Check global IPS settings on Sophos Firewall safely

The Sophos Firewall Device Console contains global IPS engine settings under set ips. They control fail-close, scan scope, application detection, SIP processing, PKI Acceleration, and behavior during signature updates. These values do not apply to only one IPS policy or firewall rule.

The safe starting point is show ips-settings, which displays the configured IPS values and running instances. Change one setting only when a reproducible symptom points to that parameter. Record the original value, expected effect, control flow, and rollback command before the maintenance window.

⚠️ set ips is not a general performance-tuning list. Individual options can drop new connections, bypass Application Control or Active Threat Response, let all traffic bypass IPS during an engine restart, or require a firewall restart.

Set up and test Sophos Firewall IPS safely covers normal enablement, policy selection, signatures, and false positives. This article adds the global CLI layer.

Safe short procedure

1. Record the affected connection, Firewall Rule ID, IPS policy, signature, time, and symptom.
2. Save show ips-settings and, when needed, the read-only show ips_conf output from Device Console.
3. Check whether a narrow policy or signature change solves the issue without a global change.
4. Change one global value with suitable positive, negative, and control tests.
5. Plan the additional apply step and operational impact for failclose or IPS instances.
6. Validate Log Viewer, ips.log, application behavior, and resources, then roll back immediately if there is no clear benefit.

After a secured SSH login, select 4. Device Console. Sophos Firewall CLI troubleshooting explains host-key verification, access, and the boundary to Advanced Shell.

show ips-settings
show ips_conf

show ips_conf exposes a technical Snort configuration view. Internal keys are not an approved template for custom changes.

Understand fail-close and resource limits

failclose determines how the firewall reacts when the IPS engine reaches its connection or memory limit. With on, it drops new connections. With off, the IPS service removes old connections from its cache to make room for new ones.

Sophos documents the default according to appliance RAM:

A backup restore can transfer a different failclose state to the firewall. Check the value explicitly after a restore instead of deriving it only from hardware size.

TCP and UDP timeouts accept 1 to 43200 seconds. Sophos documents 180 seconds when failclose is off and 600 seconds when it is on. After changing the state or a timeout, run set ips failclose apply separately.

set ips failclose on
set ips failclose timeout tcp 600
set ips failclose timeout udp 600
set ips failclose apply

This example shows the related syntax for the documented on default; it is not a blanket recommendation. Confirm current values, RAM use, new connections, critical applications, and the desired response to IPS resource exhaustion first. Rollback restores the recorded state and both timeouts, followed by failclose apply.

Define scan scope deliberately

Trust assessment or all content

inspect untrusted-content inspects only content that SophosLabs doesn’t trust. It is the documented default and provides the best performance. inspect all-content inspects all content and, according to Sophos, provides the best security.

The change is global. Test web traffic, file transfers, published servers, VPN applications, CPU, memory, and throughput under comparable load. Interpret Sophos Firewall performance metrics explains the measurement workflow.

Scan decrypted traffic independent of port

scan_decrypted_port_agnostic on is enabled by default. IPS can therefore scan decrypted traffic successfully even when a signature expects HTTP but the decrypted flow uses another port.

Disabling it reduces coverage firewall-wide and is not a permanent fix for one false positive. A focused test requires signature ID, destination, port, SSL/TLS inspection rule, and IPS policy. Prefer the narrow signature or policy exception afterwards and restore the global value. The detailed test path is in Roll out TLS Inspection gradually.

HTTP responses and packet count

http_response_scan_limit accepts 0 to 262144; Sophos requires 0 for full scanning. Do not copy another value without evidence because a limit changes detection depth and resource use.

maxpkts defines how many packets Application Filter policies scan from both client and server in new and updated connections. The documented default is 8. Sophos recommends 80 for complex or evasive proxy, P2P, and tunnel applications, but warns that excessively high values reduce connection speed.

The value 80 is not a general IPS performance setting. First prove that a specific application is not classified reliably at the default, then compare detection, connection setup, throughput, and unrelated control traffic.

Application detection and ATR exceptions

enable_appsignatures on enables application-based signatures and is the documented default. A global off reduces detection of malicious applications by traffic pattern and is not a clean solution for one misclassified application.

ac_atr exception fwrules excludes one or more Firewall Rule IDs from Application Classification and Active Threat Response. Separate multiple IDs with commas; none removes the exception.

set ips ac_atr exception fwrules 12,27
set ips ac_atr exception fwrules none

The exception does not allow or block the firewall rules themselves. It removes their traffic from two additional protection or classification paths. Use it only for proven Rule IDs with an owner, expiry date, and negative test. Check the threat feed, rule match, and local Active Threat Response configuration separately first.

Engine, CPU, and hardware acceleration

Do not move IPS instances as a quick optimization

ips-instance add and clear assign or remove an IPS instance from a CPU. Sophos then requires set ips-instance apply and prompts for a firewall restart. The new assignment isn’t active without that restart.

Manual CPU assignment is not live tuning. It belongs in a maintenance window with the platform, current instances, Sophos recommendation, and before-and-after load recorded.

Leave deprecated switches unchanged

Sophos has deprecated ips_mmap and packet-streaming since SFOS 18.0; both appear as on in the documented output. Do not use them as SFOS 22 optimization controls. packet-streaming off is particularly risky because, without reassembly, malicious content split across Telnet, POP3, SMTP, or HTTP packets can evade signature checks.

Classify PKI Acceleration correctly

pki-acceleration enable is the documented default. On supported XGS models, the Xstream Flow Processor can offload re-signing X.509 server certificates for SSL/TLS flows inspected by the DPI engine.

show ips-settings displays the state. Unsupported versions or models show disabled; if PKI Acceleration is enabled while Firewall Acceleration is off, it shows enabled (inactive). Enabling or disabling it can restart IPS or the DPI engine, so use an observed maintenance window.

Do not guess the search method

Sophos documents ac-bnfa for low memory and high performance, ac-q for high memory and best performance, and hyperscan for low memory and best performance. hyperscan is the default.

These labels are not an invitation to switch engines by instinct. Platform support, memory, reproducible load, and detection outcome must align. Keep the documented method unless a specific Sophos recommendation says otherwise.

SIP and special TCP behavior

sip_preproc enable scans SIP sessions for network attacks and is enabled by default. sip_ignore_call_channel enable excludes audio and video data channels from IPS scanning by default. Both are global and can affect several PBXs, providers, and firewall rules.

First separate signaling, media, direction, NAT, helper, IPS event, and VPN event. Only a reproducible call justifies a time-limited CLI comparison. Optimize and test VoIP on Sophos Firewall provides the full workflow and rollback.

tcp urgent-flag remove removes and resets the TCP urgent flag and pointer and is the documented default. allow forwards them unchanged. Relaxing it requires a packet capture and a specific legacy application, not only a generic TCP failure.

Apply signature updates safely

set ips engine_update_mode reload is the documented default. A reload may drop some packets while configuration reloads. The restart alternative restarts the IPS engine; all incoming and outgoing packets bypass IPS scanning during the restart.

Sophos strongly recommends not changing this setting for security reasons. Do not stabilize signature updates through a permanent protection bypass. If reloads cause reproducible disruption, save time, pattern version, affected flows, and logs for Sophos Support.

Keep set ips_conf with Sophos Support

set ips_conf can add, update, or delete internal Snort key-value pairs. Sophos explicitly warns that only Sophos Support engineers should run these commands.

The read-only show ips_conf output can serve as a support baseline. Do not derive custom add, update, or del commands from it. A wrong internal key can affect protection, stability, and supportability and has no safe rollback without known previous values.

Validate and roll back a change

Create a new connection with the same source, destination, and firewall rule before and after. At least one unrelated control flow must continue to show the expected IPS policy and action. Assess Log Viewer, ips.log, CPU, memory, connection setup, and application result together.

Rollback uses the original value recorded by show ips-settings. Run set ips failclose apply again after restoring fail-close; instance rollback also has apply and restart requirements. Do not experiment with deprecated or support-internal parameters.

Operations checklist

• show ips-settings, SFOS build, hardware model, time, and responsible person recorded.
• Specific parameter and affected traffic path isolated.
• Narrow IPS policy or signature correction checked before a global change.
• RAM-dependent failclose state and restore effect considered.
• Apply, restart, and protection-bypass risks clarified beforehand.
• Positive, negative, and control flows tested after the change.
• Actual original value prepared for rollback.
• No custom set ips_conf changes executed.

FAQ