Set up Avanet support access on Sophos Firewall

For a support case, Avanet may temporarily need direct access to the web admin console of a Sophos Firewall. This access is only secure when it is restricted to a known support source, the required service and a defined period. The global WAN permissions for HTTPS and SSH remain disabled; access is provided through a targeted Local service ACL exception rule.

For many cases, screen sharing or an existing controlled partner account is sufficient. New direct WAN access is only appropriate when Avanet must analyse the issue or make changes independently. SSH is added only when the Device Console, Advanced Shell or log files are required.

Device Access and Local Service ACL on Sophos Firewall explains the technical foundations. A current Sophos Firewall backup should also be available before changes are made.

Important: Support access is administrative access to the firewall. The user, ACL rule and SSH key must be disabled or removed after the case unless permanent access has been agreed.

Define the access and time period

Record the following in the ticket before configuring access:

• which work Avanet is authorised to perform,
• whether WebAdmin is sufficient or SSH is also required,
• when access starts and ends,
• which Avanet support source will be used,
• who approves access and verifies its removal.

Do not supplement an existing Avanet or partner account with a second permanent account. Instead, verify the profile, MFA, source restriction and status of the existing account. For joint troubleshooting without a direct login, screen sharing is often the lowest-risk option.

Set up the WebAdmin user

The local avanet user is intended exclusively for the web admin console. A dedicated user makes changes easier to attribute in the Audit Trail than sharing the default admin account.

1. Go to Authentication > Users.
2. Select Add.
3. Enter the username and display name.
4. Set User type to Administrator.
5. Select an appropriate Profile.
6. Enter a strong password used only for this access and an email address.

Typical values are Username avanet, Name Avanet and Email support@avanet.local. The Administrator profile grants full access to WebAdmin and CLI functions. Use it only when the support case genuinely requires these rights. For clearly limited work, a custom profile with the required Read-only or Read-write permissions under Profiles > Device access is preferable.

Two additional restrictions are available under Administrator advanced settings:

• Schedule for device access: permits sign-in to the web admin console only during the selected schedule.
• Login restriction for device access: permits sign-in only from selected IPv4 addresses or an IPv4 range.

If the fixed support IP is known, add it as a Login restriction for device access as well. The Local Service ACL then restricts reachability of the console, while the user restriction additionally limits sign-in for this account. Select Save.

Test the password and MFA in advance

Transfer the password over an agreed secure channel and do not leave it permanently in email or ticket text. If MFA for administrators is used, clarify token enrolment, handover and reset responsibility before the support appointment. A short sign-in test prevents password, role or MFA issues from consuming the maintenance window.

Restrict the support source and Local Service ACL

Add an FQDN host for support.avanet.com

The Local Service ACL supports FQDN hosts as sources. A controlled change to the Avanet egress IP therefore does not require every firewall to be updated manually. The firewall uses the addresses resolved through DNS until the DNS TTL expires. Wildcard FQDNs are not supported in Local Service ACL exception rules.

1. Go to Hosts and services > FQDN host.
2. Select Add.
3. Set Name and FQDN to support.avanet.com.
4. Select Save.

Before continuing, verify that support.avanet.com resolves to the public support IP stated in the ticket. If the actual egress IP does not match the DNS result, the ACL will correctly reject access.

Create the Local Service ACL exception rule

HTTPS and SSH are local firewall services. Normal firewall rules do not control this traffic. Configure access under Administration > Device access instead.

1. Go to Administration > Device access.
2. Under Local service ACL, make sure HTTPS and SSH are not enabled globally for WAN.
3. Scroll to Local service ACL exception rule and select Add.
4. Create the rule with the following values.

• Rule name: Avanet-Support
• Rule position: Top
• Description: ticket number, purpose and planned end date
• IP version: IPv4
• Source zone: WAN
• Source Network / Host: FQDN object support.avanet.com
• Destination host: the public firewall address, or Any if the firewall must be reachable through several applicable WAN addresses
• Services: HTTPS; SSH only when confirmed as necessary; Ping/Ping6 only for a specific diagnostic task
• Action: Accept

Select Save. Positioning the rule at Top ensures that the targeted permission is evaluated before an overlapping drop rule. Existing exception rules still need review: a broader accept rule above it or an incorrect source zone can change the intended security model.

Do not use: Any or 0.0.0.0 as the source. Sophos prevents global WAN access to the web admin console for good reason. Do not enable the WAN checkbox for HTTPS or SSH for this procedure either.

Add SSH only when required

SSH provides access to the Device Console and Advanced Shell and is therefore considerably more powerful than a restricted WebAdmin profile. For many support cases, Services should remain limited to HTTPS.

The avanet user cannot be used for SSH. Sophos Firewall accepts only the default admin user for CLI access. The public key is therefore stored globally under Public key authentication for admin, not on the avanet user.

1. Go to Administration.
2. Select Device access.
3. Scroll to Public key authentication for admin.
4. Turn on Enable authentication.
5. Paste the public key confirmed for the current case under Authorized keys and add it with the plus button.
6. Select Apply.

Only the default admin can add or remove SSH keys; Apply is not shown to custom administrators. Sophos supports RSA keys of at least 2048 bits and certain DSA and ECDSA keys, but not ED25519. Use a modern, sufficiently strong key that is supported by the SSH client in use.

A public key has the following structure, for example:

ssh-rsa <base64-public-key> avanet-support-<ticket>

The private key remains with the support engineer and is never stored on the firewall. After the support case, remove the case-specific public key and SSH from the exception rule unless permanent access has been agreed. Connect to Sophos Firewall via SSH explains the actual sign-in process.

Test access and troubleshoot failures

A successful sign-in from the permitted source alone is not sufficient acceptance testing. Also verify that access remains blocked from another internet source.

1. Open WebAdmin from the agreed Avanet support source using the configured admin port. The default is TCP 4444, but it may have been changed under Administration > Admin and user settings.
2. Sign in as avanet and verify that the selected profile exposes the required menus.
3. Test from a second internet source that is not permitted. The web admin console must not be reachable from it.
4. If SSH was permitted, test sign-in as admin using the case-specific private key. Password-based SSH is not required for this test.
5. Check authentication events in Log viewer. Review configuration changes separately in the Audit Trail.
6. Record the result and access end time in the ticket.

If WebAdmin is not reachable

Start at the source and work towards the firewall:

• Does support.avanet.com resolve to the actual public egress IP?
• Does the connection really enter through the zone selected under Source zone?
• Does the WAN address being contacted match Destination host?
• Is the exception rule at Top, and does it include HTTPS?
• Is the correct WebAdmin port being used?
• Is a provider router, upstream NAT device or upstream ACL blocking access?
• Does Login restriction for device access permit the TCP connection but reject sign-in for the user?

Do not enable the global WAN permissions for HTTPS or SSH while troubleshooting. A correctly configured exception rule does not require them for this targeted access.

If sign-in fails

If the console is reachable but sign-in fails, check the user status, password, MFA, profile, Schedule for device access, Login restriction for device access and the system-wide Block login settings under Administration > Admin and user settings. After repeated failed attempts, Sophos Firewall can temporarily block the source IP from all sign-in services.

Remove access in a controlled manner

After the support case, review the agreed configuration changes and the access itself separately:

1. Use the Audit Trail to verify which configuration changes were made as avanet.
2. For larger rule-set changes, Sophos Firewall Config Studio can support a before-and-after comparison.
3. Disable or delete the avanet user unless permanent partner access has been agreed.
4. Disable or delete the Local Service ACL exception rule.
5. Remove the case-specific SSH public key.
6. Verify from the former support source that WebAdmin and SSH are no longer reachable.

Any deliberately retained partner access still requires MFA, a tightly restricted source, a responsible owner and regular review. An inactive ticket is not a reason to leave management access permanently open.

Frequently asked questions