Manage Windows Firewall with Sophos Fusion Endpoint
The Windows Firewall Policy in Sophos Fusion (formerly Sophos Central) monitors or configures the host firewall built into Windows. It doesn’t create detailed rules: exceptions remain local Windows Firewall rules or are distributed through a dedicated system such as Group Policy or MDM.
Product boundary: This policy applies to Windows computers and Windows servers. It has nothing to do with a Sophos Firewall appliance, its network rules, NAT, VPN, or Central Firewall Management. The path for computers is My Products > Endpoint > Policies; for servers, it is My Products > Server > Policies.
Quick path
- Select Add Policy, choose Windows Firewall as the feature and, for Endpoint, select the required policy type.
- On the policy details page, assign the required devices or groups.
- Under Settings > Monitor Type, start with Monitor Only.
- Turn on the policy and record the reported state and existing rules in a pilot group.
- Only then switch to Monitor & Configure Network Profiles and set inbound connections for Domain Networks, Private Networks, and Public Networks.
This cautious start matters: Sophos explicitly warns that other firewalls and Windows Group Policy can affect how the policy is applied. The existing rule base must also continue to allow communication with Sophos.
Choose the correct Monitor Type
| Mode | Meaning |
|---|---|
| Disabled | Uninstalls the Sophos firewall component from the endpoint; this choice is documented in the current Endpoint help, but not in the separate Server policy |
| Monitor Only | Reports the firewall state without changing the profiles |
| Monitor & Configure Network Profiles | Reports the state and sets the chosen inbound action for each network profile |
Monitor Only is the documented default and the safe baseline for existing GPO or MDM management. Disabled doesn’t merely mean “don’t configure”: on endpoint computers it uninstalls the component. For Windows servers, Sophos documents only Monitor Only and Monitor & Configure Network Profiles.
Inbound connections for each network profile
Domain, Private, and Public offer three actions:
- Block All: blocks all inbound connections for the profile.
- Block (with exceptions): blocks inbound connections unless an exception configured locally on the computer or server allows them. Without exceptions, all inbound connections are blocked.
- Allow All: allows all inbound connections for the profile.
According to Sophos, these choices control inbound connections; they aren’t a general outbound-traffic rule. Block (with exceptions) is usually the sensible production baseline. Allow All increases the attack surface, while Block All can interrupt management, authentication, printing, file access, and support access.
Establish the Windows profile and rule owner
Windows applies the Domain, Private, or Public profile according to the detected network. A domain-joined device uses the Domain profile automatically when it detects a domain controller. Public is the default for unidentified networks. Include at least one device for every profile actually used in the pilot.
When Sophos Fusion configures the profiles, the policy prevents changes to Windows Firewall through Windows Security Center. This is intentional, but it may change the helpdesk process.
Before using Configure mode, appoint an owner for detailed rules. Sophos Fusion only sets the profile action here. Windows administration still determines which local rules may merge and which rules originate from GPO or MDM. Explicit Windows block rules take precedence over conflicting allow rules, so the presence of an apparent exception doesn’t guarantee traffic flow.
Roll out safely to a pilot group
1. Record the baseline
Include computers or servers from the profiles actually used, plus a home-office client if that scenario applies. In Monitor Only, record active profiles, existing local rules, GPO or MDM settings, third-party firewalls, and applications that require inbound connectivity.
2. Configure the policy
Under Settings > Monitor Type, select Monitor & Configure Network Profiles. Set a deliberate action for Domain Networks, Private Networks, and Public Networks. Before switching, deploy required exceptions locally or through the agreed Windows management channel and restrict them to the correct profiles. Move the pilot policy above more general Windows Firewall policies in the policy list because Sophos Fusion applies the first active policy with a matching scope. During the pilot, change and verify just one profile that is actually in use first.
3. Validate the effect
After saving, first confirm that the policy is turned on and assigned to the test device. Then open My Environment > Computers & Servers > test device > Policies and confirm that the pilot policy’s name is shown as the policy actually applied for Windows Firewall. Only then test required inbound connections for each active profile, such as Remote Support, printing, or approved client-server services. Sophos Fusion communication, DNS, DHCP, sign-in, software distribution, and normal endpoint operation remain part of acceptance. A green firewall status alone doesn’t prove that every required connection works.
4. Return safely
Before the change, retain tested management access that is independent of the affected network path. If unexpected blocks occur, set the same policy back to Monitor Only, save it, wait until the test device receives the change, and retest traffic. If Sophos Fusion communication is already interrupted, a remote rollback over that same path isn’t sufficient; use the prepared alternative access. Disabled isn’t a quick rollback because it uninstalls the component on endpoint computers.
Monitor another registered firewall
If another host firewall is registered with Windows Security Center, Sophos can monitor its state. This doesn’t mean Sophos Fusion can configure its rule base. A green state confirms only the protection state reported by Windows, not the quality of all rules.
Troubleshooting by symptom
For unexpectedly blocked traffic, first check the active Windows network profile, the Sophos policy actually applied, and effective Windows Firewall rules. Then inspect the GPO Resultant Set, MDM settings, and registered security products. Pay particular attention to conflicting explicit block rules and exceptions scoped only to the wrong profile.
If a user can no longer change Windows Firewall in Security Center, that is expected in Configure mode. If local changes are required, adjust the operating model instead of manipulating the Endpoint agent.
If Sophos Fusion reports the wrong state, check Windows Security Center, the registered firewall, service status, events, and policy receipt. A restart may be required after a component change. A broad Threat Protection exclusion isn’t a repair for the firewall policy. Don’t carry old registry or audit-policy workarounds over to current agents. Record the installed agent version and incident time window, then use Sophos Endpoint updates, cache and Message Relay to correlate the onset with component changes and review known release issues. If there is no match, escalate to Sophos Support with the exact agent version, timestamps, and logs.
Related articles
Build Sophos Fusion Endpoint policies correctly explains policy assignment. Agent network access and proxy requirements are covered separately.