• Hardware
    • Firewall
      • XGS Appliances
        • XGS 87
        • XGS 107
        • XGS 116
        • XGS 126
        • XGS 136
        • XGS 2100
        • XGS 2300
        • XGS 3100
        • XGS 3300
        • XGS 4300
        • XGS 4500
        • XGS 5500
        • XGS 6500
      • XG Appliances
        • XG 106
        • XG 115
        • XG 125
        • XG 135
        • XG 210
        • XG 230
        • XG 310
        • XG 330
        • XG 430
        • XG 450
        • XG 550
        • XG 650
        • XG 750
      • XG Accessories
      • SG Appliances
        • SG 105
        • SG 115
        • SG 125
        • SG 135
        • SG 210
        • SG 230
        • SG 310
        • SG 330
        • SG 430
        • SG 450
        • SG 550
        • SG 650
      • SG Accessories
    • Access Point
      • Appliances
        • APX 120
        • APX 320
        • APX 530
        • APX 740
        • APX 320X
        • AP 100X
      • AP Accessories
    • RED
      • Appliances
        • SD-RED 20
        • SD-RED 60
      • RED Accessories
  • Licence
    • Firewall
      • XGS Licences
        • XGS 87
        • XGS 107
        • XGS 116
        • XGS 126
        • XGS 136
        • XGS 2100
        • XGS 2300
        • XGS 3100
        • XGS 3300
        • XGS 4300
        • XGS 4500
        • XGS 5500
        • XGS 6500
      • XG Licences
        • XG 85
        • XG 86
        • XG 105
        • XG 106
        • XG 115
        • XG 125
        • XG 135
        • XG 210
        • XG 230
        • XG 310
        • XG 330
        • XG 430
        • XG 450
        • XG 550
        • XG 650
        • XG 750
      • SG Licences
        • SG 105
        • SG 115
        • SG 125
        • SG 135
        • SG 210
        • SG 230
        • SG 310
        • SG 330
        • SG 430
        • SG 450
        • SG 550
        • SG 650
      • SFOS Software
        • 1 CPU 4GB RAM
        • 2 CPU 4GB RAM
        • 4 CPU 6GB RAM
        • 6 CPU 8GB RAM
        • 8 CPU 16GB RAM
        • 16 CPU 24GB RAM
        • Unlimited CPU / GB RAM
      • UTM Software
        • 10 User
        • 25 User
        • 50 User
        • 75 User
        • 100 User
        • 150 User
        • 250 User
        • 500 User
        • 750 User
        • 1000 User
        • 1500 User
        • 2500 User
        • unlimited User
    • Central
      • Endpoint Protection
      • Intercept X
      • Intercept X Advanced
      • Intercept X Advanced with EDR
      • Intercept X Advanced with EDR and MTR
      • Server Protection
      • Intercept X Advanced for Server
      • Intercept X Advanced for Server with EDR
      • Intercept X Advanced for Server with EDR and MTR
      • Mobile
      • Intercept X for Mobile
      • Wireless
      • Email Gateway
      • Device Encryption
      • Phish Threat
      • Firewall Reporting
  • Service
  • Blog
  • Support
  • Contact
  • English
    • Deutsch
Sign in
My Account
Cart
  1. Home
  2. Blog
  3. Sophos Firewall
  4. Sophos XG Update v17.5
  • Sophos Firewall 35
  • Sophos Central 28
  • Avanet Shop 32
  • Security Life 14

Subscribe

Subscribe to our Newsletter, RSS Feed or follow us on Social Media to make sure you don't miss an article.

Subscribe Now
Sophos XG Update v17.5 - All new features at a glance
sophos-firewall

Sophos XG Update v17.5: All new features at a glance

Patrizio November 14, 2018

In early November we installed the second beta of the new SFOS 17.5 firmware and took a closer look at it. At the Sophos Roadshow in March 2018 in Dübendorf it was still mentioned that there were versions 17.2 and 17.3, but Sophos has decided to pack all the planned features together and take the plunge to version 17.5 right away.

We can anticipate one thing from this report: The SFOS 17.5 is causing us rather mixed feelings. There are cool new features, but from our point of view they weren’t always thought through to the end.

Lateral Movement Protection

Since the first version of Synchronized Security, it has been possible for the Endpoint Client to share its status with the firewall. Thanks to this feature, we can deny a workstation that has not received updates for a long time, or is already infected, access to the file server or the Internet, in order not to compromise other systems.

However, such a configuration previously also required good network segmentation. If all devices in a company are connected to the same switch and they are on the same network, the Security Heartbeat has not really had an effect until now.

With SFOS 17.5 this feature was extended and improved. It is now also possible to isolate computers that Synchronized Security classified as “unhealthy” from other computers in the same broadcast domain or network. The firewall automatically informs all other clients if there is a problem with one client. So now not only the firewall knows if something is wrong with one client, but also all other clients in the network. This allows an infected device to be isolated even more effectively until the problem has been resolved. As soon as the security heartbeat status changes back to “green”, the connection to other systems in the network is automatically re-established.

Sophos XG v17.5 - Lateral Movement Protection

In addition, IPS detection of vulnerable endpoints can now trigger a “red” heartbeat. This further improves network threat protection.

Forwarding Portal URL

During my tests I noticed a feature that was smuggled into the new version, because it is not mentioned anywhere in the release notes.

I’m sure you’re all familiar with that. When a web page is blocked by the Sophos web proxy, a warning page is displayed to the user. If the user wants to access the page anyway, an IP address would hide behind the link instead of a normal URL. In version 17.1, this could at least be changed from the console. With 17.5 this can now be done conveniently via the web interface of the XG firewall. 👍

Sophos XG v17.5 - Use hostnames instead of URLs

Switching from an IP address to a web URL only works for the web part! If the XG firewall scans your emails, for example, it is common for users to receive a quarantine report from the firewall. This will tell you which emails Sophos Firewall has blocked. By clicking on a link, you can manually release the supposed spam message. But this link is still an IP address, which works technically but gives the user a certificate warning.

Switching from an IP address to a web URL was not finished for the email part. I have received feedback from Sophos that it may be delivered with MR1 or MR2 and that the developers are working on it. I’d rather bet on MR2 here, which we can expect around January or February.

Synchronized User ID

EOne of the most common tasks that a firewall has to perform is to transport traffic from A to B, provided that a firewall rule has been created for this purpose. The traffic comes and goes to one IP address at a time. As administrators, we would like to know from which devices the traffic is generated or even better from which user. This helps us to create user-based firewall rules, network transparency or more understandable reports.

On the SFOS there are several ways to recognize the user. In the past, we used the connection to an Active Directory server, which forwarded the user information through an installed agent of the XG firewall. In some environments, however, the agent was not an option.

With SFOS v17.5, endpoints on an Active Directory domain can now share user identity with the firewall via the Security Heartbeat. This makes user identification seamless and easy without the need to deploy an agent to the domain controllers. This feature can be very helpful in many situations.

Terminal servers or Linux hosts are not covered by this solution. For the former, STAC is still the best solution. However, the exceptions are large. Mac clients do not work with an Active Directory and VPN users do not log on to it.

You can only benefit from this feature if one of these products is installed on the clients:

  • Sophos Central Endpoint Protection
  • Sophos Central Endpoint Intercept X
  • Sophos Central Intercept X Advanced

In my opinion, it becomes interesting when clients that are not in a domain share their user data with the XG. This feature only solves a very small problem.

Sophos Connect IPSec VPN Client

Our post Install SSL VPN Client is one of the most popular posts in our knowledge base. For many of our customers, VPN was one of the most popular requirements before purchasing a Sophos Firewall.

As described in this guide, we currently use Sophos’s SSL VPN client very often. However, it can only be installed on Windows computers. Until now, macOS required the use of third-party tools such as Tunnelblick.

With Sophos Connect, Sophos is now introducing its own IPsec VPN client, as other vendors are doing. Sophos Connect also supports Synchronized Security. While this has worked with the SSL VPN client to date, it has required additional configuration.

Here is a screenshot of what the Sophos Connect IPsec VPN client settings look like on the XG firewall:

Sophos XG v17.5 - Sophos Connect IPSec VPN Client Admin settings

Sophos Connect is currently in beta and the client is currently available for Windows and macOS. Here is a screenshot of the Mac and Windows clients:

Sophos XG v17.5 - Sophos Connect IPSec VPN Client for Mac and Windows

The new IPsec VPN client from Sophos comes with “Sophos Connect Admin” as an additional tool. This allows you to edit a config file later and, for example, customize the hostname or enable 2FA.

Sophos XG v17.5 - Sophos Connect Admin Client

Sophos Central Management

With the new SFOS 17.5 firmware a long made promise is finally kept. The Sophos Central platform can now also be used to manage the XG firewall. Certainly the right step, but the features are still limited in the first version.

To connect your central account to the firewall, you must first enable central management on the XG firewall.

Sophos XG v17.5 - Manage XG Firewall in Central

Update 20.11.2018 Sophos Central has now received an update, which now displays the ‘Firewall Management’ menu item. By enabling Central Management on our XG firewall, we were able to successfully integrate the device into our Sophos Central account.

If you connect to the firewall via Sophos Central, you are then logged on to the firewall as admin. The downside is that, in theory, other users who have access to Sophos Central Admin can now access the firewalls. It is enough for these users to have read-only permission. We hope that in the future it will be possible to control more precisely who has the right to log on to the firewalls via Central.


Firewall management via SSO

If you have Central Management enabled on your firewall, you can log in to Sophos XG Firewall directly from the Central interface without having to log in.

Central Backups

By default, Central Management also stores the backups of your firewall on Central. If you don’t want this, you can simply disable this feature on your XG Firewall.

Sophos XG v17.5 - XG Firewall backups in Sophos Central

Central Notifications

If the firewall has been linked to Central, you will also see the firewall messages in the Central Dashboard. These include interface or VPN failures, resource utilization, license notifications, and security alerts.

Firmware Update

From Sophos Central, you can update your firewall firmware to the latest version with a single click.

Light-Touch Deployment (Zero-Touch Deployment)

The “Light-Touch Deployment” is a really cool thing! In the future it will be possible to configure a new XG firewall via Central. First you click your way through a small wizard that spits out an XG config file at the end. This configuration can then be downloaded and copied to a USB stick. Then the new firewall has to be started with this stick and the configuration is transferred. If you have done everything correctly, you can access the firewall via Sophos Central and perform the remaining configurations.

Sophos XG v17.5 - Light-Touch / Zero-Touch Deployment

Light-Touch Deployment” will make it a lot easier for us to set up XG Firewalls for our customers in the future. For our setup and configuration service we have the firewalls delivered to our office and create the basic configuration directly on the devices. Then we send them to the customer, who only has to take the firewall onto the network. With the “Light-Touch Deployment” we can skip the shipping of the hardware to us in the future and are therefore at least one day faster. 😎

Since this workflow requires a Central Account, we will probably not be able to apply this procedure to every new customer.

Synchronized Security – Synchronized Application Control improvements

Synchronized Application Control was first introduced in Version 17.0 and further improved in Version 17.1. With this feature, Sophos wanted to provide a solution to the basic problem that a large proportion of network traffic is still difficult to control and can pass through the firewall relatively undetected even with HTTP/HTTPS scanning. With Synchronized Application Control, the endpoint tells the firewall exactly what software is causing the traffic. This makes it much easier to classify network traffic.

With v17.5 the following improvements have been implemented:

  • View Windows and Mac system applications in a separate list
  • Hide applications and then use a new filter option to show hidden applications and show or hide applications.
  • There is also a new option to highlight applications to remove them from the “new” list.
  • Improved pathname display
Sophos XG v17.5 - Synchronized Application Control improvements

Log Viewer

The Log Viewer is one of the things I learned to treasure at XG. Every now and then it’s not the fastest, but I’m sure they’re working on it. With version 17.5 there is now the possibility to customize the view (custom column selection). You can now choose which columns you really need.

Sophos XG v17.5 - Log Viewer

Web Policy Improvements

Imagine a teacher working with his class on a computer and a required website being blocked. In such a situation the admin always had to be called to unlock the site. In SFOS version 17.5 there is now a feature in the web guidelines that allows you to allow authorized users to access blocked websites anyway. So you could give this teacher the possibility to activate this website, domain or category himself via the User Portal.

Each rule receives a code, which he can then share with the class. On the blocked page, the students can then enter this code and temporarily go to the actually blocked website.

As administrators, we then see in a list which codes have been generated and can delete them again. The admin can also define locations or categories which cannot be bypassed by the teachers.

Here are a few more small changes that will be available in SFOS version 17.5 in the web policy:

  • Setting a default search engine
  • SafeSearch and YouTube Restrictions
  • Limiting the file size for downloads
  • Google App domain restrictions are all set on a policy-specific basis
Sophos XG v17.5 - Web Protection general settings

Chromebook Authentication

Chromebooks are becoming increasingly popular in education and in some corporate environments (since Apple devices are becoming more expensive) 😉. User identification on this operating system is different from other systems and has not been supported by the XG firewall until now. With v17.5, Sophos offers a Chromebook extension that shares Chromebook user IDs with the firewall. This enables policy enforcement and user reporting. However, an Active Directory server is required to synchronize with Google Gsuite. The Chrome extension is launched from the Gsuite management console and provides a simple deployment that is transparent to the user.

Client Authentication Agent

The XG Firewall Client Authentication Agent provides the ability to tell the XG Firewall which user is currently logged on to the computer without Active Directory. To do this, simply run the Client Authentication Agent on the device.

The client is available for Windows, macOS, Linux 32/64 Bit, iOS and Android. The download can be found in the User Portal.

Sophos XG v17.5 - Download the Client Authentication Agent in the User Portal

Now there is support for

  • the installation per machine (and not per user)
  • an option to hide at startup
  • an option for the user to explicitly log off.
  • automatic reconnection when waking up from sleep mode
  • MAC address telemetry sharing to support MAC address filtering
  • a new taskbar icon
  • Windows XP (for whatever reason this was done)
Sophos XG v17.5 - Client Authentication Agent Task list

Management Improvements

If you create a new firewall rule, you can now directly assign it to a group. There is also a new automatic group assignment, although it didn’t work very well for me. In my tests, the firewall wanted to automatically assign my rule to a group, but I didn’t want it in that group.

Sophos XG v17.5 - Automatic group assignment

Other improvements

Email

  • At 17.5 it switches back to the Exim Engine, which is also used on the UTM.
  • Receiver check via Active Directory
  • The web protection of SFOS is now almost identical to that of the UTM operating system.
  • Sender Policy Framework (SPF) spoofing protection.

IPS Protection

  • More categories to optimize the rules even more. Provides better performance and more protection.

Wireless

  • Support for Radius server failover with multiple servers.

IPsec

  • SD-WAN failover and failback
  • IPsec failover - Redundant groups for IPsec connections to switch to another WAN link during a failover. As soon as the main connection is available again, you can switch back again.

What can we expect in the next versions?

In the coming weeks / months maintenance releases will be released as usual, which will provide some more features.

Sophos Wireless APX Access Point Support

Sophos’s new APX Access Points could only be used with Sophos Central. However, support for the XG firewall is expected in MR1, which will be released approximately 2-4 weeks after the 17.5 release. The APX 120, which will be available for less than 200 CHF, will not be released until January 2019.

Airgap Support

There are XG firewalls that are not connected to the Internet. A license activation was unfortunately not possible with these devices so far. There is now an option to download the license and updates to the firewall using a USB stick.


More information

  • PDF: XG Firewall - What’s new in v17.5

Sophos Platinum Solution Partner Logo

Purchase Advice

+41 44 585 24 68

Mo - Fr, 9:00 - 12:00 Uhr
Mo - Fr, 13:00 - 17:00 Uhr

Information

  • Payment
  • Shipping & Delivery
  • Order
  • Index of Information
  • Follow us
  • About us

Legal Issues

  • AGB
  • Legal Notice
  • Privacy Policy