img/blog/2021/sophos-sfos-v18-5-mr2-aes-gcm-aes-gmac@2x.jpg" alt="SFOS 18.5.2 AES-GCM / AES-GMAC">

New AES-GCM and AES-GMAC options in Phase 2 encryption.

</single-image>

These new options provide more performance and will be available for remote clients in a later SFOS release.

## MFA for admin user
Until now, it was not possible to enable multi-factor authentication (MFA) for the admin account. However, this system user is very vulnerable, since it exists by default on every firewall. With other manufacturers and systems, such as Windows or Synology, it is becoming more and more uncommon to create a user with the username "Admin" or "Administrator".
With SFOS 18.5 MR2 it is now at least possible to enable MFA for web admin access. 👍

<single-image url="/assets/img/blog/2021/sophos-sfos-v18-5-mr2-mfa-admin-setting@2x.jpg" alt="SFOS 18.5.2 MFA settings">

Enable MFA for web admin access.

</single-image>

For SSH access, you still only need the password. Therefore, it is still important that access is restricted as much as possible.

<single-image url="/assets/img/blog/2021/sophos-sfos-v18-5-mr2-mfa-notification@2x.jpg" alt="SFOS 18.5.2 MFA notification">

Prominent notice when accounts without MFA are present.

</single-image>

It is also pointed out that there are users for whom the MFA has not yet been activated.

## Central registration with OTP token
The firewall and Central now belong together like burgers 🍔 with fries 🍟. However, if you don't have a Central account yet or have to create a new user, this is over 15 steps and takes a few minutes.

<single-image url="/assets/img/blog/2021/sophos-sfos-v18-5-mr2-central-otp-token.gif" alt="SFOS 18.5.2 Central OTP Token">

Generate token for firewall registration in Central.

</single-image>

Now, with a few clicks on Central, a token can be created, which can be used to register the firewall in Central.

## Sophos Assistant
Sophos Firewalls are getting an interactive assistant to help with configurations.
At this time, the assistant provides help on the following three topics.

- DNAT and firewall rules for the internal web server
- Site-to-site IPsec VPN
- Remote Access SSL VPN

The three available topics were suggested by Sophos Support, as they seem to receive a lot of requests about them. More instructions will follow in the future and Sophos is open to feedback. So if you have any ideas, please feel free to send them to us via the contact form and we will forward them to Sophos.

<single-image url="/assets/img/blog/2021/sophos-sfos-v18-5-mr2-sophos-assistent.gif" alt="SFOS 18.5.2 Sophos Assistant"></single-image>

## Other improvements
- When reinstalling an appliance with the ISO image, a message appears on the firewall LED display after the installation process is complete.
- Certifications - FIPS 140-2 Level 1
- Display of all groups a user is in
- Cloudflare is now supported as DynDNS provider
- Switch to disable IPS globally (e.g. for troubleshooting)

<single-image url="/assets/img/blog/2021/sophos-sfos-v18-5-mr2-global-ips-toggle@2x.jpg" alt="SFOS 18.5.2 global IPS toggle">

Disable IPS Protection globally

</single-image>

With the Sophos Firewall release 18.5 MR2, there were numerous innovations, such as a new encryption mode or MFA for the admin user.

sophos-sfos-update-new-features-in-v18-5-02

Sophos SFOS update - New features in v18.5.2

There are currently two really exciting topics at Sophos. Zero Trust Network Access and the switches. This post is about the latter and we have almost all the information together by now.

## Hardware: 10 models
I'll start with what we already know about the hardware of Sophos switches. So that you are not completely overwhelmed by the name or have to search for the differences in the product table, I will first explain the name model and thus also the rough differences of the hardware. Because the name of the switch models from Sophos already reveal a lot about the technical data of the hardware. The following picture shows the CS110-48FP switch as an example:

<single-image url="/assets/img/blog/2021/sophos-switch-naming@2x.jpg" alt="Das Namensmodell und die Unterschiede der Hardware">
As an example, the name model explained for the CS110-48FP Swich.
</single-image>

There will be the following 10 switch models from Sophos:

### 100 Series - 1 Gbps
- **8 Port Models**: [CS101-8](https://www.avanet.com/en/shop/sophos-switch-cs101-8/), [CS101-8FP](https://www.avanet.com/en/shop/sophos-switch-cs101-8fp/)
- **24 Port Models**: [CS110-24](https://www.avanet.com/en/shop/sophos-switch-cs110-24/), [CS110-24FP](https://www.avanet.com/en/shop/sophos-switch-cs110-24fp/)
- **48 Port Models**: [CS110-48](https://www.avanet.com/en/shop/sophos-switch-cs110-48/), [CS110-48P](https://www.avanet.com/en/shop/sophos-switch-cs110-48p/), [CS110-48FP](https://www.avanet.com/en/shop/sophos-switch-cs110-48fp/)

### 200 Series - 2.5 Gbps
- **8 Port Models**: [CS210-8FP](https://www.avanet.com/en/shop/sophos-switch-cs210-8fp/)
- **24 Port Models**: [CS210-24FP](https://www.avanet.com/en/shop/sophos-switch-cs210-24fp/) – *verfügbar Mitte 2022*
- **48 Port Models**: [CS210-48FP](https://www.avanet.com/en/shop/sophos-switch-cs210-48fp/) – *verfügbar Mitte 2022*

All technical data can be found in the [Sophos Switch Datasheet](https://www.avanet.com/assets/pdf/sophos-switch-en.pdf) or on the product pages of the switches.

## Thank you Sophos, for the test device 🙏
We received a Sophos Switch CS110-48P as a test device from Sophos back in October. Many thanks to Sophos for giving us the opportunity to try and test this great device ourselves. Here are a few photos of the CS110-48P switch:

<image-gallery-slider>
 <source src="/assets/img/blog/2021/sophos-switch-cd110-48p-front@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-cd110-48p-front@2x.jpg" caption="Sophos Switch cs110-48p front panel"/>
 <source src="/assets/img/blog/2021/sophos-switch-cd110-48p-left@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-cd110-48p-left@2x.jpg" caption="Sophos Switch cs110-48p left panel"/>
 <source src="/assets/img/blog/2021/sophos-switch-cd110-48p-right@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-cd110-48p-right@2x.jpg" caption="Sophos Switch cs110-48p right panel"/>
</image-gallery-slider>

## Hardware only or with license
Sophos switches can be purchased with or without a license. If you choose the hardware only (without license), the following services are included:

- **Local Web Management** - The Sophos Switch can be managed directly via the browser without any restrictions.
- **Command Line Interface** (CLI) - The Sophos Switch can also be managed via the console, also without any restrictions.
- **Limited lifetime warranty** - The Sophos Switch is covered by warranty until the end-of-life date. When Sophos talks about lifetime here, it is about how long Sophos will support this product. At the current time, you can assume a minimum of 5 years.

### Added value of the subscription
At the moment, the added value of the subscription consists of the following points:

- **Sophos Central Management** - The Sophos switch can be managed via Sophos Central.
- **Advanced RMA Support** - Fast turnaround in the event of a hardware defect.
- **7 × 24 telephone support**
- **Firmware Updates**

When the subscription is no longer renewed, there is of course no more phone support, the warranty service is standard again, the Central Management is in **read-only** mode and the firmware updates have to be installed locally again.

### Subscription price
Sophos sets the price for service and support here at 10% of the hardware price, and at 8% for a 3-year license.

> We must admit that the features of the Sevice are very weak at this point in time. It is a bit like when you buy a Tesla and decide to buy Autopilot. First and foremost, you buy the potential that will follow. With the Switch, this would be features such as Synchronized Security or XDR/MTR functions.

## Local GUI
I have now explained the models and what options are available for purchase. Let's move on to the management of the switch.
We have had the device in productive use for a few weeks now. As expected, the hardware makes a good impression, but it is the software that can make the hardware exceptional. In this early version, it makes an excellent and stable impression.
The GUI comes in nine languages: English, Spanish, Italian, German, French, Portuguese, Chinese, Japanese, Korean.

There is also a dark mode and the interface is more responsive than you are used to from other Sophos products.
In some places the loading time is still a bit slow, but this has been improved a lot since the last firmware and should be completely fixed until the final version.

Here are a few impressions of the web interface:

<image-gallery-grid>
 <source src="/assets/img/blog/2021/sophos-switch-login-page@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-login-page@2x.jpg"/>
 <source src="/assets/img/blog/2021/sophos-switch-local-dashboard@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-local-dashboard@2x.jpg"/>
 <source src="/assets/img/blog/2021/sophos-switch-local-dashboard-dark@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-local-dashboard-dark@2x.jpg"/>
 <source src="/assets/img/blog/2021/sophos-switch-local-system-settings@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-local-system-settings@2x.jpg"/>
 <source src="/assets/img/blog/2021/sophos-switch-local-analyze@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-local-analyze@2x.jpg"/>
 <source src="/assets/img/blog/2021/sophos-switch-local-people@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-local-people@2x.jpg"/>
 <source src="/assets/img/blog/2021/sophos-switch-local-security-settings@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-local-security-settings@2x.jpg"/>
</image-gallery-grid>

## Switch management via Sophos Central
Sophos offers several ways to manage the new switches. You can configure them locally via the web interface or CLI (command line) and if required also via SNMP. The easiest and most comfortable method is certainly the Sophos Central connection. This means that in the future you will have your firewalls, access points and switches, together with all other Central solutions, integrated on one console.

Here are some first impressions of what is currently possible with Central:

<image-gallery-grid>
 <source src="/assets/img/blog/2021/sophos-switch-central-dashboard-menu-switch@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-central-dashboard-menu-switch@2x.jpg"/>
 <source src="/assets/img/blog/2021/sophos-switch-central-overview@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-central-overview@2x.jpg"/>
 <source src="/assets/img/blog/2021/sophos-switch-central-management-system-details@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-central-management-system-details@2x.jpg"/>
 <source src="/assets/img/blog/2021/sophos-switch-central-management-vlans@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-central-management-vlans@2x.jpg"/>
 <source src="/assets/img/blog/2021/sophos-switch-central-management-port-settings@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-central-management-port-settings@2x.jpg"/>
 <source src="/assets/img/blog/2021/sophos-switch-central-management-task-queue@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-central-management-task-queue@2x.jpg"/>
 <source src="/assets/img/blog/2021/sophos-switch-central-management-diagnostics@2x.jpg" thumb-url="/assets/img/blog/2021/sophos-switch-central-management-diagnostics@2x.jpg"/>
</image-gallery-grid>

## Availabilities
We know that some are already waiting for the Sophos switches. Sophos is expected to be able to deliver the first models in mid-December 2021, but the number of units is still massively limited here. Things look a bit better starting in February / March.

## Conclusion
We have been dreaming of a Sophos switch for a few years now. The product makes perfect sense in the line-up and completes the network portfolio. However, Sophos' last acquisitions were always software companies.
Other manufacturers have had a central dashboard for switches and access points for some time, but the firewall or endpoint was missing. With the switches, Sophos brings an important product into their ecosystem.

The rumors that Sophos is working on a switch series have been around for a while. All the more pleasing that it has now worked out with a market launch, even if only very small numbers will be available at the beginning. But launching a new product during a global chip crisis is also very brave and not an easy task.

### Central Switch
The product name starts with CS, which stands for Central Switch. If you only buy the switch, without the service and support subscription, the Central part is omitted, but this is what makes the switch so interesting. Without the management with Central, the question arises why one should buy a Sophos switch and not a product from another manufacturer. Managing the switches via Central, alongside the firewalls, access points and the rest of the Central modules in one console, is therefore a really big selling point for anyone who is already in this ecosystem or would like to build on it in the future.

Still, it has to be said, of course, that the software won't be ready when the switches hit the market either. Exciting killer features, such as Synchronized Security or XDR/MTR connectors will probably only be available later. However, a switch is not a 3-4 year purchase, but rather a longer term purchase. If Sophos delivers these functions within a reasonable period of time, one can of course overlook this.
Freely according to the motto "connecting points", an incredible number of things are possible here through this central device in the network and the upcoming functions are only the beginning. 😎

### Sophos Switches as the new standard
We already have some customers expressing strong interest in the new Sophos switches and as soon as they are available, we will be able to gain even more experience in other environments. From what we have seen and tested so far, we can already say that Sophos switches will be our first choice for the right projects in the future. Until now, we have been using switches from Ubiquiti, and there was really nothing wrong with them. But we still really like the Sophos ecosystem, and the new switches make it even more powerful.

Sophos is adding a new category to its product range. Sophos now offers 10 different switches that can be managed via Central.

sophos-switch-what-you-need-to-know-about-the-new-product

Sophos Switch - What you need to know about the new product

When the [new licensing model for SFOS](https://www.avanet.com/en/blog/sophos-firewall-xgs-hardware-launches-new-license-bundles/) was introduced, we heard about Central Orchestration for the first time. At that time (April 21) it was not yet ready, but is now available with SFOS 18.5 MR1. A licence for Central Orchestration is already included in the Xstream Protection Bundle. The licence can also be purchased separately.

In general, however, it can be said that Central Orchestration is not very useful with only one firewall. In the next section I will explain why.elurchase of the licence is rather unnecessary.

## SD-WAN
One of two new features in Central Orchestration is SD-WAN. Setting up a site-to-site VPN connection is not difficult and can be done in under 10 minutes in most cases. Where it gets exhausting is when you need to connect four or more firewalls together. Central Orchestration creates the necessary connections and firewall rules in a few seconds with just a few clicks.

<videoblock video-id="573112784" provider="vimeo"></videoblock>

## Requirements on all firewalls
The following requirements must be met on all firewalls if you want to use the SD-WAN feature:
- SFOS v18.5 MR1 or higher.
- Central Management activated
- Central Orchestration licence

## Central Firewall Reporting Advanced
The new Central Orchestration licence also includes all the features of the Central Firewall Reporting Advanced licence. The only difference is that the data is stored on Sophos Central for only 30 days instead of 365 days. If you do need 365 days, you will need to order the [Central Firewall Reporting Advanced](https://www.avanet.com/en/shop/sophos-central-firewall-reporting/) license separately.

By storing the firewall logs on Central, you can generate online reports on one or more firewalls simultaneously.
With the XDR/MTR connector, data from the firewall is then also stored in the data lake and can be queried with a valid XDR licence in the Threat Analysis Center with Live Discover. For customers with an active Managed Threat Response Advanced licence, this data is also available to the MTR team, which further increases visibility in the network.

## What Sophos Central Firewall features are coming next?
Two additional features will be added to Central Orchestration in the coming months:

- Support for multiple WAN connections: So you have a redundant VPN connection across two WAN connections.
- Extended support for NAT'd firewalls: If the firewall is behind another NAT device, the SD-WAN setup does not currently work. However, this should be possible soon.

But also the Central Firewall Manager gets further renewals:

- Pinning of firewall rules
- Improvements in backups and alerts
- Management APIs
- Support for AWS regions
- Usability improvements

Sophos Central Orchestration is a new licence that is already included in the Xstream Protection. However, it can also be purchased separately.

sophos-central-orchestration-what-features-does-the-new-license-offer

Central Orchestration - What features does the new license offer?

The SFOS 18.5 MR1 is here and in order to install the new update you need to have one of the following versions already installed on your firewall:

- SFOS v18.5 GA
- SFOS v18 MR3 or newer
- SFOS v17.5 MR14 or newer

<alertmessage icon="danger" >
 If your firewall does not have any of the above versions installed before the update, the configuration migration will not work.
</alertmessage>

## New features
After installing the new firmware, three important new features await you.

### 1. Central Orchestration
With SFOS 18.5.1, the previously announced Sophos Firewall module **Central Orchestration** is finally released. If you manage multiple firewalls (three or more) and want to connect them with VPN, Central Orchestration can save you a lot of work. Whether it's a full mesh network, a hub-and-spoke topology, or something else, Sophos Central automatically takes care of setting up tunnels and firewalls.

Central Orchestration is already included in the **Xstream Protection** and **Avanet Epic Protection** bundles, but can also be purchased as a standalone license. Customers who have already licensed Xstream or Epic Protection will be able to take advantage of the new features after the update.

### 2. Central Firewall Reporting Advanced
If you integrate your firewall into Central, logs and reports from one or more firewalls can be stored and analyzed for up to **7 days** free of charge. If you want to extend this period up to **365 days**, you need a [**Central Firewall Reporting Advanced**](https://www.avanet.com/en/shop/sophos-central-firewall-reporting/) license.

With Central Orchestration there is now another possibility to extend the period for log storage. If you have one of the following licenses, you will get **30 days** instead of the free 7 days:

- Central Orchestration single license
- Sophos Xtream Protection
- Avanet Epic Protection

### 3. MTR/XDR Connector
The **MTR/XDR Connector** included in SFOS 18.5.1 now opens the door to firewall data analysis on Sophos Central for the first time. On the one hand, the Sophos MTR team can benefit from this, but also all security admins who have a Central XDR license. This is automatically included in the following products:

- [Sophos Central Intercept X Advanced with XDR](https://www.avanet.com/en/shop/sophos-central-intercept-x-advanced-with-xdr/)
- [Sophos Central Intercept X Advanced with XDR and MTR Standard](https://www.avanet.com/en/shop/sophos-central-intercept-x-advanced-with-xdr-and-mtr/)

With the MTR/XDR connector, the Central XDR product becomes even more powerful, as the firewall adds another source from which data can be obtained and queried.

## Navigation changes
Visually, a few changes have sneaked into the navigation.

- **Zero-Day Protection** - Formerly Sandstorm (Sandboxing). Here the analyzed files and their reports are listed and under a second tab the settings of the function.
- **Sophos Central** - Under this menu item the firewall can be connected to Central. Security Heartbeat, Synchronized Application Control and Firewall Management, Reporting and more.
- **Advanced threat** has been renamed to **Advanced Protection**.

<single-image url="/assets/img/blog/2021//sfos-navigation-v18-0-vs-v18-5@2x.jpg" alt="Comparison of navigation SFOS v18.0 and v18.5"></single-image>

## Further information
If you want to update to the new version or migrate from an XG to an XGS, please have a look at the following websites. They will help you prepare for the update and clarify important requirements.

- [Backup-restore compatibility check](https://support.sophos.com/support/s/article/KB-000036245?language=en_US){:target="_blank" rel="nofollow"}
- [Release Notes SFOS v18.5 MR1 Build 326](https://docs.sophos.com/releasenotes/index.html?productGroupID=nsg&productID=xg&versionID=18.5){:target="_blank" rel="nofollow"}
- [Other small improvements in v18.5 MR1](https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-firewall-v18-5-mr1-is-now-available){:target="_blank" rel="nofollow"}

With Sophos Firewall Release 18.5.1, Sophos unlocks the new features of Central Orchestration for the first time.

sophos-sfos-update-new-features-in-v18-05-01

Sophos SFOS update - New features in v18.5.1

Many admins are not logged into the firewall all the time, but only when there is something to configure, to check or to update. Depending on how far back the last login to the backend was, various warning messages appear in the dashboard. By the way, these also remain even if you have read them. For a future update to SFOS, it would certainly be helpful if you could hide them yourself. 🤔

Well, I'm drifting a bit right now. 😅 Among these alerts, I recently noticed the news that Sophos will discontinue the Dynamic DNS service (myfirewall.co) at the end of January 2022.

<single-image url="/assets/img/blog/2021/sophos-firewall-dashboard-alert-ddns-discontinuing@2x.jpg" alt="Sophos DDNS server is discontinued"></single-image>

We know that some people have liked to use Sophos's Dynamic DNS service when they didn't have a fixed IP. Meanwhile, Sophos does not give any reasons for stopping this service, but refers to third-party providers.

<single-image url="/assets/img/blog/2021/sophos-firewall-ddns-myfirewall-co-discontinued@2x.jpg" alt="Sophos DDNS server is discontinued and reference to alternative third-party providers."></single-image>

## 9 Provider for DDNS as alternative
We ourselves also used the service, since our providers do not offer a fixed IP at all locations, or at least only for the much more expensive business connections.

On the firewall you now have the option to choose the following providers:

- DynDNS
- DynAccess
- EasyDNS
- ZoneEdit
- Google DDNS
- Namecheap
- DNS-O-Matic
- No-IP
- FreeDNS

> We personally trust the provider No-IP.

<alertmessage icon="danger" >
 If you have also used the DNS name in the SSL VPN configuration, you should not forget to change it as well and roll out the new config on the clients.
</alertmessage>

Sophos's DynDNS service will be discontinued at the end of January 2022 and you should switch to another DDNS service.

sophos-dyndns-service-myfirewallco-is-discontinued

Sophos DynDNS service myfirewall.co is discontinued

Sophos has launched [**Intercept X Essentials**](https://www.avanet.com/en/shop/sophos-central-intercept-x-essentials/) (CIXE) and [**Intercept X Essentials for Server**](https://www.avanet.com/en/shop/sophos-central-intercept-x-essentials-for-server/) (SVRCIXE), two new Central licenses intended as entry-level products for protecting clients and servers. However, the introduction of these two new licenses also means the end of **Central Endpoint Protection** (CEP) and **Central Server Protection** (SVRC), which were previously intended as a low-cost entry point.

Before I tell you more about **Intercept X Essentials**, I'll first do a little education for those customers who still have active **Central Endpoint Protection** or **Server Protection** licenses.

## Central Endpoint and Server Protection go end-of-sale
It's no longer a secret that **Central Endpoint Protection** or **Server Protection** are no longer sufficient to protect against today's threats. “Ransomware” is still one of the biggest security threats in 2021, and signature-based solutions are simply powerless against it. To stand up to modern threats like ransomware, you need features like **deep learning, anti-ransomware and anti-exploit** at a minimum.

Sophos has consistently emphasized in its presentations that they would recommend at least **Intercept X Advanced** as basic protection to everyone. However, despite these statements, Endpoint, and Server Protection licenses continued to be offered. This is now over and Sophos is removing the two obsolete products from its lineup with immediate effect.

### What existing CEP and SVRC customers need to know
Existing customers who currently have active Central Endpoint or Server Protection licenses will be migrated by Sophos to **Intercept X Advanced** and **Intercept X Advanced for Server** free of charge during **September/October**. If your licenses expire before this migration, it is still possible to order a renewal. Only the new purchase of the two products is no longer allowed.

> For the remaining term of the license, existing customers retain all the functions of CEP or SVRC and even receive modern technologies from Intercept X Advanced as a gift.

At the end of the term, it is up to you whether you want to continue to renew Intercept X Advanced / Intercept X Advanced for Server or perhaps even upgrade to EDR or MTR. Alternatively, you may choose to downgrade to **Intercept X Essentials** / **Intercept X Essentials for Server**. What such a downgrade would mean exactly and which features you would then have to do without, you will learn in the next section.

## Intercept X Essentials / Intercept X Essentials for Server
By stopping the sale of Endpoint and Server Protection, Sophos has, in our view, plugged a major security gap in their product portfolio. We see it all the time that when customers are deciding between two products, they prioritize cost over the actual protection a product can provide. For this reason, customers have been happy to choose Endpoint or Server Protection because it was simply more affordable price-wise compared to Intercept X Advanced. However, in the next ransomware attack, these two solutions were not going to be able to do anything because they lack important features such as **deep learning, anti-ransomware and anti-exploit**.

> With Intercept X Essentials, Sophos has recognized that while it still needs an affordable entry-level product, the smaller price tag should by no means come at the expense of a lack of security features.

### Advanced protection against threats
When it comes to **threat protection**, **Intercept X Essentials** and **Intercept X Essentials for Servers** give you the same tools as Intercept X Advanced. The only difference is that if you want to protect your servers with Intercept X Essentials, the Advanced version offers additional features. In the following table, you can get an overview of the included protection features:

<single-image url="/blog/2021/intercept-x-essentials-vs-intercept-x-advanced@2x.jpg" alt="Comparison of features between Intercept X Essentials and Intercept X Advanced"></single-image>

> The protection features listed above were not part of the Endpoint and Server Protection, but these are exactly what is needed to survive against today's threats.

### Deleted features
In my eyes, Sophos has focused on the right features with Intercept X Essentials to create an entry-level product for protecting clients and servers. Those who have used the previous base product “Endpoint Protection” or “Server Protection” will notice when looking at the table above that some features were removed. The following features are now only available with Intercept X Advanced or higher:

<single-image url="/blog/2021/intercept-x-essentials-vs-intercept-x-advanced-2@2x.jpg" alt="Features missing in Intercept X Essentials"></single-image>

- **Multiple Policies**: With Intercept X Essentials you can only use the base policy. It is not possible to duplicate policies.
- **Controlled Updates**: With Intercept X Essentials it is not possible to delay an update of the agent.
- **Web Control**: With Intercept X Essentials, access to unwanted websites cannot be denied.
- **Peripheral Control**: With Intercept X Essentials it is not possible to restrict which devices can be connected.
- **Application Control**: With Intercept X Essentials it is not possible to control what types of applications are installed and run.
- **Data Loss Prevention**: With Intercept X Essentials you cannot restrict what sensitive data leaves the company.
- **Thread Case**: With Intercept X Essentials, access to threat cases is not possible.

The fact that the features listed above are missing from **Intercept X Essentials** is also the reason that Sophos upgrade existing customers to **Intercept X Advanced**. Apart from the additional security features, switching to Intercept X Essentials would have been more of a downgrade for existing customers.

## Conclusion
As pointed out several times in this article, I agree 100% with Sophos's strategy. It was really time to stop selling licenses for Endpoint and Server Protection, as the protection against modern threats was no longer sufficient. For purely signature-based detection, one might as well have installed the free Microsoft Defender or similar products.

With the new basic products **Intercept X Essentials** and **Intercept X Essentials for Servers**, Sophos will, in my view, address an estimated 90% of the customers who previously used endpoint or server protection. Whether, I'm going too far out on a limb with this claim, will certainly be seen in the coming months. However, I think that protection against malware and the detection of attacks belong more to the basic version of an endpoint or server security software, than, for example, peripheral or application control. Those who need such features will get them when switching to **Intercept X Advanced** or higher.

However, the only flaw I see with Intercept X Essentials is the price. In my opinion, Sophos has missed an opportunity here to really provide a low-cost entry point. I see the price difference to Intercept X Advanced as too small, which at the same time makes the additional features like “Web Control”, “Application Control”, “Peripheral Control” etc. seem somewhat worthless. At the same time, there is a risk that many Intercept X Advanced customers will downgrade to Intercept X Essentials at the next renewal. I can imagine that there are some customers who have not used any of the additional features so far. 🤔

The end of Central Endpoint and Server Protection was declared, and at the same time Intercept X Essentials was introduced as the new base protection.

intercept-x-essentials-the-new-base-protection-for-clients-and-server

Intercept X Essentials - The new base protection for Clients & Server

Sales of the XG 85(w) and XG 105(w) have already been discontinued on August 17, 2019. Anyone who wants to purchase a license for these devices once again will have to hurry. The hardware will go end-of-life in August 2022.

## Last renewal for XG 85(w) and XG 105(w)
We have already mentioned the [end-of-sale of the XG 85(w) and XG 105(w) firewall hardware](/en/blog/sophos-xg-85-and-xg-105-end-of-sale/). The time for the last renewal is getting closer and closer and with this article, we would like to remind all owners of an **XG 85(w)** or **XG 105(w)** once again that until **August 17, 2021** is the last opportunity to renew the license for at least one year. Any requests after this date cannot be processed..

Those who still rely on these models today and want to extend the renewal period until August 17, 2021 will certainly have their reasons. But it is a fact that the two devices can already no longer be operated with the latest SFOS version. After v17.5x, the XG 85(w) and 105(w) are no longer supported.

For this reason, you should think about switching to the latest hardware. Sophos lists the XG series as a successor product on its website.

<single-image url="/blog/2021/sophos-hardware-migration-path-xg85-xg105@2x.jpg" alt="Sophos Hardware Migration path XG 85(w), XG 105(w)"></single-image>

However, we would strongly advise against buying an XG Firewall now. The XG series [namely goes end-of-sale on September 30, 2021](https://www.avanet.com/en/blog/end-of-sale-xg-firewall-hardware/) and end-of-life at the end of 2024. In addition, the [XGS Series with more power](https://www.avanet.com/en/blog/sophos-xgs-series-new-firewalls-with-more-power/) was introduced on April 22, 2022. For these aforementioned reasons, we would suggest the following migration path:

- [**XG 85**](/en/shop/sophos-xg-85-security-appliance/) → [**XGS 87**](/en/shop/sophos-xgs-87-security-appliance/)
- [**XG 85w**](/en/shop/sophos-xg-85w-security-appliance/) → [**XGS 87w**](/en/shop/sophos-xgs-87w-security-appliance/)
- [**XG 105**](/en/shop/sophos-xg-105-security-appliance/) → [**XGS 107**](/en/shop/sophos-xgs-107-security-appliance/)
- [**XG 105w**](/en/shop/sophos-xg-105w-security-appliance/) → [**XGS 107w**](/en/shop/sophos-xgs-107w-security-appliance/)


## It's better to avoid the smallest desktop model
Basically, we always advise against buying the smallest firewall model. The performance is simply too limited, even if the throughput numbers in the data sheet don't look bad. It may be that these values could even be achieved, but even if they are, you have to do without the following features with the XGS 87 or 87w:

- **Reporting**: Storage of logs on the appliance (only possible via Central).
- **Web Protection**: Filescan with two scan engines
- **Webserver Protection**: Antivirus Scans
- **Email Protection**: Message Transfer Agent (MTA)

The features listed above cannot be used with the smallest desktop model. There are no restrictions with all other firewall models.

The last opportunity to renew an XG 85(w) or XG 105(w) license for one year is August 17, 2021.

last-chance-for-1-year-renewal-xg-85w-and-xg-105w

Last chance for 1-year renewal - XG 85(w) and XG 105(w)

Currently, there are the **XGS** and **XG Firewalls** running the SFOS. For those who prefer the UTM operating system, the **SG series** is still available. However, the sale of the XG Firewalls will be discontinued shortly, making it a bit clearer again when choosing a new firewall.

## The history of the XG hardware

In November 2015, Sophos released the first version of the XG Firewall and with it the Sophos Firewall OS (SFOS). However, the new OS had a difficult time and was barely usable at the beginning. The hardware was 1:1 the same as the SG hardware. The only difference was the pre-installed operating system. We described the beginnings of the UTM operating system up to the SFOS in the article [Sophos UTM: End of Support at the end of 2021](/en/blog/sophos-utm-end-of-support-for-end-of-2021/).

In September 2017, the [revision 2 of the rack models](/en/blog/sophos-firewall-rev-2-sg-xg-hardware-with-more-power/) followed, for both the XG and SG series. New desktop models were not long in coming, and so the new [3rd generation XG/SG models](/en/blog/sophos-firewall-rev-3-sg-xg-85-135-completely-revised/) appeared in April 2018. For the first time, there were at least optical differences between the SG and the XG series.

Since the XG 85(w) and XG 105(w) did not offer enough performance to support the SFOS in version 18, Sophos released the [XG 86 and 106](/en/blog/new-firewall-hardware-sophos-xg-86w-and-xg-106w/) with more RAM as successors in April 2019.

With the launch of the new [**XGS Firewall Series**](/en/blog/sophos-xgs-series-new-firewalls-with-more-power/) in April 2021, the days of the XG Firewall are now coming to an end.

> For all UTM users, the SG models from 2017 (rack models) and 2018 (desktop models) are still current and as far as we know there are no new devices planned.

## XG series goes end-of-sale

The XG Firewalls will be sold until **September 30, 2021**. Thereafter, only remaining stock will be available. This step does not come as a surprise because the new XGS hardware has already been available for purchase for over 3 months..

Only with the accessories, Sophos still gives a little more time. Those who may need a new power supply, rackmount kits, Wi-Fi, 3G/4G or FleXi port modules for their XG Firewall at a later date can order these from us until the end of 2022.

> ❗ **Attention**: The accessories for the XG are not compatible with the XGS hardware anymore.

## End-of-life of the XG will already be at the end of 2024 🪦

For customers who have an XG Firewall in use, the end-of-life date is critical. On this date, Sophos will stop supporting the product and RMAs will no longer be processed. Sophos sets the end-of-life date for the XG series at **12/31/2024**. This results in a last possible renewal date of 12/31/2023.

The end-of-life date is particularly hard on customers who have recently purchased an XG Firewall. Especially the 100% promo from Sophos, which is still offered, has increased the number of new customers. Nevertheless, one should not panic right away. A lot of time will pass until the end of 2024, and I would not be surprised if Sophos is ready with an attractive XG to XGS promo at the appropriate time. 😎

## End-of-life also for software versions

Recently, Sophos announced that from the end of July 2021 [old software versions will no longer be supported](/en/blog/sophos-firewall-os-important-lifecycle-policy-changes/). When a new version is released, the predecessor automatically goes end-of-life.

This decision has a direct impact on the revision of an XG Firewall. Already today, SFOS v18 can no longer be installed on an XG 85(w) or XG 105(w). For all other XG models with revision 1 or 2, v18.5+ is the latest.

For this, we have already written a blog post some time ago, which pre-announces which hardware will soon be cut from new features: [Sophos Firewall Appliances: Supported hardware for SFOS v18+](/en/blog/sophos-firewall-appliances-supported-hardware-for-sfos-v18-plus/)

## Security Made Simple 😜

Until around 2019, Sophos's slogan was always **Security made simple**.

<single-image url="/blog/2021/sophos-notebook-security-made-simple@2x.jpg" alt="Sophos notebook"></single-image>

But little by little, this sentence disappeared from the data sheets and the website. Now you can find the phrase on the **Cisco Meraki website**. 😂

<single-image url="/blog/2021/cisco-security-made-simple@2x.jpg" alt="Cisco Meraki website"></single-image>

Sophos' security may still be very user-friendly compared to other vendors, but for existing customers, the changes in recent months have been quite challenging. Even for us, who deal with Sophos 100% every day, it is not always easy. Especially since Sophos is not exactly the communication champion and sometimes announces changes with only a few days' notice.

Regardless of how radical Sophos's latest decisions may be, they make sense for the following two reasons:

1. Even Sophos, as a larger company, has limited resources and cannot maintain multiple generations of hardware and software.
2. they want to continue to develop the platform and prepare it against new threats. This requires up-to-date hardware and software.

## The exception

But every rule has an exception, and at Sophos, that exception is called "**UTM**". The UTM customers have made themselves comfortable in their armchairs and with these many changes around the SFOS platform, Sophos only gives them more reasons to stay with UTM.

Those who have continued to rely on an SG with the UTM operating system since November 2015 have so far been spared all the stress that XG customers have had to go through. Still, it's no secret that the future at Sophos belongs 100% to SFOS.

So, why is Sophos allowing this platform to continue? Well, Sophos is also a company that wants to make money at the end of the day. Currently, the UTM community is still too big and valuable to upset. Therefore, it is only a matter of time before an end-of-life date is set for UTM as well.

The official end of sale for the Sophos XG Firewall has been set for the end of September 2021. The devices will be sold while stocks last.

end-of-sale-xg-firewall-hardware

End of Sale - Sophos XG Firewall Hardware


The APX 320X has already been available since September 2020, yet the AP 100X was still available for purchase. Sophos has now announced the end of sale date due to "supply limitations". In our view, this is a somewhat special reason to discontinue a 7-year-old access point. In this article, we will take a closer look at Sophos' explanation and find out whether the APX 320X can really completely convince as a successor.

## AP 100X – The first outdoor access point from Sophos
The [**AP 100X**](/en/shop/sophos-ap-100x/) was introduced in August 2014 as Sophos' first outdoor access point and is now compatible with UTM OS, SFOS and Central. At the same time, it is the last survivor of the AP series. In fact, the indoor access points were [discontinued from the product line](/en/blog/end-of-sale-indoor-access-points-der-ap-serie-gehen-in-rente/) on March 31, 2020.

The reason why the AP 100X did not also go end-of-sale with the indoor access points was because there was no successor at that time. However, in September 2020, the [**APX 320X**](/en/shop/sophos-apx-320x/) was launched as a new outdoor access point, but the AP 100X remained on sale, for which there was a legitimate reason, which I will resolve a little later in this article.

For now, here's the important data on what's next for the AP 100X:

- **End-of-Sale:** 1st August 2021 (only remaining stocks)
- **Final Renewal (Sophos Central):** March 31, 2022
- **End-of-Support:** September 30, 2022
- **End-of-Life:** March 31, 2023
- **Nachfolgeprodukt:** [**APX 320X**](/en/shop/sophos-apx-320x/)


## Strange end-of-sale justification
Regarding the discontinuation of the AP 100X, Sophos writes the following statement:

> "Our Outdoor Access Point AP 100X, which has been available for several years, is now affected by the current supply bottlenecks - reliable availability of individual components that meet our requirements can no longer be guaranteed. We are therefore forced to announce the end-of-sale for the AP 100X and will only sell the model while stocks last. We are trying our best to supply as many additional access points as possible. However, the remaining access points may be sold out in some regions as early as August."

The justification for taking the AP 100X out of the range due to "supply bottlenecks" sounds a bit ironic. So, if there were no supply bottlenecks, they would continue to produce a 7-year-old access point from 2014? 😅
If you take a closer look at the data on the APX 320X, there was actually still a decisive reason to resell the AP 100X until now.

## The big drawback of the APX 320X
At first glance, the APX 320X offers some advantages over the AP 100X:

- 40% cheaper
- 802.11 ac Wave 2
- Wide range of accessories

Unfortunately, there is one major drawback to the APX 320X that calls Sophos's access point strategy into question. The APX 320X is still **only compatible** with Central and cannot be used with the SFOS or UTM operating system!

Anyone who thinks that Sophos will soon support the APX 320X on the SFOS or UTM via a software update is very much mistaken. Sophos writes in the end-of-sale notice of the AP 100X about this as follows:

> "Any plans to add support for the APX 320X in Sophos Firewall or Sophos UTM (SG) are currently suspended."

## Conclusion
With the firewall, Sophos has a product on the market that is clearly the heart of every network. With the switches, which will come at the end of the year, the portfolio in the network segment is expanded. The switches are an absolutely logical step.

However, if you look at today's networks, more and more devices are connected via WLAN. On this front, Sophos is a bit weak in my opinion, and it feels like the wireless space is just a hobby project. Here are a few reasons why I come to this conclusion:

- For over 6 months, the APX 320X has not received any support for the SFOS or UTM. However, here you already have to consider that the APX 310X outdoor access point is not sold regularly.
- Since the end of 2019, new notebooks and smartphones support Wi-Fi 6, and other manufacturers already offer Wi-Fi 6 access points.
- There have been no new wireless features for Central Wireless or the Sophos Firewall for months.


One thing is clear, many of our customers love the simplicity and integration of the Sophos Wireless solution. The APX indoor access points are a perfect fit with the Sophos Firewall and are also wonderfully manageable behind a RED. However, there are more than a few customers who would need to replace all of their AP series access points regarding the [**XGS Firewall**](/en/blog/sophos-xgs-series-new-firewalls-with-more-power/). This is because the new XGS firewalls only support the APX access points. Unfortunately, it is no longer possible to use Sophos Central to manage the AP series, as the licenses are EoS. An extra firewall for WLAN management is probably not a viable solution either.


In any case, we are very curious to see how Sophos will tackle the wireless topic in the future and, as always, will keep you up to date.


The Sophos Outdoor Access Point AP 100X is going end of sale. A successor model is already available, but only for Sophos Central.

end-of-sale-ap-100x-outdoor-access-point

End of Sale - AP 100X Outdoor Access Point


Sophos is permanently working on improving the security of the hardware and software, but in fact, in order to provide the maximum and most efficient protection, we need to keep updating both the hardware and, of course, the software. Software updates are regular and new features are being introduced in every update.

In April 2021, Sophos introduced a [new hardware series](https://www.avanet.com/en/blog/sophos-xgs-series-new-firewalls-with-more-power/), which in terms of performance, will again be sufficient for the next few years. Upcoming software releases will be even better optimized for this new hardware. This is perhaps why Sophos is now making important changes regarding the lifecycle of a software release on its Sophos Firewall OS (SFOS). As of July 31, 2021, the following versions are End of Life:

- v17.5 MR13 and older
- v18.0 MR3 and older


> **End of Sale** means that the product can no longer be purchased from Sophos or verified resellers. **End of Life**, on the other hand, means that Sophos will no longer support this product. There will be no future releases for this product.

From this date on, any new SFOS release will automatically mean EOL for the older version. Sophos will no longer announce EOL for SFOS versions. A new release automatically means End of Life for a predecessor.

If users continue to use the products that have reached End of Life, they can continue to use the features that were included in the last build before the EOL end was announced. However, this product does not provide all the new features that Sophos releases, and outdated hardware may not support new software in some cases.

See the following Sophos page for hardware that is currently or soon to be End of Life:
- [Retirement calendar for Sophos SG UTM, Sophos Firewall, Wireless, and RED](https://support.sophos.com/support/s/article/KB-000035279?language=en_US)

Often you don't know which hardware revision you have in use. This web page from Sophos can help:
- [Sophos Firewall, UTM, AP, RED: Find the revision number](https://support.sophos.com/support/s/article/KB-000034595?language=en_US)



Sophos commits to better protection for its users' hence continuous software and lifecycle changes are implemented for old SFOS Versions.

sophos-firewall-os-important-lifecycle-policy-changes

Sophos Firewall OS - Important Lifecycle Policy Changes

Sophos recently released the public beta for its new **Sophos Zero Trust Network Access** product. Anyone can now [register for the ZTNA Early Access Program](https://www.sophos.com/en-us/content/zero-trust-network-access.aspx){:target="_blank" rel="nofollow"}. Let's take a look at what the Zero Trust security model is, and what makes it one of the most secure cybersecurity frameworks in the world.

## What is the Zero Trust Model?
The Zero Trust model simply states that an organization must not trust all attempts to access data and must be verified before granting access. To explain it in three words: **Don’t trust anyone**. Don't grant access of any kind unless it is 100% sure who is trying to access it. But why should you use this over-the-top and borderline paranoid security model? Well, consider this, Cybersecurity Ventures predicted that cybercrime will cost $6 Trillion in loss around the world by 2021. This is the expected loss despite the extravagant investment in cybersecurity by some of the biggest companies in the world. No one is safe from cyberattacks, SQL injections, and illegal access to your devices.
The Zero Trust model proposes to change the concept that organizations focus on outside threats while assuming that everything already inside does not require any authorization and is harmless. Most security breaches occur because it is easy for hackers to gain access to more information within the system once access has been granted.
Before putting all your faith in the Zero Trust model, you should know the pros and cons of this framework.

### Pros of the Zero Trust model:
- The company is much less vulnerable to cyber threats.
- Authentication procedures are very strict.
- Improved protection of company's data.
- Very sophisticated security structure.

### Cons of the Zero Trust model:
- Requires a lot of time to set up.
- The management of many users as all the access requests needs to be authenticated.
- Harder to secure data as data is stored in multiple locations which means there is more protection needed at multiple sites.


## What is ZTNA?
ZTNA is the newest Sophos Central product that is completely delivered and managed on the cloud. Its purpose is to provide secure application access to remote users. What is ZTNA about? It is based on the Zero Trust framework, which means verifying the user in every way possible to minimize the chance of compromise. This includes user authentication (commonly two-factor authentication to make sure stolen credentials don’t lead to a breach), device health validation, and checking the compliance state of the device to decide on granting access.

<single-image url="/blog/2021/ztna-procedure-for-granting-access-to-users@2x.jpg" alt="ZTNA procedure for granting access to users"></single-image>

## How does ZTNA compare with VPN?
While VPN has been a good option for us, ZTNA provides a better solution when we stack them up against each other. How does ZTNA outperform VPN?

- **Better Security:** The security of the networked application will improve drastically because, unlike VPN, ZTNA will verify the device's health and status as well. Unhealthy devices can seriously harm a device.
- **Transparent:** ZTNA offers “just works” transparency to users with frictionless connection management. VPN can be difficult and prone to initiating support calls.
- **Granular Control:** ZTNA offers more segmented access over the application's data, unlike VPN which allows the user to access all the data once verification goes through. Attackers love this, once inside, it gives them unlimited time to move from device to device. Once authenticated, it could mean access to thousands of devices.

As VPN is a technology that was developed over 20 years ago, it is a little outdated. It was created with the goal of expanding trusted networks to connect corporate officers into a unified network. But now, cloud-based applications have a wide range of users that are connecting to them through several devices, which makes **VPN a vulnerable and unsafe choice**. And hackers are using these weaknesses all the time. VPN flaws pose a serious threat to businesses.

<single-image url="/blog/2021/ztna-and-vpn-de@2x.jpg" alt="ZTNA and VPN in comparison"></single-image>



## What applications can ZTNA protect?
ZTNA will protect all the networked applications hosted on the company’s on-premise networks or available on the public cloud. This includes applications like Wiki or Jira or any other sort of repositories or ticketing apps. ZTNA will not provide protection for the applications that are not owned by the customer but instead are internet-facing applications that are used by many customers like Microsoft Office. But these systems already have a very sophisticated two-factor authentication procedure in place.

## Components of ZTNA
There are three components of the Sophos ZTNA:

- **Sophos Central:** provides a cloud management platform for all Sophos products including the Sophos ZTNA which is cloud-enabled providing easy deployment, policy management, and reporting.
- **Sophos ZTNA Gateway:** a virtual appliance for the protection of on-premise or public cloud networked applications with initial support for AWS and VMware ESXi and will support Azure, Hyper-V and Nutanix very soon.
- **Sophos ZTNA Client:** provides seamless connectivity to applications based on end users' identifications and device health. It is straightforward to deploy and will gain device health status from Windows Security Center. It will only support windows in the beginning, shortly followed by support for macOS, Linux, and the mobile operating systems iOS and Android.

## When can we expect to get our hands on ZTNA?
Sophos is proud to announce that they are starting with the [Early Access Program for Sophos Zero Trust Network Access](https://www.sophos.com/en-us/content/zero-trust-network-access.aspx){:target="_blank" rel="nofollow"} (ZTNA). The first phase will provide clientless access to browser applications such as CRM and Ticketing applications (JIRA). The next phase will contain further advancements such as Windows client support with integrated deployment alongside Intercept X, Synchronized Security for device health, additional Identity providers, and a gateway for AWS.

## Licensing and Pricing
As we already know from other Central products, ZTNA is licensed per user and not per device. So a user with multiple devices needs only one license. There will be a free trial at launch as well, so the users can take a look under the hood before deciding to buy the license.

Sophos recently released the public beta for ZTNA. Find out how the new Sophos ZTNA uses zero trust to secure all your applications and devices.

sophos-zero-trust-network-access-an-alternative-to-vpn

Sophos Zero Trust Network Access - An alternative to VPN

In this article, we'll go over all the changes and innovations to the XGS series that make it the best firewall appliance Sophos has ever created.

<videoblock video-id="_hTqlrhefs4" provider="youtube"></videoblock>

## It has become true after all...
At the [Sophos Discover Conference 2017](https://www.avanet.com/en/blog/sophos-discover-conference-2017-what-sophos-plans-for-the-future/) in Lisbon, the new hardware was presented for the first time. At that time, it was said that it would be available in 2018. However, the release did not happen and it became very quiet about the new hardware. Now, a little more than three years later, it is here. We had the great honor of participating in an exclusive EAP for the XGS since February 2021. We were able to test an XGS 2300 with v18.5 and share our experiences with Sophos. Small conclusion beforehand: It is really fast! 🚀


## The main improvements of the XGS Series
Sophos's XGS firewall has been redesigned from the ground up to become a completely new and much more efficient product. The hardware resembles the XG series from the outside, but what matters is what's inside the new XGS series. Under the hood, the new firewall has been designed for maximum protection and more efficient network security.

<single-image url="/blog/2021/sophos-firewall-xgs-series-key-features@2x.jpg" alt="Key features of the XGS Firewall Serie"></single-image>

### Dual-Processor Architecture
All the appliances in the XGS series now come with two different multi-core processors. The multi-core **CPU** and the multi-core networking processing unit, **Xstream Flow Processor**. Up until now, the Xstream architecture (discussed later) was only software-based, but now in the XGS series, it has a hardware layer that takes the efficiency metrics of this architecture beyond imagination.

> In the upcoming firmware releases SFOS 19.0 and 19.5, the software will be further optimized to allow the hardware to offload even more tasks to the NPU e.g. SD-WAN, VPN and Endpoint AV/TLS.

### Port Density and Diversity
The XGS series comes with an increased number of built-in interfaces and a more diverse option of connectivity to make sure that this series can keep up with the infrastructure changes. The XGS series does not aim to keep your network protected for the next year, it aims to match your requirements for the next 4-5 years. We've all been hit differently hard by Covid-19, but based on the last 18 months, network requirements can change drastically and your firewall appliances need to be flexible enough to adapt to a variety of changes to the infrastructure.

> **Note**: The FleXi port modules of the XG Firewall are no longer compatible for the XGS series.

### Protection & Performance
Intelligent and more focused traffic handling due to extra dedicated hardware frees up resources so they can be used on more intensive tasks such as *Core Firewall Tasks*, *TLS Inspections*, and *Deep Packet Inspection*. Depending upon which statistics you are looking at, the XGS series offers up to **3X or even more performance boost** over your previous appliances.


## The Xstream Architecture
The new XGS series comes with a new **Xstream Flow Processor** which is a multi-core networking processing unit or an NPU. Before we can get into how the new processor significantly improves the performance of XGS over XG, we need to take a look at what Xstream architecture is.

<single-image url="/blog/2021/sophos-firewall-xgs-series-xstream-architecture@2x.jpg" alt="Sophos Xstream Architecture"></single-image>

Introduced in V18, Xstream architecture is an efficient way for traffic handling by consolidating security in a *single streaming deep packet inspection engine*. It creates a virtual fast path to offload previously verified and trusted traffic and significantly benefits apps with real-time data such as SaaS and Cloud applications. In the XG series, the Xstream architecture was completely software-based but in the XGS series, Sophos have added a hardware layer i.e the Xstream Flow Processor. This provides a dedicated fast path for app acceleration. All of this means less burden on the CPU which can focus all the resources on *core firewall tasks* and *deep packet inspection* hence greatly improving latency and providing much more efficient network protection


## The XGS Appliances
The all-new Hardware comes with a series of new appliances that are distributed into different categories. Depending on how big the IT infrastructure is, the appropriate hardware size then comes into action. But before we go into detail about all the categories and the devices, we need to take a look at the portfolio to see how the devices are changed from the XG series.

- [Sophos XG 86](https://www.avanet.com/en/shop/sophos-xg-86-security-appliance/) > [Sophos XGS 87](https://www.avanet.com/en/shop/sophos-xgs-87-security-appliance/)
- [Sophos XG 106](https://www.avanet.com/en/shop/sophos-xg-106-security-appliance/) > [Sophos XGS 107](https://www.avanet.com/en/shop/sophos-xgs-107-security-appliance/)
- [Sophos XG 115](https://www.avanet.com/en/shop/sophos-xg-115-security-appliance/) > [Sophos XGS 116](https://www.avanet.com/en/shop/sophos-xgs-116-security-appliance/)
- [Sophos XG 125](https://www.avanet.com/en/shop/sophos-xg-125-security-appliance/) > [Sophos XGS 126](https://www.avanet.com/en/shop/sophos-xgs-126-security-appliance/)
- [Sophos XG 135](https://www.avanet.com/en/shop/sophos-xg-135-security-appliance/) > [Sophos XGS 136](https://www.avanet.com/en/shop/sophos-xgs-136-security-appliance/)
- [Sophos XG 210](https://www.avanet.com/en/shop/sophos-xg-210-security-appliance/) > [Sophos XGS 2100](https://www.avanet.com/en/shop/sophos-xgs-2100-security-appliance/)
- [Sophos XG 230](https://www.avanet.com/en/shop/sophos-xg-230-security-appliance/) > [Sophos XGS 2300](https://www.avanet.com/en/shop/sophos-xgs-2300-security-appliance/)
- [Sophos XG 310](https://www.avanet.com/en/shop/sophos-xg-310-security-appliance/) > [Sophos XGS 3100](https://www.avanet.com/en/shop/sophos-xgs-3100-security-appliance/)
- [Sophos XG 330](https://www.avanet.com/en/shop/sophos-xg-330-security-appliance/) > [Sophos XGS 3300](https://www.avanet.com/en/shop/sophos-xgs-3300-security-appliance/)
- [Sophos XG 430](https://www.avanet.com/en/shop/sophos-xg-430-security-appliance/) > [Sophos XGS 4300](https://www.avanet.com/en/shop/sophos-xgs-4300-security-appliance/)
- [Sophos XG 450](https://www.avanet.com/en/shop/sophos-xg-450-security-appliance/) > [Sophos XGS 4500](https://www.avanet.com/en/shop/sophos-xgs-4500-security-appliance/)
- [Sophos XG 550](https://www.avanet.com/en/shop/sophos-xg-550-security-appliance/) > [Sophos XGS 5500](https://www.avanet.com/en/shop/sophos-xgs-5500-security-appliance/)
- [Sophos XG 650](https://www.avanet.com/en/shop/sophos-xg-650-security-appliance/) > [Sophos XGS 6500](https://www.avanet.com/en/shop/sophos-xgs-6500-security-appliance/)
- [Sophos XG 750](https://www.avanet.com/en/shop/sophos-xg-750-security-appliance/) > [Sophos XGS 6500](https://www.avanet.com/en/shop/sophos-xgs-6500-security-appliance/)

All the appliances of the XG series have an XGS equivalent with the exception of XG 750. However, with the improved hardware, all the XGS series significantly outperform the XG series hence XGS 6500 is miles ahead of XG 750.


<single-image url="/blog/2021/sophos-firewall-xg-series-vs-xgs-series@2x.jpg" alt="Sophos XG vs. XGS Appliance Performance Differences"></single-image>

> If the power of an XGS 6500 is still not enough for you, I would like to mention here that the XGS 7500 and XGS 8500 models will be added next year 🤐.

Now we will take a look at the three categories that the XGS series devices offer:


### Desktop Range
All the Devices from XGS 87 to XGS 136 are categorized as the Desktop Range. These appliances are best for Small offices, Branches, and Retail Stores. The highlights of this category are:

<single-image url="/blog/2021/sophos-firewall-xgs-series-desktop-highlights@2x.jpg" alt="Sophos XGS Firewall Hardware - Desktop Appliance Highlights"></single-image>

- All the devices in this range come with the **Dual-processor Architecture**.
- All devices of this series have a **SFP port**, which was also newly integrated in the XGS 87 (was not the case in the XG 86)
- The devices from 116w to 136w now come with optional modules, which is a new addition for 116w (was not available in 115w XG series)
- The XGS 116w, 126w and 136w, can now optionally install a WiFi module (was not available on the XG 115w & XG 125w)
- The devices from 116w to 136w now come with a **Power over Ethernet (POE)** built-in.
- The XGS 136w now has **2.5 GE ports**
- All the models except 87w have optional **2nd Power Supply**.


### 1U Rackmount
All the devices from XGS 2100 to XGS 4500 are categorized as 1U Rackmount. These devices are perfectly suited for distributed locations and multiple branches. The highlights of this category are:

<single-image url="/blog/2021/sophos-firewall-xgs-series-1u-model-highlights@2x.jpg" alt="Sophos XGS Firewall Hardware - 1U Model Appliance Highlights"></single-image>

- All the devices in this range come with the **Dual-processor Architecture**.
- All the devices from XGS 2100 to XGS 3300 come with **One Flexi port bay** and XGS 4300 & XGS 4500 come with **Two flexi port bays**.
- XGS 3100 onwards come with an **SFP+ built-in**.
- All the devices from XGS 2100 to XGS 3300 come with **One LAN Bypass port pair** and XGS 4300 & XGS 4500 come with **Two LAN Bypass port pairs**.
- XGS 4300 and XGS 4500 now come with **2.5 GE ports built-in**
- The **memory** in the devices from XGS 3300 onwards is boosted for better TLS inspected
- All the devices in 1U Rackmount now come with **Optional centrally-powered PoE Flexi port modules**.
- All the devices in 1U rackmount now come with **Optional external redundant power supply**
- XGS 4500 comes with a Dual SSD and an **optional internal redundant power source**


### 2U Rackmount
XGS 5500 and XGS 6500 are categorized as 2U Rackmount. These devices are perfectly suited for enterprise requirements. The highlights of this category are:

<single-image url="/blog/2021/sophos-firewall-xgs-series-2u-model-highlights@2x.jpg" alt="Sophos XGS Firewall Hardware 2U Model Appliance Highlights"></single-image>

- All the devices in this range come with the **Dual-processor Architecture**.
- Both of the devices come with **Two Flexi port bays**.
- XGS 5500 comes with **One high-density Flexi port bay** and XGS 6500 comes with **Two high-density Flexi port bays**.
- Both devices come with **Copper and 10G fiber ports** on-board.
- The XGS 5500 can have 48 maximum ports using modules.
- The XGS 6500 can have 68 maximum ports using modules.
- Both devices have **Internal redundant power supplies**.
- Both devices have **Dual SSDs**.
- Both devices have **Boosted Memory** for better TLS inspection.


## Licensing
The new XGS series comes with a new licensing model. We've covered everything you need to know about this in detail in a separate article: [Sophos Firewall: XGS Hardware launches new license bundles](/en/blog/sophos-firewall-xgs-hardware-launches-new-license-bundles/)

---

### More information about the **XGS series**:

- [Sophos XGS Firewall Datasheet](/assets/pdf/sophos-xgs-firewall-de.pdf){:target="_blank"}
- [Sophos XGS Firewall Brochure](/assets/pdf/sophos-xgs-firewall-brochure-de.pdf){:target="_blank"}

The new XGS Firewall series is finally here and with the powerful new hardware, Sophos has created a whole new level of network protection.

sophos-xgs-series-new-firewalls-with-more-power

Sophos XGS Series - Revolutionary Firewall Protection

The new XGS series also introduces new license bundles, which will also apply to XG firewalls (or SG firewalls with SFOS) from June.

## Single licenses
The individual licenses have remained more or less the same. These can still be purchased in the variants **1, 2 or 3 years** and depending on the region also for schools as **EDU** or governmental organizations as **GOV** licenses. Here is an overview of all individual licenses as a refresher:

- **Base License**: Stateful Firewall, VPN, Wireless
> The [Base license](https://www.avanet.com/en/kb/sophos-firewall-os-base-license/) is included "free of charge" with every XG/XGS firewall and must only be purchased once for the virtual firewalls. There is no runtime here.
- **Network Protection**: IPS, ATP, SD-RED Device Management
- **Web Protection**: Web Security and Control, Application Control, Web Malware Protection
- **Zero-Day Protection** (formerly Sandstorm): Machine Learning, Sandboxing File Analysis, Threat Intelligence
- **Central Orchestration (planned)**: SD-WAN VPN Orchestration, Central Firewall Reporting Advanced
- **Email Protection**: Anti-spam, Antivirus, DLP, Encryption, Email Malware Protection
- **Webserver Protection**: Web Application Firewall
- **Enhanced Support**
- ~~**Enhanced Plus Support**~~ (no longer exists): Here you should buy the "Enhanced Support" and then the "Enhanced to Enhanced Plus Support Upgrade".
- **Enhanced to Enhanced Plus Support Upgrade**


## License Bundles
Since in most cases several modules in the top list are needed at once to meet the requirements in a network, Sophos has combined a few individual licenses and previously offered them as a bundle at a lower price.
The previously known **FullGuard (Plus)** and **EnterpriseGuard (Plus)** bundles have not been adopted for the new XGS series and instead the following bundles have been introduced:

**Standard Protection**
- Base License
- Network Protection
- Web Protection
- Enhanced Support

**Xstream Protection**
- Base License
- Network Protection
- Web Protection
- Enhanced Support
- Zero-Day Protection
- Central Orchestration

**Epic Protection**
- Base License
- Network Protection
- Web Protection
- Enhanced Support
- Zero-Day Protection
- Central Orchestration
- Email Protection
- Webserver Protection

<single-image url="/blog/2021/sophos-xgs-firewall-new-license-bundles@2x.jpg" alt="The new license bundles of Sophos XGS Firewall"></single-image>

If you need all modules, you are completely covered with the Epic Protection. Only if the Enhanced Plus support is needed, the upgrade would have to be purchased separately.

> The bundles listed above are valid for the new XGS firewalls as of now. From July 2021, the XG series will also be switched to these bundles. After that, **FullGuard (Plus)** or **EnterpriseGuard (Plus)** bundles can no longer be ordered.

### Migration path for XG Firewall users
As mentioned above, the XG license bundles will also be adjusted from July 2021. Sophos has provided the following migration path for this:

- **EnterpriseGuard** → Standard Protection
- **EnterpriseGuard Plus** → Xstream Protection
- **FullGuard** → Epic Protection
- **FullGuard Plus** → Epic Protection


<single-image url="/blog/2021/sophos-xgs-firewall-licensing-migration-infografic@2x.jpg" alt="Sophos XGS Firewall license migration infographic" enlarge="true"></single-image>

## Hardware Bundles
Hardware bundles were the logical choice when buying a new firewall together with a license bundle. These were always a bit cheaper than if you had bought the hardware and the license bundle separately.

With the launch of the XGS series, the previously known hardware bundles **Total Protect (Plus)** and **Enterprise Protect (Plus)** will also disappear. Sophos also offers hardware bundles for the firewalls of the XGS series, but judging by the current price list, the price advantage will disappear in the future.

Specifically, this means that you can buy the XGS series together with a license bundle, such as the **Standard**, **Epic** or **Xstream Protection** as a hardware bundle (combined as one item), but in terms of price, it would be the same as if you were to add the hardware and license bundle to your cart separately. 🤷🏼‍♂️

The new hardware bundles are also no longer named specifically, which makes it less complicated from our point of view:

- Sophos [name of the XGS appliance] with **Standard Protection**
- Sophos [name of the XGS appliance] with **Xstream Protection**
- Sophos [name of the XGS appliance] with **Epic Protection**

In contrast to the SG or XG series, you can set the license term to **5 years** when purchasing a hardware bundle. While the single licenses or license bundles can only be purchased for 1, 2 or 3 years, the hardware bundle can be purchased for 1, 3 or 5 years.

## Prices 📈
If we compare the prices with the XG series, we come to the conclusion that everything has become a little more expensive. A close analysis of the new price list has revealed the following:


### The hardware has become more expensive
Yes, but the hardware also has more performance. The bottom line is about 30-40%. In some places it's even a 10-fold performance increase. Future software releases will bring even more performance here, as certain processes can be outsourced to the new hardware even better.


### The licenses have become more expensive
It has always been the case that hardware with more power also has higher license costs. One thought that comes to many is, of course, that if the hardware now has more power, then yes, you can switch to the smaller model and thus save on license costs. In some cases, switching to a smaller model of the XGS series does make sense. However, you really have to check the requirements carefully beforehand.


### Renewal discount removed
Since the days of Astaro, the renewal of firewall licenses has been about 5% cheaper than buying a new one. This is now also no longer the case.


### Price advantage for hardware bundles no longer applies
As described, it is no longer cheaper to buy a hardware bundle instead of purchasing the hardware and license bundles individually. Customers who buy the hardware first and then use the 30-day trial license to find out which modules they really need are therefore no longer at a disadvantage. The right license bundle or the right individual license can therefore be purchased later without any price disadvantage. However, offering a price advantage for hardware bundles would still have made sense from our point of view.


## Final remarks
The **Sophos Firewall** still offers the best price performance on the market, despite the price increase. If you don't believe me, just compare yourself with other well-known manufacturers, which offer approximately the same range of functions and excellent performance.

The new XGS series also introduces new license bundles, which will also apply to XG firewalls from June (or SG Firewalls with SFOS).

sophos-firewall-xgs-hardware-launches-new-license-bundles

Sophos Firewall - XGS Hardware launches new license bundles

With the Sophos Firewall release 18.0.5 or also called v18 MR5, Sophos brings new features besides bug fixes.

## IPsec performance improvements
With the [MR3 release](/en/blog/sophos-sfos-update-new-features-in-v18-03-mr3/), SSL VPN performance was tweaked to suddenly allow more SSL VPN connections on the same hardware.
With MR5, more IPsec connections are now also possible via the Sophos Connect client.

<single-image url="/blog/2021/sophos-firewall-sfos-v18-0-5-ipsec-performance@2x.jpg" alt="MR5 IPsec Performance"></single-image>

## WAF and SSL VPN with Port 443
The Web Application Firewall is one of the rather rarely used modules of the Sophos Firewall. The problem was often that applications were secured with port 443 (HTTPS). Unfortunately, this meant that it was no longer possible to use the same port for the SSL VPN. With MR5, the WAF and SSL VPN can now be used together on port 443.


## Azure Active Directory
This new feature will also please some of our customers. Sophos Firewall can now be used with Azure Active Directory, without the expensive "Azure Active Directory Domain Services" from Microsoft.
How this works is beautifully explained in the KB post from Sophos:
[Sophos XG Firewall: Integrate XG Firewall with Azure AD](https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/125872/sophos-xg-firewall-integrate-xg-firewall-with-azure-ad){:target="_blank" rel="nofollow"}


## Other new features
- Sophos lists all other updates in the release article: [Sophos v18 MR5](https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-xg-firewall-v18-mr5--build-586-is-now-available){:target="_blank" rel="nofollow"}
- For the **release notes**, **bugfixes**, **known issues**, Sophos has now created a new, nice and clear web page: [Sophos v18 MR5 Release Notes](https://docs.sophos.com/releasenotes/index.html?productGroupID=nsg&productID=xg&versionID=18.0){:target="_blank" rel="nofollow"}

With the Sophos Firewall release 18.0.5 or also called v18 MR5, Sophos brings new features besides bug fixes.

sophos-sfos-update-new-features-in-v18-05

Sophos SFOS Update - New features in v18.0.5

There are currently two Sophos Firewall operating systems out there. One is called UTM, which was originally developed by Astaro. The new system is called Sophos Firewall OS or "SFOS" for short. We are now discontinuing support for the UTM OS at the end of 2021.

## A touch of nostalgia
In 2008 I had to deal with the Astaro Firewall for the first time, at that time still in version 6. It just sends shivers down my spine when I look at the screenshots of the version at that time. 🥶

<single-image url="/blog/2021/astaro-security-gateway-v6@2x.jpg" alt="Astaro Security Gateway v6 NAT Rules"></single-image>

Nevertheless, for that period of time, it was an excellent firewall!

## My first task and immediately a bug
I can still remember my first experience with the Astaro Firewall. I remember it so well because not everything went smoothly. I had to upgrade the firewall from version 6 to version 7. After the migration, the IPsec connection could not be established. Unfortunately there was a bug, as I found out later. The pre-shared key (PSK) started with the digit 0, which the firewall apparently didn't like. When I replaced the 0 with a letter, the VPN connection could be re-established. 😅

## Daily Business
At the beginning of 2015, Sophos products became our daily business. I had to take a quick look at our [timeline](/en/timeline/) myself to remember. Until then, the firewall was always just an option on our quotes, where we mainly offered remote desktop services. For the Sophos firewalls, there was also only the UTM operating system at that time, which was fast, very intuitive and functional. All reasons why many admins still love the system today.

## SFOS v15 came straight from hell
In February 2016, the first version (v15) of the Sophos Firewall OS was released and Sophos has been beating the "NexGen Firewall advertising drums". In the middle of the year, we had the first major customer who wanted the new OS with the new hardware. It was a community with about 150 users. It was an absolute nightmare! 🧟

My psychological defense mechanisms were able to repress the memories of it as self-protection. 🤮
The system was so bad that we wanted nothing to do with SFOS until the end of 2016. No idea what Sophos was thinking throwing such an unfinished version on the market in the first place. V15 was a very early pre-alpha version at best.

> By the way, the community has remained our customer and still relies on the XG firewall.

## Everything new with SFOS
But what you really have to give Sophos credit for is that they stuck to the idea and vision of the new firewall operating system back then, despite a lot of criticism. They even admitted on stage a little later at a partner conference in Lisbon that v15 was really bad! 👏

After more than a year of advising everyone against SFOS and recommending UTM, we dared to try again with the release of v16 in October 2016. The further development could be evaluated as positive. We quickly ventured into **smaller** projects and things got better with each new update. Confidence in the system grew steadily and even before SFOS v17 was released, XG Firewall became our standard for new projects.

## Migrations from UTM to SFOS
Since mid-2017, we have not implemented a single project with UTM to date and will not do so again. The last three years we were busy migrating firewalls with the UTM OS to SFOS. Today, we have reached the point where we are using SFOS for over 95% of our customers that we actively support.

Every now and then I still log on to a UTM to support individual customers. But the system has become alien to me and I miss the possibilities of SFOS.

## Our decision
If you look at the version history of the two operating systems over the last few months, you will see that SFOS is constantly evolving, while UTM has stood still. This is hardly surprising, because Sophos is also only blowing one horn in its marketing. The UTM is actually dead and the SFOS is touted as the next generation firewall. In several blogposts and podcasts we have already speculated when Sophos will stop supporting the UTM. For the security vendor itself, there still seems to be plenty of reasons to keep the UTM alive. However, when we look at our customer landscape, the time has come for us personally and also economically to say goodbye and no longer offer UTM support by the end of 2021 at the latest.

We only want to concentrate on one firewall operating system and preferably on the one that has a future. For those who still need UTM support after that, you can contact Sophos directly with "Premium Support" or we will open the tickets for you. But there is no direct support based on our expertise anymore.

## FAQ
- **Is it possible to migrate from UTM to SFOS?**
	- There is no update button. However, you can still install the SFOS on the SG Appliance and take over the license for free. We have also written a manual for this: [Install Sophos XG Firewall OS on a SG Appliance](/en/kb/install-sophos-xg-firewall-os-on-a-sg-appliance/)
- **Is it possible to import the UTM configuration to SFOS?**
	- SFOS is a new operating system. There is a migration wizard that converts parts of the configuration for SFOS. However, a lot of things still have to be set up from scratch afterwards.
- **Do you offer help with a migration?**
	- We already have several "UTM to SFOS migrations" behind us. We can support you with pleasure.
- **What will happen to the UTM operating system?**
	- The UTM system will continue to run at least until January 2024, but development will not really continue. With v9.8, the new hardware is still supported, but that's probably it.

If you haven't looked into the SFOS at all, I can recommend the article [**7 reasons why the XG Firewall (SFOS) is better than the UTM**](/en/blog/7-reasons-why-the-xg-firewall-sfos-is-better-than-the-utm/).

There are two operating systems for Sophos Firewalls – UTM and SFOS. We will discontinue support for UTM at the end of 2021.

sophos-utm-end-of-support-for-end-of-2021

Sophos UTM - End of Support for end of 2021

Sophos rarely releases updates before the holidays, but on December 15, the SFOS **v18 MR4** was released. You get new firewall features and 73 bugs were fixed.

## Change password
After updating to [v18 MR3](/en/blog/sophos-sfos-update-new-features-in-v18-03-mr3/), one was prompted to create a Secure Storage Master Key (SSMK) right after login. After updating to v18 MR4, the admin user is prompted to change their password. Sophos has implemented a stronger password hash.

> We have received questions from customers asking if a password change is really necessary. They say the password is already secure or has only recently been changed after the latest [vulnerability](/en/blog/sophos-sfos-sql-injection-vulnerability-fixed/). Our recommendation is "Yes, change your password."

## For a better world
If the web filter is active on the firewall, websites in which the "Internet Watch Foundation (IWF)" identifies content with child sexual abuse are automatically blocked.

## Improvements for HA Cluster
Finally, Sophos has taken care of an issue with MR4, which worked up to and with MR3, but was cumbersome to set up. Also, the previous representation of HA clusters was rather unattractive in my opinion.

If you have an HA cluster, it is now possible to register both firewalls with Central from one appliance without having to change the appliance each time.

<single-image url="/blog/2021/sophos-firewall-sfos-v18-0-4-central-registration@2x.jpg" alt="Firewall Central registration"></single-image>

A cluster is now also better presented on the Central Firewall Manager. Previously, you had two individual appliances, where one was always offline in an Active/Passive cluster.

<single-image url="/blog/2021/sophos-firewall-sfos-v18-0-4-central-firewall-manager-cluster-view-mr3-mr4@2x.jpg" alt="Central Firewall Manager - HA Cluster view improvements"></single-image>

> So you always had a little shock at first sight and wondered why a firewall is down. 😅

If version v18 MR4 is now installed on the firewall, the cluster is displayed as one entry in the overview. By clicking on the green HA icon, you can see more information about the cluster.

<single-image url="/blog/2021/sophos-firewall-sfos-v18-0-4-central-firewall-manager-ha-cluster-mouseover@2x.jpg" alt="Central Firewall Manager - HA Cluster mouseover"></single-image>

## Scheduled updates
MR4 is now the first update that can be installed time-controlled with a v18 MR3 version. We have tested this of course and it works like a charm. 👌


## Other new features
- We haven't looked much at Sophos's Cloud Optix product yet. But XG Firewall has now received an integration for Cloud Optix so that the two solutions work together – at least the firewalls that are hosted on AWS.
- Synchronized Application Control has received a function that now cleans all applications older than 30 days on the list.
- RADIUS authentication: Users can now be created for RADIUS in UPN (username@domain) format.
- The bugfixes mentioned at the beginning can be found in the following post: [Sophos v18 MR4 Release Notes](https://community.sophos.com/xg-firewall/b/blog/posts/xg-firewall-v18-mr4-is-now-available){:target="_blank" rel="nofollow"}

Shortly before the end of 2020, Sophos has released the firewall update v18 MR4. In this article you will learn what is new.

sophos-sfos-update-new-features-in-v18-04

Sophos SFOS update - New features in v18.0.4

How do you think an IT administrator or CEO (who doesn't have an IT administrator) reacts when he realizes that a malware is just spreading in the company network and the whole operation is slowly coming to a halt?

<img src="https://media.giphy.com/media/jquDWJfPUMCiI/giphy-downsized.gif" alt="Person who gets frightened">

When such a situation occurs, every second counts to stop the attack as quickly as possible and limit the damage. And this is exactly where Sophos wants to make its contribution with **Rapid Response**.

## What exactly is Rapid Response?
Sophos Rapid Response provides lightning-fast help when you find yourself in the situation of an active threat. The service is aimed at **all customers**, regardless of whether they already use a Sophos product or not.

> The only ones among you who will never need Rapid Response are those who have a [**Sophos Central Intercept X Advanced with EDR and MTR**](/en/shop/sophos-central-intercept-x-advanced-for-server-with-xdr-and-mtr/) license. With this, an elite security team is already taking care of threat detection in your organization 24/7 and will take immediate action in critical situations.

## Available for you 24/7
Since every second counts in an attack, the cybersecurity analysts, as well as the onboarding team, work **24/7** to get customers out of the awkward situation directly. The high availability is absolutely necessary for such a service because such attacks usually don't happen at 9:00 on a Monday morning, but rather at 9:00 in the evening on a Friday, or even on Christmas Eve. 😬


## Stopping the damage is the first priority
Fittingly in times of a pandemic, the service is performed entirely remotely. The goal is always to stop the damage, not to restore the original environment. You have to think of it like a fire department operation. If there is a fire in a house, Sophos would be the fire department, making sure that the fire is brought under control and extinguished. But Sophos is not responsible for rebuilding the house at the end.


## Quick onboarding
In order for the Rapid Response Team to stop the attack on your organization, you first go through an onboarding process. This involves rolling out the **Intercept X Advanced with EDR** agent on all endpoints and servers to have the initial data available as quickly as possible to evaluate the situation. 

> For customers who previously relied on another security vendor, the software will be temporarily deactivated or removed.

During the entire time the Rapid Response Team is working to contain the threat on your network and stop the attack, you will enjoy VIP status with a dedicated contact person. Note, however, that the service is currently only available in English.


## Fixed price without hidden costs
Rapid Response is provided for **45 days** at a **fixed price**. The price is calculated based on the number of users and the number of servers in the company.

For the 45 days, the customer is covered by the **MTR Advanced Service**. It does not matter if the unauthorized accesses could already be brought under control after two days. The "patient" still remains under constant surveillance for the remaining 43 days.

After these 45 days, the customer is free to decide whether he wants to continue protecting his computers and servers with the **MTR Advanced License** or switch back to his previous security vendor. However, the latter is probably only seriously considered in the fewest cases. 😅

Of course, it would also be possible to switch to a lower license, such as [**MTR Standard**](/en/shop/sophos-central-intercept-x-advanced-for-server-with-xdr-and-mtr/) or [**Intercept X Advanced with EDR**](/en/shop/sophos-central-intercept-x-advanced-with-xdr/). However, I would not recommend anything below that.

## Bottom line
I don't think anyone would like to get into the situation of being hit by a nasty malware that is not detected by the installed endpoint protection and can happily collect data undisturbed for months. And this is just one example of the behavior of a modern malware. When faced with such a disaster, there is nothing more reassuring than having an expert take care of the situation and get it under control as quickly as possible. So with Rapid Response, Sophos now has a solution.

But just because there's a service like this now, it doesn't mean you should be careless about protecting your network. You don't light a fire in your home thinking, "The fire department will be there if it gets out of control."

The goal must be to never have to call on the Sophos rapid response service. So for customers who already protect their computers and servers with Sophos Central, they should license at least **Intercept X Advanced with EDR**. Only EDR gives you professional tools to detect suspicious activity on the network that is not directly detected by Intercept X Advanced.

If you don't have the time to regularly check your network for suspicious activity, the MTR license lets you relax and let Sophos's team of experts do the work for you, 24/7! You get the same service as with Rapid Response. The only difference is that you can count on Sophos's best protection now, before it's already too late. 😎

---

#### More information
- [**Website from Sophos about Rapid Response**](https://www.sophos.com/en-us/products/managed-threat-response/rapid-response.aspx){:target="_blank" rel="nofollow"}

Every second counts in an attack! Sophos Rapid Response provides lightning-fast help when you find yourself in the situation of an active threat.

sophos-rapid-response-immediate-help-for-active-threats

Sophos Rapid Response - Immediate help for active threats

In June Apple presented macOS 11 (Big Sur) to the public for the first time. Since then, it is possible for developers to prepare for the new version. Unfortunately, for Sophos this time was not quite enough.

Today, November 12, 2020, the new OS is available for no charge to all users. However, if you are using the Sophos Central Endpoint Client, you should not install the update yet, as Sophos's endpoint protection will not work after that. 🤯

Sophos will soon be releasing a version that supports the new macOS through its Early Access Program (EAP). In December 2020 / January 2021 the final version should be released.

The Central Device Encryption version 1.5.3 already supports macOS 11, but since it is often installed with the endpoint protection, it is still necessary to wait.


## Sophos and Apple Silicon
Also in June 2020 Apple talked about Apple Silicon for the first time. These are self-developed processors with the ARM architecture, which are already used in the iPhone or iPad, for example. These processors are now to be introduced in all Macs within the next 2 years. It was already known that the first hardware with the new chips will be available at the end of 2020.

Transition Kits were distributed in advance so that the developers could already test their software.
On 10.11.2020 Apple already presented three new devices, which will arrive at the first customers at the end of November.

> As Apple fanboys, we have of course also ordered a device.

Apple does not yet support ARM for Windows at this time. But we are working on it. I suspect that the ARM Macs will be supported sooner or later, but we don't know anything about it at the moment.


## Rosetta 2 (emulator)
Of course, depending on the software, 5 months is not enough time to rewrite the code for a new processor architecture. For this purpose, Apple has introduced Rosetta 2.

It is an emulator which is integrated in macOS Big Sur and enables ARM Macs to run Intel applications. Rosetta 2 essentially translates instructions written for Intel processors into instructions that Apple's silicon chips understand. Developers do not have to make any changes to their old applications; they simply work.

> We will certainly test for you whether this is true for Sophos products and whether the Central Endpoint Client can be easily emulated with Rosetta 2. 😇

The Sophos endpoint does not yet support the new macOS operating system Big Sur. With the in-house ARM chips, Apple Silicon, you also have to be patient.

sophos-endpoint-not-for-macos-big-sur-or-apple-silicon

Sophos Endpoint - Not for macOS Big Sur or Apple Silicon

Admins who have already updated their XG firewall to 17.5 MR13 and MR14 have been waiting for this update for quite some time. But also for all others **v18 MR3** comes with 34 bug fixes and some new features.

## Upgrade to v18
Currently, there are still two different versions of SFOS being updated by Sophos. There is **v17.5** (MR6 — MR14.1) and **version 18** (MR1 and MR2).

Users of an XG 85 or XG 105 cannot upgrade to v18 because of insufficient RAM. Therefore, these [firewall appliances are also End of Sale](/en/blog/sophos-xg-85-and-xg-105-end-of-sale/) and there are corresponding follow-up models. For customers with these older appliances, Sophos continues to keep v17.5 current, at least as far as bug fixes and security updates are concerned.

To benefit from the latest features, it would be recommended to switch to the new models that support v18. To make it easier for customers with older devices, Sophos is offering a [Renewal Promo](/en/blog/sophos-promo-50-on-sg-xg-firewalls-upon-renewals/) until the end of the year, giving 50% of the new firewall hardware for free. The other option would be to simply wait until 2021 Q2… (**SPOILER:** New hardware series will be released. 🤫)

But for firewalls that support v18, an update has not been that easy so far. Until now, there was a working migration path to version 18 only for versions 17.5 MR6 to MR12. Those who had already installed MR13 or MR14 meanwhile were confronted with a factory reset when manually updating to v18 and lost their complete configuration.

With v18 MR3 there is an update path again. We also see with our v17.5 customers that the v18 update on the firewall is suggested automatically for the first time. So, Sophos is confident and has gained enough experience with v18 to make the upgrade available to all customers.

> Our experience with v18 and v18 MR3 is also very positive. We recommend an upgrade to v18. 🙌



### Why v18 is a fantastic release
- [In SFOS v18 there are some new functions](/en/blog/sophos-sfos-v18-new-features-at-a-glance/)
- [With SFOS v18 there are new features for the Central Firewall Management](/en/blog/sophos-central-firewall-management-features-with-sfos-v18/)

The same firewall appliance has also become much faster with the software upgrade to v18! 🚀

<single-image url="/blog/2020/sophos-firewall-sfos-v18-performance-boost@2x.jpg" alt="Sophos Firewall OS - Performance Boost"></single-image>

> On the 100 series (XG 86 - XG 135) the web interface has become **quite a bit faster**, but on the bottom line it is still **damn slow! 🐌



## VPN performance improvements
SSL VPN performance has been improved with v18 MR3.
Now, much more parallel connections are supported on the larger hardware models than on the older SFOS version.

<single-image url="/blog/2020/sophos-firewall-sfos-v18-mr3-sslvpn-performance-xg86-135@2x.jpg" alt="Sophos Firewall OS - SSL VPN Performance XG86 - XG135"></single-image>

<single-image url="/blog/2020/sophos-firewall-sfos-v18-mr3-sslvpn-performance-xg210-330@2x.jpg" alt="Sophos Firewall OS - SSL VPN Performance XG210 - XG330"></single-image>

<single-image url="/blog/2020/sophos-firewall-sfos-v18-mr3-sslvpn-performance-xg430-750@2x.jpg" alt="Sophos Firewall OS - SSL VPN Performance XG430 - XG750"></single-image>



## Secure Storage Master Key (SSMK)
If you have completed the update and then log in as admin, the following display appears:

<single-image url="/blog/2020/sophos-firewall-sfos-v18-mr3-secure-storage-master-key-create@2x.jpg" alt="Sophos Firewall OS - Create Secure Storage Master Key"></single-image>

### Background to this changes

Sophos found a [vulnerability in SFOS](/en/blog/sophos-sfos-sql-injection-vulnerability-fixed/) several months ago. Even further back there was the problem that with some effort the administrator password could be read from the backup files. As a result, backup encryption was also implemented.
Sophos takes this issue very seriously and has put a lot of effort into preventing this from happening again.
The planned roadmap was shifted by half a year and the first thing they took care of was the security of their system. The incidents have shown that even a firewall, which is supposed to protect against threats, is vulnerable.

> The saying "100% security does not exist" does not exist without reason. Many movies or series would be very boring if such a 100 percent security would exist. 😋

Now with v18 MR3 there is the **Secure Storage Master Key**. This key can only be created with the admin user. This does not work with another user who has administrator rights.
With the definition of this new key, important information is encrypted again.
If you want to know exactly what happens here, you can read the [Secure Storage Dokument](/assets/pdf/sophos-security-sfos-secure-storage-faq-en.pdf){:target="_blank"}.

So create a secure password and store it securely as well.

<single-image url="/blog/2020/sophos-firewall-sfos-v18-mr3-secure-storage-master-key-set-password@2x.jpg" alt="Sophos Firewall OS - Set password for Secure Storage Master Key"></single-image>



## Disable captcha
The login window of the firewall has been protected with a captcha since the above mentioned vulnerability for the UserPortal and Admin login.

<single-image url="/blog/2020/sophos-firewall-sfos-v18-admin-loginscreen@2x.jpg" alt="Sophos Firewall OS - Admin Loginscreen"></single-image>

With MR3 this bot protection can be disabled. To do this, you have to log on to the firewall over SSH and switch to the console with keyboard input '4'.

<single-image url="/blog/2020/sophos-firewall-sfos-v18-ssh-login@2x.jpg" alt="Sophos Firewall OS - SSH Login"></single-image>

Here you can activate, deactivate or display the captcha setting for the login windows with the following command.

```bash?sunburst
console> system captcha-authentication-global enable/disable/show for userportal/webadminconsole
```

<single-image url="/blog/2020/sophos-firewall-sfos-v18-ssh-disable-captcha@2x.jpg" alt="Sophos Firewall OS - Disable Captcha with SSH"></single-image>



## Device Access warnings
Like the two functions above, the Device Access warnings are also intended to provide more security.

In the menu: 'Administration > Device Access' you can define the access to the firewall services.

Here you should proceed according to the following principle: **Close everything and open consciously**. For example, by activating the checkbox at 'Ping' or 'User Portal', you allow every computer worldwide to access your firewall via ICMP or User Portal.

<single-image url="/blog/2020/sophos-firewall-sfos-v18-mr3-device-access@2x.jpg" alt="Sophos Firewall OS - Device Access"></single-image>

Of course you can change the settings as before. Now the system shows a warning message. This should make you aware of what you can open to the outside world by activating a checkbox in the WAN zone.

<single-image url="/blog/2020/sophos-firewall-sfos-v18-mr3-device-access-warning@2x.jpg" alt="Sophos Firewall OS Access Asnarök"></single-image>

It is better to define more precisely where the traffic is allowed from with the 'Local service ACL exeption rule'.
For example, select only your country for accessing the user portal or, when pinging, only those IPs that are actually allowed to reach the firewall via ICMP.


## Sophos Central Firewall Management

### High Availability Cluster view
All listeners to our podcast know that the Central Firewall Manager is a product in which I see a lot of potential. You can still see that it's under development, but with v18 MR3 a really nasty thing is fixed.

HA clusters are now no longer displayed as online and offline devices, but you can now easily see which firewalls have been configured to a cluster.

<single-image url="/blog/2020/sophos-firewall-sfos-v18-mr3-central-firewall-manager-ha-cluster@2x.jpg" alt="Sophos Firewall OS - HA Cluster with Central Firewall Manager"></single-image>

If you click with the mouse on the status display, you will be shown even more information. This shows that this device is in an active-passive cluster and that it is the Auxiliary Device.

<single-image url="/blog/2020/sophos-firewall-sfos-v18-mr3-central-firewall-manager-ha-cluster-bubble@2x.jpg" alt="Sophos Firewall OS - Central Firewall Manager HA Cluster Popup"></single-image>



### Scheduled Updates
It is now possible to schedule firmware updates via the Central Firewall Manager. UTM Admins know this from the past.

<single-image url="/blog/2020/sophos-firewall-sfos-v18-mr3-central-firewall-manager-overview-update@2x.jpg" alt="Sophos Firewall OS - Central Firewall Manager Overview Update"></single-image>

For a planned update, you can also select multiple firewalls simultaneously, which is a huge benefit in larger environments.

> Nevertheless, this feature should be used with caution. An update can also cause problems.

<single-image url="/blog/2020/sophos-firewall-sfos-v18-mr3-central-firewall-manager-schedule-update@2x.jpg" alt="Sophos Firewall OS - Central Firewall Manager Schedule Update"></single-image>

In the screenshot above you can see that there are still some updates to be installed in this environment. 😅

If a firewall is in an update process, this is signaled by an animated icon in the overview. With a click on it you get even more information.

<single-image url="/blog/2020/sophos-firewall-sfos-v18-mr3-central-firewall-manager-update-progress@2x.jpg" alt="Sophos Firewall OS - Central Firewall Manager Update Progress"></single-image>



## Other enhancements
There are more functions in this release, but I won't go into detail about them. But for completeness, I will list them:

- Sophos Connect Client: You can now add groups instead of just individual users.
- SFOS now also supports the infrastructure of Nutanix AHV and Nutanix Flow
- AWS: Support for new instances in the AWS Cloud (C5, M5 and T3)
- AWS: Support of CloudFormation Templates
- AWS: Support for Virtual WAN Zones on custom gateways

In this article you will learn everything you need to know about the update to SFOS v18 MR3 and what new features have been added.

sophos-sfos-update-new-features-in-v18-03-mr3

Sophos SFOS update - New features in v18.0.3 MR3


At least twice a year, we have a time when we stop for a moment and question our daily work steps. What can we do better, where can we optimise and what effort should we avoid in the future, as the added value is not ( or no longer) existing?

## Time for change
We are fortunate and very grateful that the pandemic has not yet harmed our business. Quite the opposite is actually the case! It has rather motivated us to make some changes to our website and clean up a bit. Recently we have [abolished the newsletter categories](/en/blog/avanet-blog-newsletter-categories-are-removed/) and we now [show stock on the product pages](/en/blog/inventory-status-for-hardware-products-introduced/). You can also expect a few more visual changes to the website this year.

## Firewall Release Notes categories removed
The next optimization point on our website concerns the **Release Notes**. There used to be two extra categories on our blog:
- SFOS Release Notes
- UTM Release Notes

When we started blogging about Sophos topics a few years ago, we felt it was an added value for our customers to be informed about new Firewall operating system updates. But now Sophos is also communicating in the Firewall backend and in their community in a very up-to-date and detailed way about new updates, so in the end it was more copy and paste for us to have this information appear on our blog. Our goal is always to publish content that is as personal and valuable as possible, which was no longer the case with the release notes. For this reason we have now removed these two categories from our blog.

> You will continue to find the latest news about the XG Firewall, SFOS or UTM in the [**Sophos Firewall**](/en/blog/sophos-firewall/) category.

If you'd like to stay informed about the release notes, please refer to the Sophos Community pages:

- [Sophos Community **SFOS Release Notes**](https://community.sophos.com/products/xg-firewall/b/blog){:target="_blank" rel="nofollow"}
- [Sophos Community **UTM Release Notes**](https://community.sophos.com/products/unified-threat-management/b/blog){:target="_blank" rel="nofollow"}


We will no longer post Firewall Release Notes on our blog. This information is available directly from the Sophos Community.

sophos-firewall-release-notes-removed-from-our-blog

Sophos Firewall release notes removed from our blog


Do you like to order from an online retailer where it is not obvious whether the desired product is in stock? Most likely not very much, right? Unfortunately, until recently we didn't have any stock on the website either, which is why we were often asked by phone.

At least for our customers from **Switzerland** and **Liechtenstein**, the stock of hardware products is now visible online on the Avanet website.

Obviously, this feature was long overdue, but we first had to adapt a few basic processes so that we could map it technically at all. But the effort was definitely worth it and the inventory is now updated several times a day on our website.

## FAQs
We have taken a step ahead and put together a small FAQ. If we should have forgotten a burning question on your part, just write us via the [contact form](/en/contact/).

- **Why is the stock not in real time?** We receive the data every two hours via CSV from our distributors. Unfortunately, we also cannot access this data in real time.
- **Why is the apparent stock level only for Switzerland and Liechtenstein?** The problem of Sophos hardware not being in stock in the required quantities only affects customers in Switzerland and Liechtenstein. All other countries we supply directly from the EU. This stock there is so large that there is hardly ever a bottleneck, and there is no need to show stock levels.


For our customers from Switzerland and Liechtenstein, the stock of hardware products is now visible online on the Avanet website.

inventory-status-for-hardware-products-introduced

Inventory status for hardware products introduced


This year we have even more major changes to our website, which we hope to be able to announce soon. Today's update is about two small adjustments to our blog, which mainly affect our existing newsletter subscribers.

## Newsletter categories are consolidated
The topics in our blog are divided into different categories. Up to now it was possible to subscribe to the different categories via newsletter, so that you are only informed about the topics you are interested in. Since a large part of the newsletter subscribers subscribed to all categories anyway, the following changes will come into effect from now on:

- You can subscribe to the newsletter in English or German, but the selection of categories is no longer possible.
- Everyone who has already subscribed to our newsletter will receive the blog posts from all categories in the future.

If you prefer to be informed only about new articles in certain categories, you will have to switch to RSS in the future. There, the categories will continue to exist individually until further notice.

## Newsletter only once a month
Previously, our newsletter subscribers were informed by email each time a new article appeared on the website. **In the future we will send you a summary of all articles of the last 30 days once a month to your mailbox**.

If you would like to continue to receive real-time updates on new articles, you can follow us on [Twitter](https://twitter.com/avanet_ch){:target="_blank" rel="nofollow"}, [LinkedIn](https://www.linkedin.com/company/avanetsecurity/){:target="_blank" rel="nofollow"} or [Facebook](https://facebook.com/avanet.ch){:target="_blank" rel="nofollow"} or subscribe to our **RSS-Feed**.



Today's announcement is about two small adjustments to our blog, which mainly affect our existing newsletter subscribers.

avanet-blog-newsletter-categories-are-removed

Avanet Blog - Newsletter categories are removed

Since a few weeks the two new REDs are available and the previous models are no longer for sale. Time to take a look at the new models and compare them.

## RED 15, RED 15w and RED 50 – End of Sale
Now that the new models are available, the old ones are no longer needed. Strictly speaking, they will not be end of sale until 31 August 2020, but as demand has risen sharply due to the pandemic, all REDs in Europe were already completely sold out and no longer available by mid-March. The delivery situation has not and will not change any more, therefore the products on our shop are also no longer available.

### Here is an overview of the old models and their successors:
- **Sophos RED 15** will be replaced by [Sophos SD-RED 20](/en/shop/sophos-sd-red-20/)
- **Sophos RED 15w** will be replaced by [Sophos SD-RED 20](/en/shop/sophos-sd-red-20/) mit [Sophos WiFi Modul](/en/shop/sophos-802-11ac-wifi-module/)
- **Sophos RED 50** will be replaced by [Sophos SD-RED 60](/en/shop/sophos-sd-red-60/)


## What exactly does the Sophos RED?
We are always happy to welcome new readers to the blog, and there are some newcomers to Sophos among them. As I think Sophos's RED is a really great product, I would like to explain very briefly what it can be used for.

If you have a Sophos Firewall in use, whether running the UTM operating system or SFOS, you can use the Sophos SD-REDs to make a VPN connection extremely easy.
For example, if you want to connect a branch office or home office to the corporate network, the RED is perfect for this. You need internet, power and someone on site who knows how to connect three cables and the VPN connection is established.
An instruction how to connect the RED can be found here: [Setting up Sophos RED](/en/kb/setting-up-sophos-red/)

The RED is so great because it is extremely simple to use and the administration is centralized on the Firewall. Our customers use the REDs, for example, to connect various systems:

- branch offices
- home offices
- offsite backup
- cameras
- cash register systems
- monitoring equipment
- building control systems (ventilation, heating, access control)
- internet TV from other countries


## What's new?
Sophos RED was fantastic even in its previous version. But what has changed with the SD RED?

### New name
Let us begin with the name **SD-RED**. Why not just RED anymore? Can the new model do more? RED stands for "Remote Ethernet Device" and the addition SD for "Software-Defined" (WAN).

As many vendors are currently talking about SD-WAN, Sophos has adopted this term in the product name. In fact, SD-RED does not have more features than the older models. The RED was already a good solution as an alternative to expensive MPLS lines.

<videoblock video-id="354926955" provider="vimeo"></videoblock>


### More performance
The RED 50 came on the market in August 2014 and the RED 15 in September 2015. In recent years, the transfer rates on the Internet and also its use have increased massively and therefore the new SD-REDs offer more throughput.

- RED 15 - 90 Mbit/s
- RED 50 - 360 Mbit/s
- SD-RED 20 - 250 Mbit/s
- SD-RED 60 - 850 Mbit/s


### More connections
Two power adapters can be connected to both the SD-RED 20 and the SD-RED 60. One is included in the scope of delivery, a second one can be bought separately, thus providing a redundant power supply.

Both models have a SFP connection. So you can choose between a copper or fiber WAN port. However, only one of both can be connected. If you want to connect two WAN connections, the SD-RED 60 offers two WAN RJ45 (WAN1 is also shared with the SFP port. It is also valid here: either RJ45 or SFPr).

The SD-REDs can also be optionally extended with modules. For this reason, there is no successor to the RED 15w, for example, because the WLAN functionality can be upgraded with a [**WiFi module**](/en/shop/sophos-802-11ac-wifi-module/) (802.11 a/b/g/n/ac Wave 1 (Wi-Fi 5) dual-band 2x2 MIMO 2 antennas). Furthermore, a [**Sophos 3G/4G module**](/en/shop/sophos-3g-4g-module/) (MC7430/MC7455 Sierra Wireless Card) and a **VDSL modem** are also available. For the latter, however, we do not yet have any information about what kind of standard it will support or when it will be available.

Like the smaller model, the SD-RED 60 has 4 LAN ports. However, in the SD-RED 60 two of these connections offer PoE with a total power of 30 watts. So instead of the WiFi model, you can also use an APX access point, which is better from a performance point of view.

### More warranty
In the past, the devices only had a one-year warranty and a second year could be purchased in addition. The new SD-RED models come with 5 years warranty, as well as the APX series of access points.

### Accessories - Rack mount
The new models are larger than the previous models. However, there is again a suitable rackmount kit, so that you can install the appliance in the rack.

- [Sophos SD-RED 20 / SD-RED 60 DIN Rail Mounting Kit](/en/shop/sophos-sd-red-20-sd-red-60-din-rail-mounting-kit/)
- [Sophos SD-RED 60 Rackmount kit with adapter holder](/en/shop/sophos-sd-red-60-rackmount-kit-with-adapter-holder/)


## Lizensierung
In order for the SD-REDs to run on a UTM or SFOS Firewall, a **Network Protection License** or a bundle containing this license is required, just like with the older models.

- Enterprise Guard
- Enterprise Guard Plus
- FullGuard
- FullGuard Plus

For the WLAN functionality, the UTM still requires Wireless Protection. This is included in the Base License for all SFOS Firewalls (XG Firewall).

## Availability
The SD-RED 20 and SD-RED 60 have been officially available since mid-April, but due to the pandemic there was no availability and we had a long list of pre-orders and customers who had to wait up to one and a half months for their RED. Meanwhile the REDs are available as usual.

## Conclusion
The new models are a great upgrade for the already excellent REDs. The performance update was absolutely necessary, because the 90 Mbit of a RED 15 are already very tight for internet speeds in 2020. The 5-year warranty and two power supplies give an additional good feeling when you buy them and ensure an all-round carefree package from Sophos. We look forward to seeing how Sophos will further improve the SD-RED in the future.

---

#### More information
- [Datasheet SD-REDs](/assets/pdf/sophos-sd-red-en.pdf){:target="_blank"}

The successors of the RED 15 and RED 50 are now available. We show what the new models offer.

new-sophos-hardware-sd-red-20-and-sd-red-60-available

New Sophos Hardware - SD-RED 20 and SD-RED 60 available

Sophos Intercept X Advanced with EDR is at the frontier of modern cybersecurity and features the strongest endpoint detection and deep learning for truly exceptional defense against suspicious activities, unknown malware, and ransomware.

With the **Version 3.0** two groundbreaking features have been implemented, which will be a great help for administrators to handle the daily requirements and challenges of IT. These new features are already available for Windows 8, 8.1, 10 and Windows Server. Support for Linux and Mac will follow later in the second quarter.

<alertmessage icon="alert">
 **Note**: You will need the Early Access Program in order to use Intercept X Advanced with EDR 3.0 and all its fantastic features. The Early Access Program is available if you have Intercept X or Intercept X for Server. If you have just enrolled to the “New Endpoint Server Protection and EDR Features” you do not have to do anything. Your devices will automatically receive the updated software.
</alertmessage>

## What’s New?
- Live Discover
- Live Response

## Live Discover
**Live Discover is the latest and crucial feature of Sophos Intercept X Advanced with EDR 3.0.**
Live Discover has the ability to ask queries about security concerns of devices. It does this by accessing and recognizing the historic activity and current running state of the device, and can get immediate responses. This could be a simple query such as ‘how long has a device been running?’ However it can also be more advanced queries e.g. recognizing the differences in network communications and standard deviations with the device over the previous 30 days in search of anomalies. To accomplish this access will be obtained directly from Sophos Central. You will be able to take advantage of the API to ask those questions and choose the device you want to ask. Through this method, you are able to look at threats that may be encountered later, and any expected malware.

### How does it work…?
Live Discovery allows administrators to search their data so that they can answer almost any question they may find using SQL at the endpoints and servers. You can pick from a selection of pre-prepared questions that can be completely customized to capture the exact information that you require. This can help answer threat hunting and IT operational queries such as:

- How’s the performance of the device?
- Why is the device running slowly?
- Is there a remote sharing option available?
- What is the patch level of the device?
- What hardware and operating system details are available according to the device?
- What are all the files and registry keys? Have these been modified when it ran 10 days ago?

Besides editing an existing query, you also have the possibility to create your own SQL queries and save them in a category. There are numerous categories available in Live Discover. You can see these categories from the picture below:

<single-image url="/blog/2020/threat-analysis-center-live-discover-categories@2x.png" alt="Threat Analysis Center - Live Discover Categories"></single-image>

<alertmessage icon="alert">
 **Note**: You can find additional support in the Sophos Community and [share your own queries](https://community.sophos.com/products/intercept/early-access-program/f/live-discover-queries){:target="_blank" rel="nofollow"}. You will need a **Sophos ID** for access.
</alertmessage>
 

To start a query, you first select the devices from which you need certain information. For example, in the screenshot below you can see the result of a query of various operating system details:

<single-image url="/blog/2020/threat-analysis-center-live-discover-operating-system-details-query@2x.png" alt="Threat Analysis Center - Live Discover - Operating System Details Query"></single-image>

In response to this request, Live Discover will present you, for all selected devices, the host name, the name of the CPU manufacturer, the operating system and OS version and much more. The statistics and data are processed on each individual device that you selected before the query and then transferred to Central. For example, if you send a query to 10,000 devices, the load will be distributed across all these devices, which means that the load on a single device is minimal.

### How the new features of ‘Live Discover’ will help you with your IT operations…
- It allows you to select your desired device for a query
- It provides advance threat hunting
- It helps with forensic investigation
- It provides SQL queries for improved details
- It can provide your present and historical data for up to 90 days.
- It scales to thousands of devices
- It contains details about patches, OS versions, video, and disk information
- It has access to system events
- It has information about any current and historic running process.
- It provides access to see changes in the registry
- It provides information about user authentications

## Live Response
**Live Response is another incredible feature of Sophos Intercept X EDR 3.0 that you are bound to love.**
What’s the most amazing thing about this feature? Live Response allows admins to link directly via remote access to any device in the environment from anywhere in the world. This does not mean a direct remote session with an image, but it provides safe access to a command-line interface, which you can control via Sophos Central in your browser. Sophos Central acts as a terminal to control the device you want to use. This gives you the ability to conduct detailed and security-related investigations on a device or to react to a threat in real time.

### How does it work…?
Before initiating the Live Response session, you need to enable the global setting from Sophos Central. It's worth highlighting that the global settings page can only be modified by admins who have the super admin privileges. Super admins must also be authenticated to Sophos Central using MFA.

<single-image url="/blog/2020/global-settings-live-response@2x.png" alt="Global Settings - Live Response"></single-image>

Once Live Response is enabled in the global settings, you can start a shell as Super-Admin for each computer or server you manage in Central. You can now use any commands that you could physically run directly on the machine. For example, "iponfig" to check the IP address of the selected device, or the "reg" command to display, change or delete the registry keys. You can also browse, view or delete files.

<single-image url="/blog/2020/live-response-terminal@2x.png" alt="Live Response - Terminal"></single-image>

<alertmessage icon="alert">
 **Note**: Currently only Windows computers or Windows servers are supported. Linux and Mac support will follow later.
</alertmessage>

Sophos Central provides a secure and safe connection to the device. No extra ports need to be kept open. As mentioned at the beginning, administrators will need to carry out two-factor authentication to have access to this function. In addition, every live response connection is recorded in the audit log and it is always possible to trace when a session was started and stopped.

### Live Response can provide the following facilities to the Admins:
- Remote access and management of your desired device from anywhere in the world.
- The ability to reboot a device awaiting updates.
- Editing of the registry keys.
- Ability to browse files.
- Ability to delete files.
- Ability to run programs and scripts.
- Assisting in detecting and neutralizing any suspicious activity.
- Check all the running operations and terminate any of them.
- Installation or uninstallation of software
- Running forensic tools
- Providing full system-level access

---

## Try Sophos Intercept X with EDR 3.0 now!
To experience **Live Discover** and **Live Response** for yourself, simply join the EAP (Early Access Program) ‘**New Endpoint Server Protection and EDR Features**’. You need at least one valid license for **Intercept X** or **Intercept X Advanced for Server**.

If you do not already have a Sophos Central Account, you can sign up [on the Sophos website](https://secure2.sophos.com/de-de/lp/sophos-central/free-trial.aspx?id=0013000001EjyeY){:target="_blank" rel="nofollow"} to create one and test all features, including ‘Sophos Intercept X with EDR 3.0’, **free for 30 days**.

If you have a Sophos Central account and the 30-day trial has already expired, you can order either a ‘Sophos Intercept X’ or ‘Intercept X Advanced for Server’ license via our website and then benefit from the EAP:

- [**Buy Sophos Incercept X now**](/en/shop/sophos-central-intercept-x/)
- [**Buy Sophos Incercept X Advanced for Server now**](/en/shop/sophos-central-intercept-x-advanced-for-server/)

Sophos Intercept X with EDR has received a powerful update to version 3. Both Live Discover and Live Response are available on EAP.

powerful-new-features-in-intercept-x-advanced-with-edr-3-0

Powerful New Features in Intercept X Advanced with EDR 3.0

A security issue has been reported in the Sophos Firewall OS, which has been actively exploited. Sophos has already distributed the hotfix, however firewall administrators have to change all local passwords.

## What happened?
Admittedly, it is a bit confusing for the normal user if a firewall, which should protect the IT infrastructure, is itself insecure. In fact, every device that runs software has security holes. Often these have simply not yet been found.

A zero-day vulnerability was reported to Sophos by a user at 20:29 on 22 April 2020. The attack had been running for 5 hours at that time. The user noticed it because it was visible in the Admin Portal. The report to Sophos about this vulnerability was made at 10pm when the first domains were blocked. At the same time the root cause was identified and work was being developed to find a solution. On 25 April 2020 at 07:00, 63 hours after the first attacks, a hotfix was distributed to all SFOS firewalls.

This security hole made it possible for attackers over the Internet to access all local user names with the password hashes. In the worst case, someone could have gained access to the firewall. However, the password hash had to be reconstructed first. This incident again shows that it is essential to use complex, long and secure passwords!

## Who's affected?
All systems on which Sophos Firewall OS (SFOS) has been installed. These can be SG appliances, XG firewalls or VMs. These systems are compromised, but this does not mean that you have been hacked. The firewalls at risk were those that were accessible from the internet via the HTTPS Admin Service or the User Portal (see the screenshot below).
If an admin has changed the default setting so that a firewall service such as SSL-VPN listens on the same port as the two portals, this firewall is also affected.

## What needs to be done?
The Trojan named Asnarök exploited a previously unknown (zero-day) pre-Auth SQL injection vulnerability. Sophos recommends changing all local passwords on the firewall. This means the **Admin** password and all other passwords of users created on the firewall itself. Users that are loaded onto the firewall from e.g. an ActiveDirctory are not affected.

1. change admin password (superadmin password of the firewall)
2. restart the firewall
3. change all other local passwords

> For customers with a maintenance contract, we have already ensured that all necessary steps have been taken.

<single-image url="/blog/2020/sophos-firewall-sfos-firewall-access-asnarok@2x.jpg" alt="Sophos Firewall OS Access Asnarök"></single-image>

- On the screenshot you can see which checkboxes should not be activated. This opens the access from the Internet to the firewall.
- Below you can define manual rules, so that access to the firewall is only possible from one IP, which makes access much more secure.
- At the bottom, you can see where the admin password has to be changed.

### Hotfix
Sophos has rolled out the hotfix, which closes the exploit, via Autoupdate. The auto-update feature is enabled by default.

<single-image url="/blog/2020/sophos-firewall-sfos-firewall-hotifx-asnarok@2x.jpg" alt="Sophos Firewall OS Hotfix Asnarök"></single-image>

All firewalls with SFOS 17.x or higher have received the patch. If your firewall is still running with version 15 or 16, it is also affected and must be updated.

## More information
Those of you who read our blog frequently will know that all we spend the whole day focusing on Sophos products, services and support. Although, as the saying goes, you should never bite the hand that feeds you, we try hard not to see everything through rose-coloured glasses. We always write what we think and that can of course be critical words. So without trying to make things pretty, as always an honest feedback:

> Sophos has, in our view, provided very fast and transparent information here. Many other vendors often keep a very low profile and you never really know what's happening.

Sophos, on the other hand, informed the community within a very short time with a KB and blog post, and we, as a Sophos partner, also received an email on Sunday (even in 8 times). This means that the information was first published by the manufacturer itself and not by news sites, which is not the norm.

In the Knowledge Base you get all the information about what exactly happened and how to proceed. Here in the blog are only the most important information, which many should already be enough.

- [Fixing SQL injection vulnerability and malicious code execution in XG Firewall/SFOS](https://support.sophos.com/support/s/article/KB-000039388?language=en_US){:target="_blank"}
- [“Asnarök” Trojan targets firewalls](https://news.sophos.com/en-us/2020/04/26/asnarok/){:target="_blank"}

Am 22. April 2020 wurde im Sophos Firewall OS eine Sicherheitslücke entdeckt. Diese hat Sophos innerhalb von 63 Stunden mit einem Hotfix behoben.

sophos-sfos-sql-injection-vulnerability-fixed

Sophos SFOS SQL injection vulnerability fixed

Sophos has released version 17.5 MR11 for the Sophos Firewall OS (SFOS).

<alertmessage icon="alert">
 **Note**: For more information on upgrading, please take a look at the following post: [SFOS Firmware auf Sophos Firewall aktualisieren](/en/kb/upgrading-sfos-firmware-on-a-sophos-firewall/).
</alertmessage>

This version is for those who cannot upgrade to SFOS v18 with their appliance. So more precisely, this concerns the **XG 85** and **SG/XG 105** devices that no longer support the new SFOS v18.

## Sophos Connect supports more IP addresses
The coronavirus forces companies in various industries to make their corporate infrastructure accessible to home offices. The Sophos Connect Client is ideal for a secure connection. However, many businesses require more than the 255 IPs supported to date. SFOS 17.5 MR11 removes this limitation.

## New REDs
With this update your firewall also supports the new **SD-REDs**, which you can already pre-order in our shop:
- [Sophos SD-RED 20](/en/shop/sophos-sd-red-20/)
- [Sophos SD-RED 60](/en/shop/sophos-sd-red-60/)

## Issues Resolved
- NC-48116 [Authentication] Importing users via csv file with special character in password fails
- NC-54642 [Authentication] Authentication not working due to high CPU utilization of access_server
- NC-55265 [Authentication] Not able to see entire IP address details for Live users on XG GUI
- NC-49765 [Clientless Access] Clientless SMB Bookmark - Unable to upload files in a folder or share with a comma
- NC-52709 [IPS Engine] IPS signature shown as detect with rule association 0 when set as DROP
- NC-57067 [IPsec] Sophos Connect lease is not supporting more than 255 IP addresses in address range
- NC-51862 [Logging Framework] Incorrect value received in gateway graph for PPPoE interface
- NC-50796 [RED] All RED site to site tunnel restart when configuring one RED interface
- NC-57800 [Reporting] Application summary in reports does not show any records
- NC-46009 [SecurityHeartbeat] Spontaneous reconnects of many endpoints
- NC-51562 [SecurityHeartbeat] Heartbeat service not started after HA failover

Sophos has released SFOS v17.5 MR11. You can now download the new firmware from the MySophos portal.

sophos-sfos-update-v17-5-mr11-released

Sophos Firewall OS (SFOS) Update v17.5 - MR11 released


Sophos has released version 18.0 GA Build 354 of SFOS. This version will be available in small stages. In first stage you can download it at the [MySophos portal](https://www.sophos.com/en-us/mysophos){:target="_blank" rel="nofollow"}.

We have already introduced all new features in detail in a separate article: [Sophos SFOS v18: New features at a glance](/en/blog/sophos-sfos-v18-new-features-at-a-glance/)

This update is for those who wish to upgrade from version 17.5 MR10 to v18.0 GA-Build354

## Issues Resolved
- NC-57067 - [IPSec VPN] - Sophos Connect lease now supports more than 255 IP addresses in address range (NC-57067)
- (NC-57910) [System] Fixed: Issues related to upgrade from v17.5 MRx to v18.0 GA
- NC-56732 [SSLVPN] Fixed: kernel panic issue related to SSLVPN tunnels

---

### More information
- [Whats new in v18](/assets/pdf/sophos-xg-firewall-whats-new-in-v18-en.pdf){:target="_blank"}


Sophos has released SFOS v18.0 GA Build 354. You can now download the new firmware from the MySophos portal.

sophos-xg-update-v18-ga-build354-veroeffentlicht

Sophos XG Update v18.0 GA - Build 354 released

Sophos has released version 18.0 GA Build 339 of SFOS. This version will be available in small stages. In first stage you can download it at the [MySophos portal](https://www.sophos.com/en-us/mysophos){:target="_blank" rel="nofollow"}.

We have already introduced all new features in detail in a separate article: [Sophos SFOS v18: New features at a glance](/en/blog/sophos-sfos-v18-new-features-at-a-glance/)

This update is for those who wish to upgrade from version 17.5 MR10 to v18.0 GA-Build339

## Activate/deactivate SSL/TLS
The new build offers the possibility to activate/deactivate SSL/TLS inspection rules independently via a new toggle. This small but nice toggle is for customers upgrading from SFOS version 17.5. By default the new feature is disabled to avoid possible errors during the upgrade. So customers who want to use the new DPI engine have to activate the new feature.

<single-image url="/blog/2020/sophos-firewall-sfos-v18-ssl-tls-inspection-toggle@2x.jpg" alt="Sophos SFOS v18 SSL/TLS toggle"></single-image>

By enabling SSL/TLS inspection, the following features are enabled:

- All traffic is checked to determine if it is SSL/TLS traffic.
- The configured SSL/TLS rules are applied.
- The traffic is decrypted by the DPI engines, which also makes the web policies work.
- In the dashboard, the corresponding widget is activated and the values are updated.

## Issues Resolved
- NNC-54339 [Config Migration Framework] v17.5 MR-10 to v18.0 GA migration support
- NC-56550 [Policy Routing] SD-WAN policy routing screen smudge with blue strip
- NC-56201 [RED] Backup/Restore failed from v17.5 MR to v18 with specific RED configuration
- NC-56397 [Web] User getting certificate error

---

### More information
- [Whats new in v18](/assets/pdf/sophos-xg-firewall-whats-new-in-v18-en.pdf){:target="_blank"}

Sophos has released SFOS v18.0 GA Build 339. You can now download the new firmware from the MySophos portal.

sophos-xg-update-v18-ga-build339-veroeffentlicht

Sophos XG Update v18.0 GA - Build 339 released

Over the past two months, Sophos has released a few new features for the Central platform, which I will summarise briefly here. However, I will start this article by mentioning that support for Windows 7 and Server 2008 R2 will end soon.

## Support for Windows 7 and Windows Server 2008 R2 will end soon
For both **Windows 7** and **Windows Server 2008 R2**, Microsoft has finally stopped support on 14 January 2020. As a result, Sophos also will not support these two operating systems for much longer. The default support officially ends on **31 December 2021**.

**Windows 7**
- End of standard support: 31 December 2021
- End of the extended support: 31 March 2025

**Windows Server 2008 R2**
- End of standard support: 31 December 2021
- End of the extended support: 31 March 2025

<alertmessage icon="info">
 **Info**: Windows Server 2008 support will end on July 31, 2020.
</alertmessage>

### Getting an extended support
Sophos is offering **extended support** to customers for whom 31 December 2021 is not sufficient to replace existing hardware. You will need to purchase an extra license to allow Sophos to grant you a grace period until 31 March 2025 for the following products:

- Intercept X Advanced/Intercept X Advanced with EDR
- Intercept X Advanced for Server/Intercept X Advanced for Server with EDR
- Central Endpoint Protection/Central Server Protection
- Endpoint Protection Standard/Endpoint Protection Advanced
- Server Protection for Virtualization, Windows und Linux/Server Protection Enterprise

If you are interested in such an extended support, just write us via [contact form](/en/contact/). We will then gladly make you an appropriate offer.

## Sophos Intercept X Enhanced Protection (beta) now available for servers
In October 2019, Sophos has already launched a beta program for **Intercept X Enhanced Protection**. The aim of this program is to further enhance Intercept X and provide new features to combat the latest malware. In 2020 ransomware attacks will continue and terms like EMOTET will be on everyone's lips. Sophos continues to work hard to ensure that customers can keep feeling secure with **Intercept X technology**.

In the first version, the **Intercept X Enhanced Protection** already included the two features **Anti-Malware Scanning Interface** (AMSI) and **Intrusion Prevention System** (IPS). We have already talked about this in the [twelfth episode of our podcast](/blog/podcast-sophos-news-11-2019/).

In December 2019 new and very important protection mechanisms for Windows systems were added, which are now also available for Windows servers as of version 2008 R2:

### Protect from Encrypting File System attacks (EFS Guard)
Since Windows 2000, Microsoft has integrated a function called **EFS** (Encrypting File System) into its operating system. Not to be confused with BitLocker, which can encrypt an entire hard disk, EFS is used to encrypt certain files and folders.

Attackers have found a way to abuse this function and encrypt their victims' data right away using the APIs of the native encryption function (EFS). The beauty of the whole thing is that they don't have to download their own malware to do it. With **EFS Guard**, Intercept X can now protect against such attacks.

<single-image url="/blog/2020/sophos-central-threat-protection-protect-from-encrypting-file-system-attacks@2x.jpg" alt="Protect from Encrypting File System attacks (EFS Guard)"></single-image>

### Dynamic Shellcode Protection
The inventors of new malware are increasingly using so-called "stagers". These are small and innocent programs that download malware into temporary memory and execute it. As a result, they are hardly detected by traditional Anti-Malware applications.
By analyzing the behavior of applications, dynamic shellcode protection can protect against exactly such Malware. If a behavior similar to staging is detected, the detection kicks in immediately and stops the application.

<single-image url="/blog/2020/sophos-central-threat-protection-dynamic-shellcode-protection@2x.jpg" alt="Dynamic Shellcode Protection"></single-image>

### Validate CTF Protocol Caller (CTF Guard)
CTF is a vulnerability in a Windows component that exists since Windows XP. This vulnerability allows an unauthorized attacker to control any Windows process, including applications running in a sandbox. To prevent the CTF protocol from being exploited, the Sophos Threat Mitigation team has developed **CTF Guard** and added it to the Threat Protection policy.

<single-image url="/blog/2020/sophos-central-threat-protection-validate-ctf-protocol-caller@2x.jpg" alt="Validate CTF Protocol Caller (CTF Guard)"></single-image>

### Prevent side loading of insecure modules (ApiSetGuard)
The function **ApiSetGuard** prevents applications from loading a malicious DLL which pretends to be an ApiSet Stub-DLL.
ApiSet Stub DLLs are DLLs that help a program to be compatible with newer Windows versions. Attackers can place malicious ApiSet Stub DLLs on a system to manipulate functions. For example, the Sophos tamper protection could be leveraged to terminate the Sophos client.

<single-image url="/blog/2020/sophos-central-threat-protection-prevent-side-loading-of-insecure-modules@2x.png" alt="Prevent side loading of insecure modules (ApiSetGuard)"></single-image>

## Email DKIM signing
Those who use Sophos Central Email to scan their inbound and outbound traffic can now add a DKIM signature to their email. To set this up, you will need to go to the "Settings" section of Central Email and select "Domain Settings / Status". If you now click on a domain that also scans outbound traffic, you will find the option to create a new DKIM key below the summary. After that you will see a short tutorial with all necessary information to set up the DKIM key.

<single-image url="/blog/2020/sophos-central-email-gateway-domain-details@2x.jpg" alt="Sophos Central Email Gateway - Email DKIM signing"></single-image>



## Customizable email address for Phish Threat Training
Sophos Centrla Phish Threat is actually designed to train company employees to detect phishing emails. In the past, it was not really trusted when the automated training and registration emails were sent from "Sophos <training@staysafe.sophos.com>". Some anxious employees may have wondered whether they should click on the link in the email. 😅
Sophos has now responded by offering the option to add your own domain to **catch emails**, **reminder emails** and **registration emails** sent to your end users.

To do this, simply go to Phish Threat's "Settings" and select the menu item "Training Reminder and Enrollment Emails". There you can now activate and confirm a custom email address. In my tests the verification email, as well as the following test email, ended up in the spam folder. 🙄
By the way, these settings are applied to the Central Account and cannot be set individually per campaign.

<single-image url="/blog/2020/sophos-central-phish-threat-automated-emails@2x.jpg" alt="Customizable email address for Phish Threat Training"></single-image>

Intercept X Enhanced Protection is available in a beta for servers. In addition, Central Email can now send outgoing messages with DKIM signing.

sophos-central-update-enhanced-protection-for-server-and-more

Sophos Central Update - Enhanced Protection for Server and more

Sophos has released version 18.0 GA for the Sophos Firewall OS (SFOS). The new firmware can now be downloaded from the [MySophos Portal](https://www.sophos.com/en-us/mysophos){:target="_blank" rel="nofollow"}.

We have already introduced all new features in detail in a separate article: [Sophos SFOS v18: New features at a glance](/en/blog/sophos-sfos-v18-new-features-at-a-glance/)

In the next days the new firmware will also be available automatically via the WebAdmin of the firewall and can be installed with a simple click.*

<videoblock video-id="388070618" provider="vimeo"></videoblock>

<alertmessage icon="alert">
 **Note**: For more information on upgrading, please take a look at the following post: [SFOS Firmware auf Sophos Firewall aktualisieren](/en/kb/upgrading-sfos-firmware-on-a-sophos-firewall/).
</alertmessage>

<alertmessage icon="alert">
 **Note**: This update to v18 is not available for every hardware model. You can find out which Firewall Appliances are compatible in the following blog post: [Sophos Firewall Appliances - supported hardware for SFOS v18+](/en/blog/sophos-firewall-appliances-supported-hardware-for-sfos-v18-plus/).
</alertmessage>

*_Only those who have paid for Sophos Enhanced Support can benefit from this more convenient option. Sophos Enhanced Support is automatically included with each bundle (EnterpriseProtect, EnterpriseGuard, TotalProtect, FullGuard) or can be purchased separately._

## Issues Resolved
- NC-33664 [App Signature] Unable to block Psiphon
- NC-42675 [Authentication] access_server returns 'Login Failed' if two awarrenhttp threads call in at same time
- NC-44686 [Authentication] Import/export of AUTHCTA has missing and incorrect values
- NC-48116 [Authentication] Importing users via csv file with special character in password fails
- NC-50521 [Authentication] User group assignment issue with LDAP users
- NC-54642 [Authentication] Authentication not working due to high CPU utilization of access_server
- NC-50136 [Backup-Restore] ISP failover for 2 PPPoE connections is not working for local LAN systems
- NC-51979 [Backup-Restore] Can't reflect time zone from restoring backup file after factory resetting
- NC-32336 [Base System (deprecated)] gpg vulnerability (CVE-2018-12020)
- NC-42490 [Base System (deprecated)] Validation function for legacy objects does not get called
- NC-55640 [Bridge] Firewall rule id not matching if traffic is going into wifi interface
- NC-45935 [Certificates] Fingerprint not updated on Default CA regenerate event
- NC-49023 [Certificates] Webproxy signing with non default certificate when using HTTPS Scanning
- NC-54562 [Certificates] CAs are missing after update from v18 EAP2 to EAP3
- NC-29869 [Clientless Access(HTTP/HTTPS)] "Internal Server Error" after adding many VPN bookmarks
- NC-48516 [Config Migration Framework] Configuration migration log on console is wrong in case of failed migration
- NC-55270 [Config Migration Framework] Report migration failed
- NC-49648 [CSC] API Get BridgePair requests sometimes report incorrectly "No. of records Zero."
- NC-52857 [CSC] One time scheduler doesn't work as expected in case of DST
- NC-51717 [DDNS, Email] DDNS uses wrong IP when interface is configured with PPPoE + Alias
- NC-38763 [DHCP] IP not leased to DHCP only interface when update from stateless
- NC-38795 [DHCP] IPv6 not removed from DB while disable DHCPv6 manage flags from RA server
- NC-38930 [DHCP] Editing DHCPv6 interface with auto configuration does not get IP from DHCPv6 server
- NC-39157 [DHCP] DHCPv6 client option "Accept other configuration from DHCP" is not working
- NC-50214 [DHCP] DHCP server dead with specific configuration
- NC-51957 [Documentation] Showing fastpath load failed with command "console> system firewall-acceleration show"
- NC-48712 [Email] Antivirus service in stopped state, cannot recover it
- NC-51340 [Email] Mailscanner child process causing OOM events when editing blocked senders list
- NC-51347 [Email] Error message "undefined" received when trying to add host
- NC-51883 [Email] API error 599 when performing GetRequest for various email modules
- NC-52212 [Email] Reject/Drop action not work correctly for oversized mails
- NC-53016 [Email] Email Blocked Senders cannot be updated
- NC-55138 [Email] SAVI AV update failed
- NC-22659 [Firewall] IPtable chains not created for firewall rule whose name contains blackslash '\\\\\'
- NC-30482 [Firewall] DNAT rules stop working after every reboot when migrating from UTM to SFOS
- NC-36616 [Firewall] Firewall group not available in APIhelpdoc
- NC-37775 [Firewall] Configuring over 20 time schedulers on the various firewall rules is causing CSC freeze
- NC-43017 [Firewall] Full config export does not include Security Policy group
- NC-43415 [Firewall] In the firewall rule, types of services are not translated
- NC-48803 [Firewall] Virtual Host update is calling on every FQDN IP update even its not used in virtual host configuration
- NC-49101 [Firewall] Group description delete issue in firewall
- NC-49678 [Firewall] Default ICMP service not matching in policy test tool
- NC-50222 [Firewall] Firewall rule position display is incorrect on rule deletion
- NC-50549 [Firewall] Drop packet does not show all the information for firewall rule ID 0 drop compare to v17.5
- NC-50712 [Firewall] NAT rules UI error
- NC-50949 [Firewall] Wrong ARP behavior in relation to DNAT rules
- NC-51867 [Firewall] Denied firewall logs send to garner for allowed firewall rule even if logging is disabled
- NC-51964 [Firewall] DNAT rule stopped working after every reboot
- NC-52395 [Firewall] Getting wrong username in admin event for firewall rule group name update
- NC-52429 [Firewall] Web access lost for 10+ minutes after HA fail-over
- NC-52638 [Firewall] WAF is not able to connect to webserver via IPsec tunnel
- NC-52662 [Firewall] Continuous receiving 'fw_fp_invalidate_microflows:459: Queueing invalidate work ffff8801ed1bb5c0' error in syslog
- NC-52853 [Firewall] Observed feedback channel plugin of garner core dump on XG330
- NC-52873 [Firewall] Kernel warning message 'RIP: 0010:tcp_send_loss_probe+0x13f/0x1c0' observed in syslog
- NC-53364 [Firewall] Firewall rules are not getting created correctly using XML API
- NC-53988 [Firewall] Kernel panic on XG450 appliance
- NC-54038 [Firewall] Wrong notification message displayed after disabling firewall rule
- NC-55261 [Firewall] Appliance crashing with Kernel Panic
- NC-55789 [Firewall] Ipuser ipset dumps when user is authenticated via STAS
- NC-47482 [Firmware Management] Firmware mismatch issue - both firmware slots showing same firmware
- NC-52441 [Firmware Management] Some time firmware 'install' opcode getting timeout and installation failed
- NC-38800 [HA] Incorrect error message when configure HA A-A with DHCP interface
- NC-39015 [HA] Unable to configure peer administration port for HA A-P when one of IP family of the interface is Dynamic IP assignment
- NC-30485 [Import-Export Framework] Export full configuration some time fails with error - 'The request could not be completed'
- NC-39229 [Interface Management] XG unsynced with SFM when unbind any interface from SFM
- NC-46514 [Interface Management] Cyberoam backup restore fails when DHCPv6 interface configured
- NC-48450 [Interface Management] Table for interface widget is not visible in control center page
- NC-49938 [Interface Management] Some time traffic drop in bridge mode
- NC-48956 [IPS Engine] Modify IPS TCP Anomaly Detection setting to disabled in default setting
- NC-53875 [IPS Engine] IPS keeps getting started because of page allocation failure
- NC-51568 [IPS-DAQ] Coredump in snort
- NC-52085 [IPS-DAQ] Wget not working for IPv6 sites in bridge mode - SSL decrypt not working
- NC-53363 [IPS-DAQ] Internet traffic hang and all traffic dropped
- NC-52641 [IPS-DAQ-NSE] IPS Service DEAD
- NC-54310 [IPS-DAQ-NSE] CC terminals not establish a connection with server
- NC-29370 [IPsec] Tunnel is getting established even though PFS is disabled on the VPN client side and enabled in SFOS IPsec profile
- NC-49919 [IPsec] Dgd service stopped and unable to start
- NC-33848 [LAG] LAG advanced options not working when LAG is member of Bridge
- NC-40683 [LAG] LAG active mode import-export is not working
- NC-52090 [Logging] LogViewer: "Action is not Allowed" filtering not working in detailed view
- NC-52762 [Logging] LogViewer: system mentioned in upper case
- NC-46114 [Logging Framework] Improper input validation and email notification after failed login (Webadmin, SSH, ...)
- NC-50127 [Logging Framework] Garner coredump in HA setup at handle_sync_input
- NC-51942 [Logging Framework] Policy Test Tool not working if firewall rule created with destination network as country or country group
- NC-37839 [nSXLd] Proxy authentication is not cleared after config reload
- NC-37841 [nSXLd] Keywords are not deleted when custom web category is deleted
- NC-54525 [RED] S2S RED tunnel doesn't established on SFOS after EAP2 to EAP3 upgrade
- NC-28022 [Reporting] Incomplete field names on data anonymization page
- NC-42864 [Reporting] Reports downloaded in PDF format have logo too close to the first line in most pages
- NC-43183 [Reporting] When data anonymization is enabled, scheduled reports are showing "Not available" instead of anonymized string
- NC-45154 [Reporting] Cannot specify hour and minute properly in Detailed Custom Reports
- NC-45236 [Reporting] Reports sent 1 hour later than scheduled
- NC-46178 [Reporting] "Web Risks & Usage Visibility" not showing any data
- NC-49273 [Reporting] Filtering on blocked user activities not working as expected
- NC-52120 [Reporting] Daily Reports are received but it delayed by different time
- NC-52125 [Reporting] UTQ user data is empty in SAR report but populated in GUI dashboard report
- NC-53072 [Reporting] Events reports (Admin, Authentication and System) are not generating due to db query for insert query getting failed
- NC-53369 [Reporting] Application Categories shown as "Unclassified"
- NC-54177 [Reporting] UTQ not generating due to change in web categories names
- NC-48718 [Service Object] Unable to edit service object that is assigned to a firewall rule
- NC-47585 [SFM-SCFM] Backedup 'central reporting' config is not maintained after Restoring config
- NC-53043 [SNMP] Wrong data is displayed in SNMP query for CPU usage
- NC-47348 [SSLVPN] LogViewer logs are not generated for ssl vpn connection up or down events
- NC-55228 [SSLVPN] Site2site - SSLVPN client in HA is not initiating connection after active node shut down
- NC-54150 [Static Routing] Data insertion is failing if large number of connections are present and Live Connection page is loaded
- NC-54314 [Static Routing] Negative value is displayed in upstream/downstream bandwidth column
- NC-51673 [UI Framework] User portal redirect loop when using non-standard port
- NC-55193 [VFP-Firewall] Port self test reboots appliance - V18 fastpath
- NC-23045 [WAF] WAF - Increase default TLS version to v1.2
- NC-51952 [WAF] WAF firewall rule update failed after migration from 17.5 MR8 to 18.0 EAP1
- NC-55034 [WAF] Web server timeout of 0 leads to syntax error in reverseproxy.conf
- NC-51156 [Web] Dynamic app filter rules which do not contain any applications is enforced for all applications in WIS
- NC-53402 [Web] Appliance auto reboot due to OOM (out of memory)
- NC-53709 [Web] Tiktok video not working with plain firewall rule with SSL/TLS enabled
- NC-54421 [Web] SSLx Exception based on SAC does not work
- NC-44346 [WWAN] Celullar WAN does not takeover again on failover

---

### More information
- [Whats new in v18](/assets/pdf/sophos-xg-firewall-whats-new-in-v18-en.pdf){:target="_blank"}

Sophos has released SFOS v18.0 GA. You can now download the new firmware from the MySophos portal.

sophos-xg-update-v18-ga-released

Sophos XG Update v18.0 - GA released

<alertmessage icon="info" >
 **Update February 2021**: The information in this blogpost is unfortunately no longer correct. Sophos has revoked their original decision to exclude older firewall revisions from current firmware updates almost a year later. All SG Firewalls with SFOS or XG Firewalls will receive version 18.5. As for newer versions, such as SFOS v19 (expected to arrive Q2 2022), it is not yet clear whether these can be installed on the older firewalls.
</alertmessage>

Sophos has published a list of hardware models which will be able to run SFOS v18.0 and SFOS v18.5 in the future. Check here to see if your hardware will be compatible.

## 2020 will be the clean up year
The still new year has started with two new End of Sale announcements.

- The [AP series of Sophos access points](/en/blog/end-of-sale-indoor-access-points-der-ap-serie-gehen-in-rente/) will no longer be sold after **31 March 2020**.
- [Sophos Central Wireless licenses](/en/blog/end-of-sale-indoor-access-points-der-ap-serie-gehen-in-rente/) for AP15, AP55 and AP100 will also no longer be sold after **31 March 2020**.
- Since August 2019, the [Sophos XG 85(w) and XG 105(w)](/en/blog/sophos-xg-85-and-xg-105-end-of-sale/) are also no longer sold due to poor performance.

Of course, Sophos has a successor for each of these devices, but depending on how many devices you have, you need to budget accordingly. That's why we're now looking a bit into the future, as older Firewall models will no longer support the new firmware from SFOS.

## SFOS Hardware Support

### v18
In order to use the new release [SFOS v18.0](/en/blog/sophos-sfos-v18-new-features-at-a-glance/) you will need an SG or XG Firewall with at least 4GB of RAM. All other models are supported.

> Yeah, you read it right. The SG models can also be installed with the "new" Sophos Firewall OS. In the KB post [Install Sophos XG Firewall OS on a SG Appliance](/en/kb/install-sophos-xg-firewall-os-on-a-sg-appliance/) we explain how this works. If you need help, our support team will be happy to help you.

It is especially annoying, as mentioned, for SG/XG customers with an 85 or 105 model of revision 3. These [desktop models have been completely revised in April 2018](/en/blog/sophos-firewall-rev-3-sg-xg-85-135-completely-revised/) and two years later they can no longer have the latest OS from SFOS.

If you run the Firewall virtually, you get a [free upgrade from 1CPU 2GB RAM to 1CPU 4GB RAM](/en/blog/free-upgrade-sophos-sw-virtual-1cpu-4gb-ram/).

### v18.5+
But if we now look further into the future, there is a bigger cut of old hardware. It is essential to have the latest hardware version.
With the rack models, the cycle is a bit longer than with the desktop models. If you now have the latest version, which is [released in Septembeer 2017](/en/blog/sophos-firewall-rev-2-sg-xg-hardware-with-more-power/), you are also on the safe side with SFOS 18.5. On all older models this release cannot be installed anymore and one remains with the firmware or the state of functionality.

### Compatibility table

#### Sophos XG Appliances

<single-image url="/blog/2020/sophos-firewall-appliance-compatibility-v18-v18-5-xg-new@2x.jpg" alt="Compatibility table for the new XG models"></single-image>

<single-image url="/blog/2020/sophos-firewall-appliance-compatibility-v18-v18-5-xg-old@2x.jpg" alt="Compatibility table for the old XG models"></single-image>

#### Sophos SG Appliances with SFOS
<single-image url="/blog/2020/sophos-firewall-appliance-compatibility-v18-v18-5-sg-new@2x.jpg" alt="Compatibility table for the new SG models"></single-image>

<single-image url="/blog/2020/sophos-firewall-appliance-compatibility-v18-v18-5-sg-old@2x.jpg" alt="Compatibility table for the old SG models"></single-image>

### Do I need to buy new hardware?
As I said, it's just a preview so you know what upcoming firmware releases could mean for your hardware. This is not immediately a reason to buy new hardware. The hardware will continue to work and get security updates, but it will not get any new features. Sure, new features often bring more security, but that's something you have to decide for yourself. From my point of view new is always better.

If you want to switch to current hardware, you get the new Firewall at half price for renewing a 1-year, 2-year or 3-year license (FullGuard, FullGuard Plus, EnterpriseGuard or EnterpriseGuard Plus). You can always find all the latest offers from Sophos on our [promo page](https://www.avanet.com/en/shop/promotions/). Owners of an XG 85 or XG 105 will need to purchase at least a 2-year license to take advantage of this deal. This promotion is only applicable in the DACH region and can be used until 30.09.2020!

> Incidentally, the end of March is also the end of Sophos's financial year. Last September, new hardware was already announced. This will definitely not be available until the end of March. The promo empties the warehouses and brings in more sales. I don't think the new hardware will be here in April, as it was two years ago, but we can definitely expect new hardware in 2020.

## FAQ
- **When will version 18.5 be released?** According to the current status as of the 18th February 2020, version 18.0 is still in beta and should be released in the next few weeks. So if Sophos is fast, v18.5 will not be released until late 2020 at the earliest. Anything else would surprise me very much.
- **Which revision of the hardware do I have?** Check the serial number of the appliance on this page to find out what revision you have: [Check your hardware revision](https://support.sophos.com/support/s/article/KB-000034595?language=en_US){:target="_blank" rel="nofollow"}

Not every Sophos Firewall Appliance is compatible with SFOS v18.0 and 18.5. We will show you what hardware will work with the upcoming version.

sophos-firewall-appliances-supported-hardware-for-sfos-v18-plus

Sophos Firewall Appliances - Supported hardware for SFOS v18+


Sophos is retiring the AP series of indoor access points. This news comes as no surprise to us. We have already speculated about it in the [eleventh episode of our podcast](/blog/podcast-sophos-news-10-2019/). When the UTM version 9.7 with support for the APX access points was released at the end of 2019 it no longer made sense for owners of a UTM Firewall to buy the old AP models.


## End of Sale - 31 March 2020
So now it is official and the AP series can only be ordered until the **31 of march 2020**. Here is a summary of all indoor access points of the AP series and which APX Sophos recommends as an alternative:

- Sophos AP15 and AP15C > [Sophos APX 120](/en/shop/sophos-apx-120/)
- Sophos AP55 and AP55C > [Sophos APX 320](/en/shop/sophos-apx-320/)
- Sophos AP100 and AP100C > [Sophos APX 530](/en/shop/sophos-apx-530/) or [Sophos APX 740](/en/shop/sophos-apx-740/)


### End of Sale even for **Central Wireless licenses**!
If you have managed your AP series access points via **Central Wireless**, you will no longer be able to purchase licenses for them after the **31st of March 2020**, except for the [AP 100X](/shop/sophos-ap-100x/) (outdoor access point). After that, no new features will be introduced for these models in Central and only critical security patches and bug fixes will be released, but only until the **31st of March 2021** (End of Support).


## End of Support - 31 March 2021
Sophos explains the 'End of Support' status as follows:

- RMAs are still being processed, provided a valid warranty or support license is in place.
- Technical support will no longer be provided. Calls to the hotline will only be accepted for RMA processing.
- No more software updates or bug fixes will be provided for the affected AP models.
- The APs can still run on the last supported firmware version


## End of Life - 31 March 2023
However, on the 31st of March 2023, this will definitely be the end and all affected AP models will no longer be able to be used in Sophos Central, the XG Firewall (SFOS) or SG UTM.

## Price increase of 30%
If you now switch from the AP series to the APX Access Point, you will face a price difference of about 30%. While today (January 2020) you can buy the AP15 Access Point for 107.25 CHF / 97.50 € net, the small APX 120 is available for 140.25 CHF / 127.50 €.

In my opinion, this would be okay if the devices were state of the art. But the APX series is currently not delivered with the latest Wi-Fi 6 standard IEEE 802.11ax, but still with Wi-Fi 5 IEEE 802.11ac.

So if you are thinking of replacing all APs with APX, I recommend waiting a little longer. Maybe Sophos will bring an update with the latest Wi-Fi standard later.
Because Sophos itself also believes that access points should last longer. That's why you get more warranty with the APX series. The AP series had 1 year warranty, the APX now have 5 years warranty. This is certainly one reason for the higher price.

## Outdoor Access Point AP100X not affected
As stated in the Sophos announcement, only indoor access points are affected. The AP100X is the only outdoor access point from Sophos to date, and will remain in the product range for the time being. According to our information there will be a change as well soon. In the coming months, Sophos is expected to introduce the first outdoor access point in the APX series (APX 320X).


Sophos is putting the AP series indoor access points out of business. Sales of the AP15(C), AP55(C) and AP100(C) will be discontinued on 31 March 2020.

end-of-sale-indoor-access-points-der-ap-serie-gehen-in-rente

End of Sale - Retirement of the AP Series Indoor Access Points

Sophos has introduced some interesting new features over the last few weeks, and I'd like to summarise the most important of these from my perspective.

## Email Impersonation Protection
Sophos Central Email Advanced has been given a new feature to help combat phishing attacks. The new feature, called **Email Impersonation Protection**, is designed to help detect and block emails from imitators.

In this type of scam, attackers send you emails with the name of a trusted sender in order to deceive you. The sender could be the name of your boss, a colleague, or your bank, for example.

For an untrained eye, it is incredibly difficult to detect such fraudulent emails on your own. Sophos even quotes on their site a recent study showing that 43% of SMEs were affected by phishing attacks through identity fraud last year.

<alertmessage icon="info">
 **Info**: Email Impersonation Protection was rolled out globally on January 14, 2020 and is now available to all users with an **Email Advanced license**.
</alertmessage>

## Sophos Wireless - Social login and Hotspot Customization
The latest Central Wireless version brings two frequently requested features to enhance the **Captive Portal**.

### Social Login with Google and Facebook
If you activate the hotspot for your SSID under **Captive Portal**, the option **Social Logins** is now available for authentication. You can choose between **Google** and **Facebook**. By activating this feature you have to change some settings in your Google or Facebook account. The setup is not very easy and Sophos has provided a video tutorial here, at least for the Facebook version. 

<videoblock video-id="378554462" provider="vimeo"></videoblock>

### Hotspot Customization
Also on the page of the **Captive Portal** there is now a drop-down menu with which you can select a template: **Default** or **Custom**.
If you now select "Custom", a dialog box will appear where you can upload an image/logo (max. size 1 MB). It is also possible to choose your own background colour. As soon as a user connects to the SSID of the hotspot, he will be redirected to your customized page.

## Sophos Managed Threat Response now available for clients and servers!
When I wrote the blog post about [MTR](/en/blog/sophos-managed-threat-response-24-7-threat-search-by-experts/) at the end of November, only support for Windows Endpoint 32 and 64 bit was offered at that time. New additions are macOS (10.13+) and Windows Server (2008 R2+).

<alertmessage icon="info">
 **Info**: You will find the products for MTR on our website next week at the latest!
</alertmessage>

## Sophos Mobile 9.5 now rolled out for Central
I have already presented the new features of Sophos Mobile 9.5 in early December 2019: [Sophos Mobile 9.5: web filtering for Chromebooks and more](/en/blog/sophos-mobile-9-5-web-filtering-for-chromebooks-and-more/)
At that time these features were only available for the on Premises version. Sophos has now, somewhat belatedly, rolled out the update to all Central customers over the weekend of **11 and 12 January**. 🥳

## More flexibility with user-defined roles
Up to now you could create your own roles in Central Admin besides the predefined roles. This made it possible, for example, to give an admin only permissions for a specific module in Central.
The latest update adds even more flexibility to the custom roles. Completely independent of the basic roles, you can set the following options individually:

- Enable access to logs & reports
- Enable policy management (add, edit, and delete)
- Enable policy assignment to users, device, etc..

<single-image url="/blog/2020/sophos-central-role-management-more-flexibility@2x.png" alt="Additional role settings for Sophos Central Admin"></single-image>

## Cloud Optix now available in Sophos Central
Sophos launched **Cloud Optix** in April 2019. It has never been a product that we wanted to offer on our website. Somehow the spark hasn't been ignited yet and there hasn't been enough time and interest to take a closer look at Cloud Optix.

But with the latest release of Sophos Cloud Optix the product has now been fully integrated into Central. Until now it was accessible via a link in the navigation, but management always took place on a separate website, which required an additional login.

We have summarized for you the latest updates to Sophos Central Email, Wireless, Mobile and Cloud Optix over the last few weeks.

sophos-central-update-email-impersonation-protection-and-more

Sophos Central Update - Email Impersonation Protection and more

The first connection between the Firewall and Central already took place through the implementation of Synchronized Security. This was followed a little later by the **Sophos Central Firewall Manager**. However, the functionality of this early version was very limited, which didn't really make the product interesting. With SFOS v18, however, the Central Firewall Manager's features were greatly enhanced.

<alertmessage icon="alert">
 **Info**: If you want to know everything about the new features in the upcoming SFOS v18, you can find my detailed article about it here: [Sophos SFOS v18: New features at a glance](/en/blog/sophos-sfos-v18-new-features-at-a-glance/)
</alertmessage>

## Central Firewall Management
Personally, I think the Sophos Central Firewall Manager (SCFM) is absolutely brilliant. Sure, the features currently available are still a bit limited, but Sophos's vision behind it is awesome. It helps us to keep track of customers with multiple Firewalls. The UTM has the **Sophos UTM Manager** (SUM) for this and the SFOS can also use the **Sophos Firewall Manager**. The latter, however, is absolute crap in my eyes and when I see where the journey with the SCFM is going, it will surely be stopped in the medium term.

Let's have a quick look at the basic features and how you can get started with the Central Firewall Manager yourself.

### Connect the Firewall
To be able to use Firewall management, a [Sophos Central Account](https://secure2.sophos.com/de-de/lp/sophos-central/free-trial.aspx?id=0013000001EjyeY){:target="_blank" rel="nofollow"} is required. You can create it for free and also the Firewall management is a free feature. In the backend of the Firewall you can register the Firewall with Central via the menu "Central synchronization". The Firewall will then appear in your Central Account.

<single-image url="/blog/2019/sophos-central-firewall-management-connect-to-central@2x.jpg" alt="Sophos Central Firewall Management - Connect to Central"></single-image>

### Management
In your Central account you will get a list of all the Firewalls you have added. By clicking on the Firewall name you automatically log in to the Firewall backend and can now configure it as usual. Logging in to the Firewall is noticeably slower than connecting directly to the Firewall, but much more comfortable, since no additional login is required. Does the Firewall have a dynamic IP address? No problem. Since the Firewall establishes the connection to Central, this works perfectly.

<single-image url="/blog/2019/sophos-central-firewall-management-list@2x.jpg" alt="Sophos Central Firewall Management - Already linked firewalls"></single-image>

> Which features are available in the Central Firewall Manager depends on the firmware of the Firewall. Some functionality will not be available until a certain release.

### Firmware updates
In the Firewall overview you can see at a glance which firmware version the individual models have. By clicking on "Upgrade" and then "Upgrade Firmware", the latest version is installed.

<single-image url="/blog/2019/sophos-central-firewall-management-fimware-version@2x.jpg" alt="Sophos Central Firewall Management - Overview of the current firmware version"></single-image>

<single-image url="/blog/2019/sophos-central-firewall-management-firmware-update@2x.jpg" alt="Sophos Central Firewall Management - Firmware update"></single-image>

> I can't stress it enough at this point to always press the update button with great care. Prepare for an update and inform yourself in advance which changes will take effect with the new version. We always have the experience that a Firewall update is too frivolous. With our Firewall maintenance contracts we take care of the updates of your Firewalls and can protect you from nasty surprises. 😎

### Online-Backup
You can also use Sophos Central Firewall Manager to create scheduled or manual backups of the configuration of your Firewalls. Of course, it is highly recommended that you set up such a backup. Previously, you could manually download these backups from the Firewall or save them directly to FTP. Sending them by email was also available as an option.

Although it is possible to create a backup on the Firewall, problems can occur if such a backup is needed. We have already encountered the following situations with customers:

- The email address to which the backup was sent no longer existed and therefore the backups never arrived in the mailbox.
- Email Protection blocked the emails because they were sent from a dynamic IP or the SPF was not correct.
- A backup was available, but the password could no longer be found.
- A backup was available, but very outdated.

There would certainly be other reasons why it could fail in an emergency despite backup. Many of these problems are solved by the introduction of online backup on Central. You get a secure way to store your backups centrally and encrypted in Central. These backups are always up to date and ready when needed in case of an emergency.

<single-image url="/blog/2019/sophos-central-firewall-management-backup@2x.jpg" alt="Sophos Central Firewall Management - Manage backups"></single-image>

## New v18 features
The features mentioned above are already available with version 17.5. Now let's get to the new features that will only be available with SFOS v18.

### Reporting
There used to be a Sophos product called **iView** which enabled a consolidated reporting system. To be honest, this software still exists, but for us a product that hasn't been updated for years no longer exists. The fact that it has not been discontinued by Sophos does not make it any more relevant. 😅 iView definitely has no future for us and definitely lives on in Central Reporting.

If you enable reporting on the Firewall, the Firewall logs will be sent to Central. From the collected data appealing reports can be generated.

<single-image url="/blog/2019/sophos-central-firewall-management-central-reporting-logs@2x.jpg" alt="Sophos Central Firewall Management - Activate Central Reporting"></single-image>

<single-image url="/blog/2019/sophos-central-firewall-management-report-dashboard@2x.jpg" alt="Sophos Central Firewall Management - Report Dashboard"></single-image>

<single-image url="/blog/2019/sophos-central-firewall-management-report-bandwidth-usage@2x.jpg" alt="Sophos Central Firewall Management - Bandwidth usage report"></single-image>

Central reporting for the Firewall is currently still in Beta. But in the current version you get a very good feeling for what you can expect from the final version.

### Global Firewall settings
For customers with a lot of Firewalls, we are quickly faced with the problem that such a mass of devices is very difficult to manage. With 10 Firewalls this can still work to some extent, with more than 50 this is already a real challenge. With v18 the Firewalls on Central can be grouped wonderfully!


<single-image url="/blog/2019/sophos-firewall-sfos-v18-firewall-groups-overview@2x.jpg" alt="Sophos Central Firewall Management - Group Firewalls"></single-image>

You then get a Firewall interface in the group policies and can define and save settings centrally. These are then rolled out to all Firewalls in this group.

<single-image url="/blog/2019/sophos-firewall-sfos-v18-firewall-groups-task-queue@2x.jpg" alt="Sophos Central Firewall Management - Firewall groups task que"></single-image>

Also this feature is still in beta at the moment and in my tests this was noticeable. They are still a bit away from a stable implementation. In addition, during my tests some questions have accumulated which are still unanswered. However, I am absolutely convinced that the global Firewall settings will be of great help to us in the future!

With SFOS v18 the features of the Central Firewall Management were enhanced. The new capabilities include online backup and log reporting.

sophos-central-firewall-management-features-with-sfos-v18

Sophos Central Firewall Management - Features with SFOS v18

The Sophos Firewalls (with SFOS) will get a major update with SFOS v18 soon. We have already installed the beta and I'll show you in this article what features the new version has to offer.

## Tests in live operation
In fact, we are not testing the beta on any test device in a lab environment. We gather our experience right in the productive environment. But that's not all. We also test the beta at selected customers with over 650 users, in order to gather as much information as possible about the new version. So I'm not just copying the texts from Sophos's documentation here, but reporting on the new SFOS v18 EAP1 and EAP2 with several weeks of experience. This is of course reflected in the length of this article, in which I will go into many features in more detail. So let's get started with the **Xstream architecture**.

## Xstream architecture
A special highlight of v18 is the new package processing architecture. This offers more performance, security and more visibility for encrypted traffic. With v18, however, a lot has happened.

<alertmessage icon="info">
 **Info**: The "X" in "Xstream" stands for NextGerneation and the "Stream" for the new DPI engine, which is a streaming-based scanning solution.
</alertmessage>

### Xstream SSL/TLS Inspection
We have already covered SSL Inspection, or often referred to as "SSL Scanning" or "HTTPS Scanning": [HTTPS-Scanning: Why it should be enabled on Sophos](/en/blog/https-scanning-why-it-should-be-enabled-on-sophos/)

**Briefly summarized**: HTTP traffic can easily be scanned by the Firewall because it is unencrypted. The HTTPS traffic has to be *broken* first. Only then is the Firewall able to scan it. The problem up to now was that the web proxy could only decrypt HTTPS traffic that went through port 443. If the traffic went through another port, e.g. "hxxps://www.example.com:8000", the Firewall was blind again.

With v18 you are ready for the latest technologies and can check both SSL and TLS 1.3 traffic. It doesn't matter which ports or protocols the traffic goes through. 🤩 But under the hood (architecture) a lot had to change, which the Firewall administrator fortunately doesn't have to suffer from.

On the one hand it needs a **Decryption Profile**, which in turn is attached to a **SSL/TLS Inspection Rule**. This rule then defines which traffic should be checked.

<single-image url="/blog/2019/sophos-firewall-sfos-v18-decryption-profiles@2x.jpg" alt="Sophos SFOS v18 Decryption Profiles"></single-image>

<single-image url="/blog/2019/sophos-firewall-sfos-v18-ssl-tls-inspection-rule@2x.jpg" alt="Sophos SFOS v18 SSL TLS Inspection Rule"></single-image>


This allows you to define which traffic is to be checked independently of the Firewall rules.

At this point there are also predefined **Decryption Profiles** and **SSL/TLS Inspection exception rules**. These exception rules include a list maintained by Sophos to prevent websites and applications that cause problems from being scanned.

The following Sophos video gives you a brief introduction to the Xstream SSL Inspection Engine in XG Firewall v18:

<videoblock video-id="373969240" provider="vimeo"></videoblock>

### Xstream DPI Engine
The DPI engine is the part that takes care of the SSL/TLS inspection. Once the traffic has been decrypted, it also scans it for Web Policy rules, Content Scanning (AV), App Control and IPS.

Here it is important to understand that the new **DPI Engine** competes with the previously used **Web Proxy**. So the **Web Proxy**or the new DPI engine takes care of the HTTP / HTTPS traffic, web policy and content scanning.

If you update from version 17.5 to 18.0, the Web Proxy settings will of course be applied. But if you want to use the DPI engine, you have to rebuild it first. You have to create an SSL/TLS Inspection Rule and deactivate the Web Proxy in the Firewall settings.

<single-image url="/blog/2019/sophos-firewall-sfos-v18-firewall-rule-security-settings@2x.jpg" alt="Sophos SFOS v18 Firewall Rule - Security Settings"></single-image>

There are only a few reasons why you should not rely on the new DPI engine. Nevertheless, there are functions that the Web Proxy offers and the DPI Engine does not. Among them are **SafeSearch** for search engines or YouTube, as well as **Caching** or **Pharming Protection**. On all Firewalls that we manage, however, we can do without these features with no problems, which is why the DPI engine will be used by us safely.

The following Sophos video will give you a brief introduction to the **Xstream DPI engine** and help you decide when to use the DPI engine compared to the outdated web proxy:

<videoblock video-id="374007446" provider="vimeo"></videoblock>

### Xstream Network Flow FastPath
You probably know the problem that the Firewall slows down the traffic a bit. Certain processes will feel a bit slower. Due to the new architecture there is a so-called **FastPath**. This helps the Firewall to outsource harmless traffic directly to the kernel and thus keep performance extremely high.

<single-image url="/blog/2019/sophos-firewall-sfos-v18-xtream-architecture-fastpath@2x.jpg" alt="Sophos SFOS v18 xStream Architecture Fastpath"></single-image>


Traffic initially goes through the **Firewall stack**. Here it is checked whether a corresponding Firewall rule exists and whether the traffic is allowed at all. If the traffic is checked e.g. by the IPS, it still runs through the DPI engine. If the IPS Engine decides that the traffic is harmless, it is transferred to the FastPath and routed directly via the kernel.

When I looked at this graphic, I wanted to test in practice how exactly this works. If the traffic is allowed or not, you know really soon and this process doesn't have to be checked for every package from this source and port. But how does the system in the DPI engine know when the traffic can be transferred to FastPath? If e.g. SSL/TSL scanning is activated, this is not possible. Otherwise the traffic would no longer be checked. With IPS or application control, on the other hand, known lists are used and a decision can be made as to whether the traffic is harmless or not.

## Threat Intelligence Analysis
If you have licensed the Sophos Sandstrom module for your Firewall, files in a sandbox will be checked for certain criteria before downloading. If you would like to learn more about Sophos Sandstorm, you can also take a look at [Sophos Sandstorm PDF with FAQs](/assets/pdf/sophos-sandstorm-partner-faq.pdf){:target="_blank"}.
Thanks to SSL/TLS inspection, the Firewall can see more of the traffic and take a closer look at web downloads. In the final analysis, however, the endpoint protection would still be in place to stop a threat.

With v18 the **Threat Intelligence Analysis** is added to Sandstorm. While scanning web downloads or email attachments on Sophos Sandstorm, threat intelligence scans files with [Machine Learning](/en/blog/machine-learning-sophos-relies-on-artificial-intelligence/). This also includes SophosLabs analysis, which is used by [Sophos Intercept X with EDR](/en/blog/why-endpoint-detection-and-response-edr/).

As known from EDR, a detailed report is then prepared for analysis. For Sophos Firewall with SFOS v18 EAP2, a report looks like this:

<single-image url="/blog/2019/sophos-firewall-sfos-v18-sandstrom-threat-meter@2x.jpg" alt="Sophos SFOS v18 Intelligence Analysis-Threat-o-Meter"></single-image>

<single-image url="/blog/2019/sophos-firewall-sfos-v18-sandstrom-report-summary@2x.jpg" alt="Abstract from the report (overview)"></single-image>

<single-image url="/blog/2019/sophos-firewall-sfos-v18-sandstrom-report-run@2x.jpg" alt="Report with screenshots when the file is executed"></single-image>

> The somewhat prettier report is only available from EAP3 onwards. 

## Enterprise NAT
Apart from the xStream architecture, the NAT rules also experienced a major change. Up to version 17.5 there was a menu item "Firewall" and here all Firewall rules, NAT rules and WAF rules were listed. In a Firewall rule you could also define the outgoing interface / IP for the traffic.

<single-image url="/blog/2019/sophos-firewall-sfos-v17.5-waf-template@2x.jpg" alt="Sophos SFOS v17.5 WAF Template"></single-image>

<single-image url="/blog/2019/sophos-firewall-sfos-v17.5-create-firewall-rule@2x.jpg" alt="Sophos SFOS v17.5 - Create Firewall Rule"></single-image>

Neu mit v18 sind die NAT-Regeln in einem eigenen TAB gelistet.

<single-image url="/blog/2019/sophos-firewall-sfos-v18-rules-and-policies-tabs@2x.jpg" alt="Sophos SFOS v18 Rules and Policies Tabs"></single-image>

As a result, updating from v17.5 to v18 migrates the NAT rules. This looks a bit messy at first, because for every Firewall rule where "NAT & routing" was enabled, a rule "linked NAT Rule" is created. These few automatically created NAT rules, however, can be replaced relatively quickly.

Now there is not only one Firewall rule, which also does NAT. There is a NAT rule and you need a Firewall rule that allows traffic. But this change was necessary, because now NAT in SFOS (Network Address Translation) has become much more flexible.

What some customers have been waiting for is, for example, the possibility to prevent all DNS or NTP requests on public servers or to forward them to an internal server. This is therefore also the solution for those who still miss the NTP server on the XG, which was still present on the UTM.

The topic NAT is explained here also in a video:

<videoblock video-id="374008313" provider="vimeo"></videoblock>

## Firewall Rule Management
From major to major version the handling of Firewall rules gets a bit better. You can now select multiple Firewall rules to delete, enable/disable, add to a group, or detach from a group. In addition, the Firewall rules are now numbered so that you know how many there are at all. However, the rule ID remains the same. The menu item "Firewall" has also been renamed to "Rules and policies".

<single-image url="/blog/2019/sophos-firewall-sfos-v18-firewall-rule-overview@2x.jpg" alt="Sophos SFOS v18 Firewall Rules Overview"></single-image>

Filters can now be added, which greatly simplifies searching for specific rules. The filter remains even if you switch to another menu item and back again.

> For those of you who now think that Sophos may now leave Firewall groups open after saving a rule, I am sorry to disappoint. Nothing has changed about that. 😖

<single-image url="/blog/2019/sophos-firewall-sfos-v18-firewall-rule-filter@2x.jpg" alt="Sophos SFOS v18 - Filter Firewall rules"></single-image>

A really often requested feature is finally available. The counter how much traffic was processed by a Firewall rule can be reset to zero.

<single-image url="/blog/2019/sophos-firewall-sfos-v18-firewall-rule-settings@2x.jpg" alt="Sophos SFOS v18 - Firewall Rules Settings"></single-image>


When you create a new Firewall rule, you can now disable the rule immediately.

<single-image url="/blog/2019/sophos-firewall-sfos-v18-firewall-rule-status@2x.jpg" alt="Sophos SFOS v18 - Firewall Rules Status"></single-image>

It is now possible to define exclusions in a Firewall rule. This is extremely helpful to avoid inflating the whole rule construct unnecessarily.

<single-image url="/blog/2019/sophos-firewall-sfos-v18-firewall-rule-exclusions@2x.jpg" alt="Sophos SFOS v18 - Firewall Rules Exclusions"></single-image>



## Log Viewer
Who has read the article [7 reasons why the XG Firewall (SFOS) is better than the UTM](/en/blog/7-reasons-why-the-xg-firewall-sfos-is-better-than-the-utm/) knows how helpful the Log Viewer is. Also in the new version the tool gets some new helpful functions.

<single-image url="/blog/2019/sophos-firewall-sfos-v18-log-viewer-filter@2x.jpg" alt="Sophos SFOS v18 Log Viewer Filter"></single-image>

<single-image url="/blog/2019/sophos-firewall-sfos-v18-log-viewer-exclusions@2x.jpg" alt="Sophos SFOS v18 Log Viewer Exclusions"></single-image>

By clicking on an entry in the Log Viewer, you can set a filter, define SSL/TSL exceptions, or change IPS, Application Control, or Web Filter guidelines.

## Alerts und Notifications
Under "Administration" > "Notifications settings" you could only activate two options for an email notification:

- IPsec tunnel up/down
- Email alert notifications

If a RED was not available or if a user entered the wrong password too often, there was no possibility to be notified about it.

<single-image url="/blog/2019/sophos-firewall-sfos-v18-notification-list@2x.jpg" alt="Sophos SFOS v18 Notifications"></single-image>

Under v18 you can find the list in the menu under "System Services" > "Notification list". From now on there are 36 actions available, about which you can be notified via email or SNMP.

## Flow Monitoring
Currently you don't really see much on the Firewall about the live connections and the data isn't real-time either. Also, in my opinion, it's not really appealing. With v18 there is now a great view which shows the active IPs, users and applications with corresponding bandwidth usage in real time. Connections can also be blocked or prioritized.

> I cannot test this feature myself, because it is only finished with EAP3. But what I have seen so far is very well implemented! 😍

 

## SD-WAN Policy Routing
Before I tell you more about SD-WAN Policy Routing, first a hint that the menu item has been renamed in v18:

- v17.5: Routing > Policy routing
- v18.0: Routing > SD-WAN policy routing

But apart from that, you can now create a routing based on more criteria. For example, if you want to route a user, group, or application using a different interface, you can do so now. Many applications are recognized thanks to Synchronized Security and the **Synchronized Application Control**.

## Email Protection - DKIM & BATV
The following two solutions are now also supported for the fight against spam:
- DKIM (DomainKeys Identified Mail)
- BATV (Bounce Address Tag Validation)

## DDNS Support
- It is no longer necessary to define how often the WAN IP should be updated. The value is now fixed at 5 minutes.
- The Sophos service, which had caused some problems in the past, has been replaced by an open source solution.
- The number of DDNS providers has doubled from 5 to 10. Newly added: DNS-O-Static, FreeDNS, Google DNS, Namecheap, No-IP

## Small improvements
- **High Availability (HA) improvements**: The appliances can now be connected to a cluster faster and easier. The firmware can also be rolled back.
- **SNMPv3 Support**: Better security compared to SNMPv1 and SNMPv2, if one could even speak of "security" in the first two versions. The **MIB File** is of course available for [Download](https://docs.sophos.com/nsg/sophos-firewall/MIB/SOPHOS-XG-MIB.zip){:target="_blank" rel="nofollow"}.
- **Name change of interfaces**: The interfaces were previously named Port1, Port2 etc. and this could not be changed. In v18 this is now possible. IPsec, IPS, wireless networks etc. still cannot be adapted.
- **GeoIP database updates**: The country IP database can now be updated separately from the firmware updates.
- **VMware Tools Upgrade**: VMware Tools are now pre-installed in version v10.3.10 and Site Recovery Manager (SRM) is also supported.

## Upgrade to SFOS v18
### Requirements
You're really excited now and can't wait to update to v18? If you already have an XG Firewall or an SG with SFOS, you must have v17.5 MR6 or higher to upgrade to v18. A rollback is of course supported as always. If something doesn't work for you with v18, you can go back to the previous version.

### SG to XG
If you still have a UTM Firewall, you can also switch to SFOS. We have created a tutorial for this: [Install Sophos XG Firewall OS on a SG Appliance](/en/kb/install-sophos-xg-firewall-os-on-a-sg-appliance/)

If you need help with the migration, please contact us. We have already retired a lot of UTMs. 😎

### XG 85 to XG 105
To install the v18 you need at least **4GB RAM**. Therefore, the future SFOS version will not run on an XG 85 or XG 105 firewall. If you use your own hardware and still have 2GB RAM installed, you face the same problem. Cyberoam is also no longer supported.

Owners of an XG 85 or XG 105 should take a look at the successor models: [XG 86 and XG 106](/en/blog/new-firewall-hardware-sophos-xg-86w-and-xg-106w/). At the moment we have a [Sophos Promo](/en/blog/sophos-promo-50-on-sg-xg-firewalls-upon-renewals/) until March 31, 2020, where you can save 50% on the new hardware by renewing.

## Sophos Central Firewall Reporting and Management
I have written a separate blog post about this topic: [Sophos Central Firewall Management - Features with SFOS v18](/en/blog/sophos-central-firewall-management-features-with-sfos-v18/)

## FAQ
- **When will the GA (Final Version) be available?** If everything goes according to plan and the betas don't cause any major problems, we can expect v18 in Q1 2020.
- **What about the new hardware?** We have already reported several times on the hardware successor of the XG Firewall in this blog, which is no longer a secret. At the moment there is no release date planned and I would expect it in the second half of 2020 at the earliest
- **Is Let's Encrypt coming?** No 😖, at least not yet in v18.

---

## More information
- [XG Firewall: What’s New in v18](/assets/pdf/sophos-xg-firewall-whats-new-in-v18-eap1-en.pdf){:target="_blank"}

The SFOS will get a major update to v18 soon. In this article we will show you what features the new version has to offer.

sophos-sfos-v18-new-features-at-a-glance

Sophos SFOS v18 - New features at a glance

Sophos has introduced the new version 9.5 of **Sophos Mobile**, which for the first time supports **Chrome OS** as a new platform. In addition, device management for **Android Enterprise** has been further improved and the name **Intercept X** is entering Sophos mobile apps.

<alertmessage icon="info">
 **Info**: Version 9.5 is already available for the on Premises version, but all Central customers will need to be patient. The original date for the global update was 9 December, but I have heard that it may not be rolled out until January 2020.
</alertmessage>

## WCAG 2.1 compliant
Although the structure of Sophos Mobile has fortunately not changed much, the user interface has been made WCAG 2.1 ready. This means that people with visual impairments in particular can now use the software much better. Sophos Mobile 9.5 has been tested for accessibility and can now be used with screen readers.

## Chromebook Security Management
With version 9.5, Sophos Mobile now also supports the Chrome OS platform. To manage such devices, Sophos has first focused on **Security Management** rather than **Chromebook Management**. To manage multiple Chromebooks, Google already offers a solution through the **G Suite**. The use of the "G Suite " is even free of charge for all customers in the education sector, which is why Chromebooks are very popular at schools. For the corporate environment, on the other hand, you have to buy a license.

So because Google already has a solution for managing Chromebooks, Sophos wanted to start with a feature that had been lacking until now, namely **web filtering**.

> The "G Suite" also provides APIs, which makes a later integration of a "Chromebook Management" into Sophos Mobile very likely.

To equip your Chromebook with Sophos Mobile web filtering, you will need the **Sophos Chrome Security** extension, which you can download from the **Chrome Web Store**. Once the Chromebook has been successfully added to Sophos Mobile, you will be able to use the familiar 14 web filter categories in the policies, which you can of course also create a white or black list for.

> If you are using a Sophos Firewall with Sophos Central, you know the problem that the web filter settings on the Firewall are not synchronized with the settings on the central endpoint. If you want to protect your computers or mobile devices outside the network, you will also need to configure web filtering for each platform. However, Sophos appears to be working to ensure that firewall rules can be applied to computers, chromebooks and mobile devices in the future. 🥳

In addition to web filtering, there are also a few compliance rules to check that Chromebooks follow corporate policies. The built-in "Tamper Protection" should certainly be highlighted here. Chrome extensions are technically written in JavaScript and are not clearly isolated from each other. So you could theoretically write an extension to disable the Sophos Chrome Security extension. This is exactly why there is this "Tamper Protection", which regularly checks on the Chromebook whether the "Security Extension" from Sophos still has the necessary accesses. You can also use another rule, for example, to specify which extensions may or may not be installed. Or you can set up a policy that restricts extensions except those that come from the Google Play Store.

## Android Enterprise – QR-Code Enrollment
For everyone who uses Android Enterprise, there is a new way to distribute Android devices. The new method is called **QR Code Enrollment** and is specially designed for Fully Managed Devices. To use this variant, create a QR code in Sophos Mobile. This code will no longer apply to a specific device or user, but can be used for any new device.

> The QR code enrollment is very convenient and offers the possibility to integrate the WLAN settings directly compared to the "Zero-Touch Enrollment". This means that the user does not have to ask for the WLAN password afterwards and enter it manually. In order to use the QR code enrollment, you only need an Android smartphone with a camera and do not have to pay attention to special hardware, as with zero-touch enrollment.

If you have now configured such a QR code, you can print it out, for example, and make the workflow for rolling out new devices very efficient. All you have to do in the future is take the new Android smartphone out of the box, turn it on and scan the QR code. After that the device will configure itself completely and the user who gets this smartphone only has to enter his username and password. This almost creates an autonomous process that can theoretically be initiated by the employee himself. This QR code can also be copied into an email and sent directly to the employees with a little instruction. Unpacking a new device and scanning the QR code is so easy that no trained mobile administrator is needed.

## Android Enterprise – App Management
If you want to add new apps from the Google Play Store to your allowed catalog, version 9.5 allows you to do this conveniently via an iFrame. Previously, this step was relatively laborious and these settings had to be done via "Google Play for Work". You can also use this iFrame to add your own APKs, which were developed especially for your own company. In addition to apps from the Play Store or own APKs, "Web Apps" can now also be added to the catalog. If you want to place links to a certain website on the Android home screen of your employees in the future, this is now also possible.

## Intercept X for Mobile
Intercept X for Mobile is not a new app from Sophos, but a renaming of the previous "Sophos Mobile Security" app. Sophos wants to bring together under the name "Intercept X" all endpoint protection solutions, whether they run on a Windows computer, Mac, server or mobile device.

In addition to the new name, a complete rebranding has also taken place. The user interface of the app has been redesigned and a new common software style has been developed. This new design will then be applied to all Sophos agents on the various platforms in the future.

Like the Sophos Mobile 9.5 user interface, the new Intercept X for Mobile app has been designed to comply with WCAG usability guidelines. So this app can now also be used by people who can't see so well. Sophos has also updated its malware detection, which is only available for Android devices. Both the signature-based engine and new machine learning models have been updated.

## Sophos Secure Email improvements
The Sophos Secure Email App has also received a small update:

- iOS & Android: Favorite Folders - Up to 10 folders are automatically synchronized.
- iOS: Contacts can now be saved as Favorites.
- iOS: Calendar entries can now be forwarded.
- iOS: Documents recorded with the camera can be attached to an email.

## Further innovations
I didn't go into every feature in detail in this blog post. In the following list you'll find the remaining new features that don't need much explanation:

- added support for **Android 10**
- added support for **iOS 13**
- added support for **macOS 10.15****.
- added Windows Server 2019** as Certification Authority Server
- support for **Samsung OEM Config**
- new report: Localize multiple devices, e.g. kiosk devices
- the log level can now be set remotely
- log files can now be remotely pulled from the device

## Removed Functionality in Mobile 9.5
Last but not least, there are three systems that are no longer supported in the new mobile version. For Windows Phone 8.1, however, the decision was not made by Sophos. It is Microsoft who is gradually phasing out support for this operating system:

- Management support for **Android Things** and **Win 10 IoT**
- Support for **Windows Phone 8.1** (devices remain visible)

Sophos Mobile 9.5 brings security management with a focus on web filtering to Chromebooks and improves device management for Android Enterprise.

sophos-mobile-9-5-web-filtering-for-chromebooks-and-more

Sophos Mobile 9.5 - Web Filtering for Chromebooks and more


On 1st October Sophos launched a very promising service which I would like to introduce to you. We are talking about **MTR** or **Managed Threat Response**. This new product is the result of the two acquisitions **Rook Security** and **DarkBytes**. Rook Security is particularly represented in the service area of this offering, while DarkBytes has contributed its part of the technology with Managed Detection and Response (MDR).

## What is Sophos Managed Threat Response (MTR)?
Sophos MTR is based on **Intercept X Advanced with EDR** and addresses the big, fat elephant in the room. 😅 If you've read my article about [Endpoint Detection and Response](/en/blog/why-endpoint-detection-and-response-edr/), you know where the added value of this product lies. But many customers simply don't have the time to search for possible threats on their own. In addition, this job requires ** highly qualified and specialized professionals** with the right level of expertise. Such people are not only particularly difficult to find, but have a really high salary level. If this service is to be extended to a 24-hour service, it will consume a very large part of the budget for your IT security. As a rule, only very large corporations have the opportunity and the financial resources to create special incentives for employees.

That's where Sophos's new MTR service comes in, offering you a **24/7 service** through an expert security team that takes care of threat detection in your business and can take immediate action in sensitive situations. The new MTR product is therefore not another menu item on your Central Admin Dashboard, but offers a targeted human response. Sophos highlights the **independent intervention** in this service. Sophos's MTR team will therefore not only inform you in the event of an attack, but will also take the necessary action on your behalf if desired. So you will have a fully managed service.

## Which variations of the MTR service are available?
We will definitely include the new MTR offer in our product catalogue and will soon be able to offer it on our website. Basically the service is available in the following variants:

1. **Central Intercept X Advanced with EDR and MTR [Standard / Advanced]** - This is the bundle for all customers who have not yet purchased an EDR license. So this concerns customers with e.g. "Intercept X Advanced" or only the "Endpoint Protection".
2. **Central MTR [Standard / Advanced]** - This option is suitable for all customers who are already using "Intercept X Advanced with EDR" and would like to purchase MTR as an add-on.

## Standard or Advanced - Where exactly are the differences?
As you can see from the two variants listed above, Sophos MTR is available in a **Standard** and a **Advanced** version. Let's take a look at what is included in the two packages:

### Scope of services of the **Standard version**

#### 24/7 Lead-Driven Threat Hunting
Once you have licensed Sophos MTR and gone through the onboarding process (more on this later), your Central Account will be connected to the automated system of the MTR team. Because this system is constantly learning, it can automatically respond to known threats. The **Lead-Driven Threat Hunting** is used when something has been detected on your system but has not been fully resolved and requires human expertise. You can imagine it a bit like the "Threat Analysis Center" in your Central Admin account. There you can see threats that have already been automatically stopped by Intercept X Advanced, as well as "suspicious objects" that have been detected but not fixed thanks to AI (artificial intelligence). In such a situation the MTR team is there for you on a 24/7 basis. An expert then takes a close look at the critical clue and uses his experience to decide what severity this particular detection has and what needs to be done. The findings and knowledge from this incident are then transferred to the automated system of the MTR team. The next time the same detection occurs in a different scenario, the system can respond automatically.

#### Adversarial Detections
At the same time as conducting an evidence-based threat search, the MTR team pays special attention to attacks executed through legitimate processes such as PowerShell. Such attacks are often successful because they are very difficult for monitoring tools to detect. The MTR team monitors these processes using proprietary analysis techniques to ensure that they are not misused for malicious purposes.

#### Activity Reporting
For the MTR team transparency towards you as customers is very important. Therefore you will get activity reports which will show you what the MTR team has done on your behalf. You'll know the current state of your systems, what insights were gathered during the reporting period, and what threats were averted.
A histogram of these reports is then generated over the period of time when you use the MTR service. Sophos uses this data to create scorecards, which you can use to compare yourself with previous periods. This gives you the transparency as promised and allows you to see very quickly whether the MTR service is of any use to you.

#### Security Health Check
As you can see from the top three features, the MTR Service Standard is about detecting threats and preventing attacks. The **Security Health Check** also ensures that your Sophos Central products, such as **Intercept X Advanced with EDR**, are always running at maximum performance. To do this, the MTR team will look at your network requirements and make recommendations for configuration changes. So you can be sure that Central's products are perfectly suited to your business.

---

### Scope of services of the **Advanced variant**
Let's take a look at which additional services are offered to you in the Advanced variant:

#### 24/7 Leadless Threat Hunting
In addition to the **Lead-Driven** threat hunting in the Standard Package, the Advanced Package also includes the **Leadless** threat hunting. In this case, the entire expertise lies with the analysts of the MTR team, who take a close look at particularly important devices or user accounts in your company. They look at how the network communicates, whether suspicious processes are being executed, or otherwise unusual or atypical behavior can be detected. The collected data is used to predict the strategy of attackers and to identify new attack indicators (IoA).
If an issue is detected, you will be assigned a dedicated response leader to help you resolve the issue completely over the phone!

#### Enhanced Telemetry
The standard MTR package contains the data provided by **Intercept X Advanced with EDR**. For improved telemetry, the Advanced version goes beyond pure endpoint event detection to include data from other Central products in the threat analysis.

#### Direct Call-In Support
Another advantage of the Advanced variant is direct access to the MTR analyst team, which is available 24/7. So if you have a question or would like to talk about a particular threat, you can contact the Security Operations Center (SOC) directly by phone.

#### Proactive Posture Improvement
In the Advanced package, the **Security Health Check** is taken to the next level. While the standard version makes general recommendations for the configuration of the Central products, the MTR team now also considers the business context behind the configuration settings of, for example, a policy. You'll receive assistance on how to fix configuration and architecture vulnerabilities that can adversely affect your security.

#### Asset Discovery
In addition to discussing critical operational procedures with you, Sophos experts will also provide you with an overview of applications in use and identify potential points of attack that may arise in the system. The MTR team uses an asset inventory to help them understand what applications are running on an endpoint and whether they are affected by open vulnerabilities. This results in valuable detailed information that is specifically tailored to your business.
---

## What levels of support are offered by the Sophos MTR team?
Regardless of whether you choose the standard or advanced version, you retain control over how autonomously the MTR team works. This is regulated right at the beginning of the so-called **Onboarding process**. When you purchase the Sophos MTR service, you can choose from three options which determine what response you expect from the MTR team:

1.  **Notify:** If the Sophos MTR team has detected a threat or attack, it will only inform you of it at this level, but will not act on your behalf. However, you will receive a detailed report on the cause and the detection, with steps that can be taken to neutralize the threat on your own.
2.  **Collaborate:** The Sophos MTR team works with your employees or an external consultant to respond to the threats they face.
3.  **Authorize**: The MTR team takes care of containment and neutralization actions completely independently and only informs you about the measures taken.

## What is the difference between Sophos MTR and its competitors, who also offer a similar service?
Sophos has named **SentinelOne** and **CrowdStrike** as two of its most competitive offerings. However, Sophos's MTR service offers a significant advantage. There has been no independent, proactive action so far. With Sophos's **authorization** response level described above, you no longer have to deal with long lists of error and threat messages on your own. All this can now be done on your behalf by trained Sophos specialists.

While **SentinelOne** and **CrowdStrike** also offer such services, they are only available to the highest tier which a small business cannot afford. The highest level of authorization at Sophos MTR is available to all companies, regardless of size or service level.

## What systems can Sophos currently operate with this service?
The service was only put into operation on 1 October. For this reason, support is currently only offered for Windows Endpoint 32 and 64 Bit. Support for other systems such as **Windows Server, Linux and Mac OS** will follow at the end of November 2019. However, an exact date has not yet been announced.

Furthermore, the service is only available in English in the first phase. However, it is planned to include other languages in the repertoire. When this will happen and which languages it will be, however, has not yet been decided.

## Conclusion on the Sophos Managed Threat Response Service
What I've read and heard so far about Sophos's MTR service has really convinced me! Sophos's MTR service gives small and medium-sized businesses the opportunity to afford comprehensive and professional IT security protection. The search for qualified and experienced staff is greatly reduced and you can rely on Sophos's own experts.

I also find the three different levels of support that Sophos offers to all customers in the onboarding process to be a great success. So you can decide for yourself how much control you want to give up. The "authorization level" is also absolutely unrivalled and is also available in the standard version! So you don't need to buy the more expensive advanced package if you want Sophos specialists to take care of the security of your network on their own.

If you are interested in Sophos MTR, don't hesitate to contact us. We will soon publish the different variants of the MTR service on our website, so the price won't be a secret. If you have any open questions, we would be happy to discuss them with you.


Sophos MTR offers you a 24/7 service provided by an expert security team that takes care of threat detection for your business.

sophos-managed-threat-response-24-7-threat-search-by-experts

Sophos MTR - 24/7 Threat Search by Experts

Sophos has completed UTM version 9.700. This version will be available in small stages. The first step is to download it from the FTP server. Later, the update will also be distributed via the Up2Date server.

<alertmessage icon="danger">
 **Important**: Who uses RED site-to-site connections should keep their fingers off this version for the time being. There was already some feedback that after the update to version 9.7, problems with site-to-site connections appeared.
</alertmessage>

<alertmessage icon="danger">
 **Important**: Note that when this version is installed, the system restarts. Then the configuration will be updated and all connected access points and REDs will be firmware upgraded.
</alertmessage>

## APX Access Points Support
Sophos's "new" access points, the APX series, could previously only be managed using Sophos Central or firewalls with SFOS. Initially, Sophos stated that the UTM would not receive support for the new APX series. This statement has been completely ignored and v9.7 now supports all APX access points on the UTM. What is "new" about these APX access points is explained in the following blog post: [New APX series with Wave 2.0](/en/blog/sophos-access-points-new-apx-series-with-wave-2-0/)

For friends of UTM this is certainly great news. Now you can start planning the replacement of the old AP series. Many of those who were still using the first generation (AP30/AP50) did not find an investment in the second generation (AP55/AP100) very attractive, as these access points have been sold since 2015. Nobody likes to buy hardware that is that old. Here you can find the direct links to our product pages:

- [Sophos APX 120](/shop/sophos-apx-120/)
- [Sophos APX 320](/shop/sophos-apx-320/)
- [Sophos APX 530](/shop/sophos-apx-530/)
- [Sophos APX 740](/shop/sophos-apx-740/)

## Certificate Chain support for WebAdmin, UserPortal and WebProxy
The UTM now also supports the use of certificates from sub-CA's for the UTM.

## New protocol for RED Site to Site connections
As mentioned in the note box at the beginning, this new protocol seems to cause problems, so you should wait for the update.
The UTM now uses the same protocol as the XG firewall used for site-to-site connections. So the Legacy RED site-to-site connection is no longer necessary.

## UTM Endpoint Management
Sophos has not sold any new licenses for UTM Endpoint Protection since the end of 2018. For the past 2 years, this menu item has also strongly pointed out that Central should be used after all. Existing customers could also switch to Central for free if an active license was still available.

Support will now be discontinued from the end of 2019 and with the new version some buttons will disappear. What remains is the possibility to deactivate the Tamper Protection so that the endpoint can be uninstalled from the client.

If someone is still using this Antivirus, it is best to switch to Sophos Central immediately:

### For Client Operating Systems
- [Sophos Central Endpoint Protection](/en/shop/sophos-central-endpoint-protection/)
- [Sophos Central Intercept X Advanced](/en/shop/sophos-central-intercept-x-advanced/)

### For Server Operating Systems
- [Sophos Central Server Protection](/en/shop/sophos-central-server-protection/)
- [Sophos Central Intercept X Advanced for Server](/en/shop/sophos-central-intercept-x-advanced-for-server/)

## IKEv2
I'm sorry if I gave you hope with this title. No, in v9.7 there is still no IKEv2 support.
But currently the feature is still on the roadmap and will be released in v9.8. **According to Sophos, the schedules in the roadmap are without guarantee!**

## Bugfixes
- NUTM-10804 [Access & Identity] strongSwan vulnerability fix (CVE-2010-2628, CVE-2018-17540)
- NUTM-10485 [Email] POP3 E-Mail blocked message won't be displayed properly in some MS Outlook versions
- NUTM-10745 [Email] Quarantine mail older than 14 days are not getting removed
- NUTM-10958 [Email] Quarantined SPX Mails which are released are still available on UTM
- NUTM-10192 [RED] Patch OpenSSL (CVE-2018-0732)
- NUTM-11141 [Sandstorm] Add support for Sandstorm's Frankfurt data centre
- NUTM-10454 [WAF] SAVI integration doesn't support scanning files larger than 2GB
- NUTM-10873 [WAF] Underscore in DNS-Hostname makes WAF unusable
- NUTM-11162 [WAF] Authentication through WAF with URL hardening enabled and umlaut in password fails
- NUTM-11202 [Web] Conform to Apple's new certificate requirements introduced in iOS13 and macOS10.15

Sophos has released UTM version 9.700. This version will be available in small increments and can be downloaded from the FTP server.

sophos-utm-update-v9-700-released

Sophos UTM Update v9.700 released

Since 20 August 2019, Sophos Sandstorm has been analysing your files at a data centre in Frankfurt am Main, Germany. This will certainly please customers who have concerns about compliance with the DSGVO or further Brexit development. On the XG firewall, the selection looks like this:

<single-image url="/blog/2019/sandstorm-data-center-location-dropdown@2x.jpg" alt="Datacenter selection for Sandstorm on the XG Firewall"></single-image>

## Sophos Sandstorm briefly explained
If you have licensed email or web protection on your Sophos firewall, whether UTM or XG, Sophos Sandstorm can provide you with additional security with these modules. Sophos Sandstorm analyzes files that are to be downloaded from the internet or sent as an email attachment in a Sophos data center first, and then finds them to be good or blocks them. If you would like to find out more about Sophos Sandstorm, please read [our blog post, in which we introduce Sandstorm in detail](/en/blog/sophos-sandstorm-with-sandboxing-against-zero-day-maleware-and-apts/).

## Data centers for file analysis
The following locations are available for Sandstorm for data analysis:

- Europe: Germany → Frankfurt *NEW*
- Europe: United Kingdom → London
- USA
- Asia: Japan, Tokyo

## Where can I select the new data analysis location in Frankfurt?
Sophos does not offer Sandstorm's technology only on UTM or SFOS. Sophos Sandstorm is also used on the web or email appliance. However, the new data analysis location of Frankfurt cannot be selected everywhere.

- **Sophos Firewall with SFOS (XG Firewall)** - The Frankfurt location has been selectable since 20 August 2019.
- **Sophos Firewall with UTM OS (SG Firewall)** - Frankfurt location can be selected from UTM version 9.7 onwards.
- **Sophos Web Appliance** - The Frankfurt location can be selected as of version 4.3.9.
- **Sophos Email Appliance** - Manual selection is not possible here.

If you automatically assign the analysis location for Sandstorm in the settings, "Frankfurt" will be selected automatically from October 2019, if you are also in this area. However, this is decided by the latency-based routing of the Amazon DNS.

Since 20 August 2019, Sophos Sandstorm has been analysing your files at a data centre in Frankfurt am Main, Germany.

sophos-sandstorm-data-center-opens-in-frankfurt-germany

Sophos Sandstorm data center opens in Frankfurt, Germany

Sophos has released version 17.5 MR8 for the Sophos Firewall OS (SFOS).

<alertmessage icon="alert">
 **Note**: For more information on upgrading, please take a look at the following post: [SFOS Firmware auf Sophos Firewall aktualisieren](/en/kb/upgrading-sfos-firmware-on-a-sophos-firewall/).
</alertmessage>

## FQDN in Quarantine Digest
Sophos has secretly listed a new feature among the 'Issues Resolved' which in my opinion definitely deserves a little more attention! I am talking about:

- NC-39749 [Email] Use FQDN in Quarantine Digest

If you check emails for viruses and spam through the XG Firewall, emails will be quarantined from time to time. In order to relieve the admin, you can configure that the users receive a quarantine report by email. This allows the user to decide for himself which email was incorrectly blocked and to have it moved to the inbox with a single click.

But clicking on the link to move the email from quarantine to the inbox caused problems so far! Behind this link was not an FQDN, but an IP address. Thus a certificate error message was always displayed, which was not necessarily trustworthy.

Of course, our customers were very disturbed by this and so we asked Sophos for a solution as early as March 2018. At that time it was said that the solution comes with v17.0, then 17.5 and finally in an MR release. With v17.5.8 this problem is finally solved. Thank you Sophos, we had almost given up hope. 😅

Now you can define a DNS name in the quarantine settings and also set the size of the quarantine.

<single-image url="/blog/2019/sophos-xg-firewall-17-5-mr8-email-quarantine-dns@2x.jpg" alt="Quarantine settings - Enable quarantine digest"></single-image>

## Added support for the Sandstorm data center in Frankfurt
Sophos has launched a [new data centre opened in Frankfurt](/en/blog/sophos-sandstorm-data-center-opens-in-frankfurt-germany/) for the analysis of files transferred to Sandstorm. This is certainly a wise move in terms of compliance with the DSGVO or further Brexit development. After updating to MR8 you can change the Sandstorm settings to **Europe (Frankfurt)**. The selection on the XG Firewall look like this:

<single-image url="/blog/2019/sandstorm-data-center-location-dropdown@2x.jpg" alt="Datacenter selection for Sandstorm on the XG Firewall"></single-image>

## Issues Resolved
- NC-47055 [Authentication] Support >48 characters password length for Radius Server
- NC-46680 [Certificates] Completing CSR with certificate breaks SSL VPN
- NC-48512 [Dynamic Routing (PIM)] Multicast traffic getting stopped after update of interface
- NC-39749 [Email] Use FQDN in Quarantine Digest
- NC-40831 [Email] Add capability to increase size of Mail Quarantine area in UI
- NC-45305 [Email] SPX related reports not being displayed on the GUI
- NC-48542 [Email] Potential RCE via arbitrary file creation vulnerability
- NC-49003 [Email] Custom ports for SMTP proxy stopped working after 17.5
- NC-46938 [FQDN] FQDNd doesn't update/create ipset
- NC-46401 [Import-Export Framework] "/conf" partition is at 100%
- NC-47095 [Interface Management] TSO changes are not permanent in HA
- NC-48031 [Interface Management] Wifi client did not get gateway and other config after reboot until enable and re-enable the wifi on client
- NC-48487 [IPS Engine] Postgres taking high CPU
- NC-48956 [IPS Engine] Modify IPS TCP Anomaly Detection setting to disabled in default setting
- NC-46079 [Logging Framework] Garner coredump on aux node following upgrade to 17.5 MR3
- NC-46780 [Logging Framework] Reports not being generated when Email Notification feature is enabled
- NC-46879 [Sandstorm] Add support for Sandstorm's Frankfurt data centre
- NC-48718 [Service Object] Unable to edit service object that is assigned to a firewall rule
- NC-43625 [UI Framework] Adding VLAN interface fails in IE in HA Active-Active mode
- NC-45371 [UI Framework] Incorrect UI behavior for Web User Activities
- NC-45495 [Web] Policy Tester UI and overlay issues
- NC-45724 [Web] Full file download retry failure after 416 (Range Not Satisfiable) being returned by proxy
- NC-47626 [Web] Web category "Hacking" should be classified as "Objectionable" instead "Acceptable"
- NC-47075 [Wireless] Export of the WirelessAccessPoint does not contain the Group
- NC-47115 [Wireless] WirelessAccessPoint includes the wrong value for DynChan5GHz
- NC-47738 [Wireless] XML import is failing for wireless config failing when RADIUS Server and Pending Access Points data is present in import file

Sophos has released SFOS v17.5 MR8. You can now download the new firmware from the MySophos portal.

sophos-sfos-update-v17-5-mr8-released

Sophos Firewall OS (SFOS) Update v17.5 - MR8 released

For over two years now, we have only put XG Firewalls into operation with the SFOS or installed the SFOS on SG appliances. To be honest, the XG Firewall was an absolute nightmare in the first versions and could only be used in a few environments. With version 16 it slowly got better and we dared to realize at least smaller projects with it. Starting with v16.5 we completely used XG for new projects and have never looked back on UTM since.

> To get rid of this right from the start, when I talk about the XG Firewall, I mean the XG Appliance series with the Sophos Firewall OS (SFOS). But we also manage SG appliances, on which we simply installed the SFOS. That works fine. 🙂

After we have already implemented several projects with the XG Firewall, I wanted to tell you what 7 reasons make the XG Firewall a better choice than the SG series with the UTM operating system. With this article I would like to contribute my part to the debate **UTM vs. XG**. 🥊

## 01 - Development
Today, when I'm looking for a new app for my smartphone or computer, I pay special attention to when the app was last updated. If I can't find a changelog, I look at the social account, e.g. Twitter. Any activity older than one year is dead to me and the app will definitely not make it to my smartphone or computer.

I admit, it's not that bad with the UTM Firewall. But the update cycles have been extremely extended. There used to be an update for the UTM almost every month. Today it's about every 4 months and there are hardly any new features.

The reason is this: Sophos has about 300 developers working on the SFOS and UTM operating systems. But only about 5% of these developers are still working on the UTM operating system. The rest are working on the XG Firewall. So you can also see from the manufacturer where the priorities are.

Every now and then they give the UTM users some hope with a new feature. But actually they have been looking for a recipe for a long time to make the XG appealing to loyal followers without losing it to another manufacturer. But as a former UTM user I know that you don't change a system that quickly if you don't really have to. So as long as the UTM is not finally discontinued, there is simply no reason for the majority to change.

If you look at the roadmap of the two operating systems, the list for the SFOS is extremely long and the plans go far beyond 18 months. With the UTM, functions have been removed in the past from the roadmap or moved further and further back. A prominent example here is IKEv2. The feature was on the roadmap for a long time and was moved again and again and finally even removed completely from the roadmap. After an outcry in the community, it was added again and will be released in version 9.8 next year.

With the Sophos Firewall OS, things look completely different and that's why this is the first reason we love the system. Approximately every seven weeks we are happy about new *MR - Maintenance Releases* and 1 or 2 times a year there is a *MINOR* release with lots of new features.
The Sophos Firewall OS has therefore gone from "good" to "very good" over the last few months. The system isn't quite where it should be yet and still has a few flaws. But for such a young OS, the progress has been very big!

## 02 - Hardware
The Sophos XG Firewall hardware and the SG series are identical in terms of CPU, RAM, memory and ports. A minor exception is the Sophos XG 86 and XG 106, which do not exist in the SG series. The two smallest models would be the SG 85 and SG 105, which have less RAM and memory than the XG 86 and XG 106. However, it is basically possible to install the SFOS of the XG Firewall on SG hardware. The license can then be migrated 1:1.

We have explained how to install SFOS on a Sophos SG appliance in a KB post:
[Install Sophos XG Firewall OS on a SG Appliance](/en/kb/install-sophos-xg-firewall-os-on-a-sg-appliance/)

In the next year a new hardware series is expected, which currently listens to the name "XGS". We can't say at this point if it will replace the XG series. In any case, only the SFOS will be mentioned as a compatible operating system. No new release is planned for the SG series.

What also speaks clearly for an XG Firewall with SFOS at the moment is the support of the new APX Access Points! The access points, which were launched in July 2018 and feature the new Wave 2 standard, are still only compatible with XG Firewalls and Central. Sophos has always said that APX access points would never be compatible with the UTM. For us, this step always made perfect sense! This is NextGen hardware, which was developed only for NextGen Firewalls.

Shaking our heads, however, we can now announce that Sophos has rowed back on this plan. APX access point support will come for UTM! Support is planned for UTM 9.7, which will be released at the end of the year.

## 03 - Licensing
The licensing of the XG Firewall is not completely different from the licensing of the UTM. Nevertheless, there are some important advantages.

### Base License
The base license of an XG Firewall Appliance is included free of charge. You can find out which features are included in a separate article about the [Base License](/en/kb/sophos-firewall-os-base-license/). But here are the most important things you can enjoy for free:

- Wireless protection
- SSL VPN or Sophos Connect Client
- IPsec VPN connections

### EnterpriseGuard Bundle
You probably know the **FullGuard Bundle**, which unlocks all modules except Sandstorm on the Firewall. With the **FullGuard Plus Bundle** you also get Sandstorm.

For the XG series there is also the popular **EnterpriseGuard Bundle**. This bundle is a real alternative to the **FullGuard Bundle**, because it already covers the needs of most customers. With the **EnterpriseGuard Bundle**, you get Network and Web Protection, including Sophos Premium Support. Wireless protection is already included free of charge in the base license. As a result, only very few customers have to choose the more expensive **FullGuard Bundle** as long as there is still a need to protect Emails and Web Servers.

## 04 - Firewall rules
Let's now come to the more technical part, why in my opinion the SFOS is ahead of the UTM operating system.

The Firewall rules have become much clearer for SFOS. If you have more than 10 Firewall rules, which should be the case in most environments, they can be grouped in SFOS very well. The following screenshot of my XG Firewall from home should illustrate this. Here all IoT devices have their own network and the Firewall rules are grouped together.

<single-image url="/blog/2019/sophos-xg-vs-utm-firewall-rule-overview@2x.jpg" alt="Firewall rules are grouped together"></single-image>

If you then take a closer look at a group, you will quickly find out through which individual Firewall rules traffic still passes and which rules may no longer be used. This helps to detect and remove unnecessary rules.

<single-image url="/blog/2019/sophos-xg-vs-utm-firewall-rule-detail@2x.jpg" alt="Detailed view of Firewall rules in a group"></single-image>

In contrast to UTM, I can give a Firewall rule its own name in SFOS. Within a rule, longer comments are also possible, for example to record who created this rule and what this rule was made for.

- Each rule gets an ID, so I can check in the log which traffic goes through this rule.
- You can see at a glance whether the IPS or the web filter is active for a rule or not.

Regarding Firewall rules, I could theoretically give you many more advantages that underline why I would never go back to a UTM again. But I'll leave it with the main arguments listed above, which should already convince every Firewall admin. 🙂

> Even if SFOS has been improved a lot regarding Firewall rules, there is a very annoying disadvantage compared to UTM with SFOS. Saving a Firewall rule takes between 4-10 seconds for XG 86 till XG 135 Firewalls! This circumstance will be improved in v18 first and then completely fixed in v19.

## 05 - Log Viewer
Even after several years on the XG Firewall, the Log Viewer is still an absolute highlight! This makes it quick and easy to check logs directly via the GUI. But before I lose too many words about it, have a look at the following video:

<videoblock video-id="333278580" provider="vimeo"></videoblock>

## 06 - Sophos Central
No, don't be afraid! I'm not going to come up with **Sophos Synchronized Security**, from which Sophos's marketing department has kicked off the slogan of the century. But if it helps you trade in your UTM for an XG, then of course we'll jump on the train. Did you know that with Synchronized Security on the XG Firewall you can see which applications are running on the endpoints? 😂 So yes, Synchronized Security will bring even more ingenious possibilities in the future!

But let's now come to a feature regarding Central that is still in its early stages, but has a huge potential. I'm talking about **Central Firewall Management**. This makes it possible to link the Firewall to Central and manage it over it. Such a connection can already be made but the really interesting functions are yet to come! I can't tell you too much here yet, but if Sophos does it right, it could end up being a management for SDN. We can expect new features by the end of this year.

## 07 - Firmware Updates
As I said, we always like updates. The saying **never change a running system** is absolute nonsense when it comes to the Firewall. We've already mentioned this in an earlier post [about the need for Firewall updates](/en/blog/firewall-updates-ignoring-is-not-an-option/).

I'm sure you guys understand that updates are important. But updates are also very dangerous, because it can happen that not everything works as smoothly as before. From admins who are afraid of it, you will always hear the above quote. 😅

In order to reduce the risk of updates, there are some improvements on the XG Firewall:

1. The updates of access points and REDs are detached and no longer integrated in the Firewall update. Thus the REDs can be updated without restarting the Firewall.
2. If a Firewall update did not work and you want to return to the previous version, you can do this with a few clicks.

## Conclusion
This article is now a bit longer than I originally had in mind. I've listed seven reasons here that in my opinion should encourage every UTM friend to change. I used to adore UTM too, but especially in terms of future security, updates and a clear vision, our minds suggested the change early on and we have never regretted it! When it comes to the comparison **UTM vs. XG**, the XG clearly has the more impressive combat weight on the scales for us. So be brave or much more reasonable (😅) and rely on an XG firewall for your next project. Once this step has been taken, you can start migrating your UTMs to the SFOS.

## Drawbacks
Even though the SFOS offers many excellent features, you might get the feeling that this article was written through pink glasses. That's why I'm going to add a short chapter with the disadvantages, because SFOS is still a very young operating system and there are some things that don't work so well yet.

**Speed of the GUI**
- Loading or saving Firewall rules still takes too long and not the way you want.
- Generating reports or system resources needs definitely a speed boost.

_* As already mentioned in the article, these things will be better done with v18 and solved with v18.5._

**Rename Objects**
- Unfortunately it is not always possible to rename entries afterwards. This includes for example zones, wireless networks, active firewall NAT ports, IPS protection policies, web server protection policies, IPsec policies and some more.

_* The reason for this is that the developers of the Cyberoam firewall, which is still the basis for the SFOS, used the name for these objects in the database as the primary key. Of course, this makes renaming the objects afterwards rather difficult. But this is also being worked on and first improvements are expected with v18._

**NAT Rules**
- Created NAT rules can no longer be edited if they are active. You must first deactivate them, edit them and then reactivate them again.

_* To be corrected with v18._

**Notifications**
- The notifications in the UTM system are a lot better. You can be notified of practically anything by email. The SFOS offers almost no options in this respect. With [SFOS 17.5 MR4 something has been improved](/en/blog/sophos-sfos-update-v17-5-mr4-released/), but there are still not these possibilities offered, which we took for granted at the UTM.

_* To be further improved with v18._

## More information
In this article I often refer to v18, which is supposed to bring many improvements. According to Sophos, the v18 will be released by the end of 2019. However, we are very optimistic about this timing and believe that the first quarter of 2020 will be more accurate. 😅

We have already implemented several projects with the XG Firewall. I'll give you 7 reasons why SFOS is the better choice than UTM.

7-reasons-why-the-xg-firewall-sfos-is-better-than-the-utm

7 reasons why the XG Firewall (SFOS) is better than the UTM


In April the [new XG 86 and XG 106 models were introduced](/en/blog/new-firewall-hardware-sophos-xg-86w-and-xg-106w/) and at the same time the [XG 85 and XG 105 were discontinued](/en/blog/sophos-xg-85-and-xg-105-end-of-sale/) for the middle of the year. Meanwhile, it is known that Sophos did this because the future SFOS v18 firmware will require at least 4GB of RAM.

## 1Core 2GB RAM to 1Core 4GB RAM Upgrade
So far we only talked about the hardware, but it was almost forgotten that there is also a variant for 1Core and 2GB RAM for the virtual/software licenses. Sophos plans to automatically upgrade all existing 1Core 2GB RAM to 1Core 4GB RAM. So if you have such a license, you will benefit from a free update. 👏

The automatic upgrade is expected to be completed by the **end of July 2019** and will not disrupt operations for customers currently using the 1C2 license.


Sophos plans to automatically upgrade all existing 1CPU 2GB RAM to 1CPU 4GB RAM free of charge by the end of July.