Using Sophos Firewall Config Studio

Sophos Firewall Config Studio is the browser-based successor to Configuration Viewer. The tool creates reports from an Entities.xml file, compares two or more configuration versions, and prepares changes or migrations. Processing takes place locally in the browser; the configuration is not uploaded to Sophos.

Config Studio is particularly useful for reviews, before-and-after comparisons during changes or firmware updates, and preparing larger rule-set changes. However, it does not replace a restore backup or real functional tests. For a current traffic problem, Log Viewer, Policy Test on the firewall and Packet Capture are more direct.

Export and protect Entities.xml

Config Studio does not compare encrypted restore backups. Before a production change, two different file types are therefore required: a full backup as a recovery path and Entities.xml exports for Config Studio.

1. Under Backup & firmware > Backup & restore, create a current restore backup and store it securely.
2. Open Backup & firmware > Import export.
3. Select Full configuration for a complete report or Selective configuration for individual modules. For a selective export, enable Include dependent entity if required.
4. Download the export. If SFOS supplies a .tar file, extract it and use the Entities.xml file it contains.
5. Export a second Entities.xml after the change.

If the file may later be imported into a firewall again, do not rename it. Clear folder names still prevent confusion, for example:

firewall-site-before-change-2026-07-16/Entities.xml
firewall-site-after-change-2026-07-16/Entities.xml

⚠️ Important: Entities.xml and restore backups contain sensitive information about the network structure, rules, objects, VPNs and services. Process them only on a trusted administration device, do not share them through personal cloud storage, messengers or uncontrolled email distribution lists, and archive or delete them securely afterwards.

Create or restore a Sophos Firewall backup explains how backups, the Secure Storage Master Key, restore compatibility and interface mapping work together.

Review a configuration as a report

1. Open Configuration report in Config Studio.
2. Upload the Entities.xml file.
3. Select a module or use Global search to find rules, objects and where they occur.
4. Use Policy test to check which rules and routes match a specified source and destination.
5. Use Usage reference to see where an object is used, and Analyze to check for shadowed or duplicate rules and objects.
6. Document the reviewed version with Download as HTML.

Since Config Studio 2.6, the report shows referenced object values directly in firewall, NAT and TLS rules. This makes it easier to see what is behind an object name and which additional rules a change affects.

During a review, pay particular attention to broad sources, destinations or services, old NAT, VPN or WAF rules, duplicate objects and deliberately enabled security functions. Also review management access under Device Access, because normal firewall rules do not control access to WebAdmin, SSH, User Portal or VPN Portal.

Policy Test in Config Studio evaluates the exported configuration, not current packet flow. Therefore, confirm notable Analyze results in WebAdmin and, where necessary, with real connection tests.

Compare multiple configurations

Config Studio 2.6 can compare two or more Entities.xml files as a timeline. The files are sorted by their modification date.

1. Open Compare configurations and upload the export files.
2. Use the module filter to select only the affected areas.
3. Expand the Removed, Modified and Added categories.
4. Review expected and unexpected differences.
5. Save the result with Export HTML.

For a simple change, the exports immediately before and after are sufficient. Other useful pairs are before and after a firmware update, hardware migration or incident, or a comparison with a reference configuration. Multiple versions help identify when a change first appeared.

Classify the differences briefly during the review:

• Planned: Compare with the change objective and ticket.
• System-related: Check firmware, certificate or internal reference changes.
• Unexpected: Identify the administrator account and time through the Audit Trail or, if necessary, configuration-audit.log.
• Missing: Check whether the change was saved, synchronised or imported.
• Removed: Check dependencies in rules, NAT, VPN, WAF and Device Access.

Config Studio shows what differs between the versions. Audit Trail answers who made the change and when.

Prepare changes and templates

In the Configuration editor, an Entities.xml file can be imported with either Keep all configurations or Keep only editable configurations. Depending on the module, new entries can be added with Add or Bulk add. Config Studio 2.6 can also merge a base configuration with Sophos or industry templates.

After editing, Preview provides Import XML, API Request and cURL formats. Download generates XML or a TAR file for importing into the firewall.

⚠️ Check before applying: Never import or execute editor output on a production firewall without reviewing it. Especially for NAT, VPN, interfaces, Device Access, Authentication and HA, dependent objects, target names, zones and services must be correct. A current backup, maintenance window, recovery path and subsequent functional tests are part of the change.

How Entities.xml, companion files, the Secure Storage Master Key, and import merge behavior interact in a manual WebAdmin import is explained in selectively export and import configuration.

For API or curl output, also verify the API account, source IP address and permissions. Secure configuration is described in Secure Sophos Firewall XML API access. After applying the change, check the affected services, Log Viewer and a new configuration comparison.

Check migrations and hardware replacements

Under Migrate to Sophos Firewall, Config Studio converts configurations from Sophos UTM, SonicWall, FortiGate and Palo Alto Networks. The results report shows what is fully, partially, manually or not supported; Config Studio 2.6 also provides a conversion rate and recommended follow-up work.

A percentage does not replace acceptance testing. Before importing, review entries that were not migrated as well as zones, interfaces, rules and dependent objects. Afterwards, validate at least VPN, NAT, WAF, routing, DHCP, DNS, HA and management access with real tests.

For SFOS 20.0 MR2 and later, the integrated Backup-restore compatibility view helps check XG and XGS target models beforehand. It shows port layouts as well as compatible Flexi Port modules, transceivers and port standards. For the complete process, follow the backup and restore article, the comparison of XG and XGS, and, for clusters, the HA variants.

The release highlights for multi-file diff, templates and migration insights are summarised in Sophos Firewall Config Studio 2.6.

Troubleshooting

Config Studio does not load the export

Check that the file is actually Entities.xml from Backup & firmware > Import export. A .backup file from Backup & restore is incorrect; a downloaded .tar file must first be extracted. If a fresh, unmodified export also fails, reload the browser and temporarily disable extensions that block local file processing or JavaScript.

The diff contains too many changes

First check the file order and modification date, then filter for the affected modules or create smaller exports with Selective configuration. Firmware updates or migrations can produce system-related differences; rules, NAT, interfaces, VPN, certificates, Authentication, Hosts and services, and Device Access are what matter.

Editor output cannot be applied

Do not improvise on the production system. Recheck the source configuration, dependent objects, names, zones, interfaces and services. For a file import, use the generated TAR file; for API or curl, also check the account, source IP address and permissions. Test again only when a backup exists and the recovery path is clear.