Sophos Firewall Sizing Guide: Properly Dimensioning an XGS Appliance
Sophos Firewall sizing is not just about the number of users. Key factors include bandwidth, TLS Inspection, IPS, VPN, HA, logging, and reserve …
Sophos Firewall
Practical Sophos Firewall guides for setup, hardening, VPN, network rules, licenses, updates, logs, and troubleshooting.
Table of Contents
Sophos Firewall Topic Overview
The articles are organised by typical admin tasks: select, set up, secure, publish, connect remotely, analyse, and restore.
Getting Started, Selection, and Licensing 17
Sizing, XGS Appliance selection, Base License, bundles, Air Gap, lifecycle, portals, and license operation.
Comparing Sophos Firewall Bundles
Sophos offers Standard and Xstream as appliance bundles. Avanet Epic Protection adds Email and Webserver Protection to Xstream.
Understanding the Sophos Firewall Base License
The Base License is the foundation of Sophos Firewall, but it does not replace support or security subscriptions. Licence status, support, updates, HA …
Migrate a Sophos UTM license to Sophos Firewall
There are two official paths from a UTM license to SFOS. This guide separates SG conversion from virtual license migration and explains prerequisites, …
Activate Sophos Firewall Licence Key
How to activate a Sophos Firewall Subscription Key and check its licence status, assignment, and synchronization.
Operating Sophos Firewall Air-Gap Licensing and Pattern Updates
Air-gap operation on Sophos Firewall requires approval, license file, manual synchronization, pattern updates, and a clear operational routine.
Correctly Interpreting Sophos Firewall Performance Data
Sophos Firewall datasheet values are comparative figures. Key factors include firewall, IMIX, IPS, NGFW, TLS Inspection, VPN, and reserves.
Sophos Firewall: Hardware, virtual or cloud?
Hardware, virtual appliance, Software Appliance and Cloud Deployment differ in operation, HA, recovery, sizing and responsibilities.
Deploy and operate Sophos Firewall on AWS
Standalone and Auto Scaling on AWS have different licensing, interfaces, traffic directions, and operating boundaries.
Deploy and route Sophos Firewall on Azure
Azure runs Sophos Firewall as a cloud appliance. The operating model, static NIC addresses, UDRs, and symmetric return paths are decisive.
Sophos XG vs XGS: differences, EOL and migration
This article explains XG End of Life, XG vs XGS differences, SFOS 21/22 limits and how to prepare migration to XGS cleanly.
Sophos Product Lifecycle Calendar - End-of-Sale / End-of-Life
Sophos lifecycle planning needs End-of-Sale, Last Renewal, End-of-Life, successor products and clear checks before renewal, migration or hardware …
Sophos hardware warranty, support, and RMA explained
Warranty, support, and RMA are separate checks. The device, serial number, lifecycle, support model, and replacement process determine eligibility.
Sophos portals: Central, Self Service, Support and firewall
Central Admin, Self Service, Support, and firewall portals serve different purposes. Sign-in, licensing, access, and Remote Access are key …
Find the Sophos Firewall serial number
Quick ways to find the serial number in SFOS 22 and Sophos Central, with guidance for hardware, virtual firewalls, HA, and support cases.
Transfer a Sophos Firewall license to a replacement device
For hardware replacement, plan the claim, license transfer, and configuration restore separately. This workflow transfers subscriptions in Sophos …
Transfer Sophos Firewall to another Sophos Central account
How to safely transfer a Sophos Firewall license and account assignment to another Central account.
Setup and Basic Configuration 23
Setup Wizard, Central connection, Active Directory, STAS, SATC, Device Access, and support access.
Properly Configure Sophos Firewall After the Setup Wizard
After the Setup Wizard, the firewall is accessible but not yet fully hardened. Following this, backup, firmware, Device Access, rules, and logs are …
Configure system time and NTP on Sophos Firewall
An accurate firewall clock is essential for logs, MFA, certificates, VPNs, and schedules. This guide shows how to configure and verify the time …
Connect Sophos Firewall with Sophos Central
A Sophos Firewall can operate locally but offers additional features for management, backups, reporting, and security with Sophos Central.
Connect Active Directory to Sophos Firewall
Active Directory provides users, groups and authentication for Sophos Firewall. LDAPS, search base, group import, Main Group and AD SSO matter.
Manage Sophos Firewall user groups and the main group correctly
Groups bundle user policies but do not replace access rules. Their source, order, and Main Group determine which policy actually applies.
Connect a Generic LDAP Server to Sophos Firewall
Sophos Firewall can authenticate users from generic LDAP directories. The key requirements are an encrypted connection, suitable search attributes, a …
Create and manage local users on Sophos Firewall
A local user needs more than a username and password. Group, authentication method, service, rule, MFA, and lifecycle must work together.
Create and securely manage Guest users on Sophos Firewall
Guest accounts receive time-limited credentials. A restrictive group, clear validity, a tested Captive Portal, and clean offboarding are essential.
Set up and test a RADIUS server on Sophos Firewall
This guide connects Sophos Firewall to a RADIUS server and covers the server object, NPS, service order, groups, validation, troubleshooting, and …
Set Up TACACS+ for Sophos Firewall Administrators
TACACS+ centralizes password verification, but the SFOS administrator role remains local. A safe rollout requires a local emergency admin, a pilot …
Configure Sophos Firewall RADIUS SSO with accounting
RADIUS SSO creates user-to-IP mappings from accounting packets. The actual sender, Framed-IP-Address, Device Access, and a controlled rule test are …
Set up and test Clientless Users on Sophos Firewall
Clientless Users assign an identity to a fixed IP without a login or agent. A stable address, narrow rules, and a real negative test are essential.
Set up STAS on Sophos Firewall
STAS maps AD logons to client IPs so Sophos Firewall can use user-based rules. This guide covers setup, testing and troubleshooting.
Set up Sophos Firewall Client Authentication Agent
Client Authentication Agent signs a user directly in to the firewall. The TLS-protected agent path, correct authentication method, and a real test of …
Set up Sophos Firewall SATC for Remote Desktop Services
SATC maps users on Remote Desktop Session Hosts to Sophos Firewall. Server Protection, registry, Device Access and Live Users matter.
Set up Sophos Firewall Per-Connection AD SSO for multi-user hosts
Per-Connection AD SSO identifies multiple users behind one RDS IP for each proxy connection. This guide covers selection, setup, tests, and limits.
Set up Synchronized User ID Authentication on Sophos Firewall
Sophos Endpoint sends the Windows domain identity through Security Heartbeat. The firewall validates it in AD and can apply user-based rules.
Set up Sophos Firewall Chromebook SSO with Google Workspace
Chromebook SSO maps signed-in Google Workspace users to their IP addresses. The certificate, Device Access, two firewall rules, and the managed MV3 …
Set up Microsoft Entra ID SSO for Sophos Firewall WebAdmin
Map Entra groups or app roles to local administrator profiles. A tested emergency login, least privilege, and a negative access test are essential.
Set up Sophos Firewall administrators and profiles securely
Personal admin accounts replace shared logins. Profiles, MFA, schedules, and login sources limit permissions and make changes traceable.
Configure the Sophos Firewall login disclaimer and messages
The login disclaimer is a compliance and notice feature. It needs approved wording, separate access controls, and genuine tests for sign-in, email, …
Sophos Firewall: Device Access and Local Service ACL
Device Access protects local firewall services. This guide covers narrow ACL exceptions, safe rollout, proxy and port-sharing pitfalls, and targeted …
Set up Avanet support access on Sophos Firewall
Restrict Avanet support access by task, source, permissions, and time, then validate and remove it. The guide also distinguishes Sophos Support …
Firewall Rules, NAT, and Network Design 60
Firewall rules, zones, interfaces, VLAN, NAT, DNS, DHCP, SD-WAN, NTP, and VoIP.
Plan Sophos Firewall zones and interfaces correctly
Zones define security areas, while interfaces connect networks. Clear assignments, restrictive Device Access and suitable firewall rules are …
Set up and test Wi-Fi directly on Sophos Firewall
Wi-Fi managed directly by SFOS requires the correct traffic assignment, a suitable client network, DHCP, firewall rules and assignment to an access …
Set up and test Sophos Firewall Wireless Mesh
An APX mesh extends an existing SFOS-managed wireless network without a network cable, but requires a wired root AP, one fixed common channel, and a …
Set up a Sophos Firewall hotspot with vouchers or a daily password
A guided example for restricted guest access with vouchers and the simpler alternative using a daily password.
Use Sophos Firewall IP Hosts, Services, and Groups Correctly
Clear host and service objects make firewall rules easier to understand. The key is choosing the right object type and destination port, and checking …
Set up and test Sophos Firewall Captive Portal
Captive Portal links a browser login to user rules. Device Access, DNS, authentication, HTTPS, and a clean acceptance test are essential.
Understand and safely configure Sophos Firewall rules
Firewall rules are at the heart of Sophos Firewall. The key aspects are rule structure, order, scope, rule types, practical examples, testing and …
Set up Sophos Firewall schedules for rules and policies
Schedules limit rules and policies to defined time windows. The schedule type, firewall time, rule order, and tests before and after switching are …
Set up Sophos Firewall Access Time for users
Access Time combines a recurring schedule with Allow or Deny. User identification, policy assignment, the AD main group, and boundary tests are …
Set up Sophos Firewall surfing and network traffic quotas
Surfing quota limits consumed internet time, while network traffic quota limits data volume. Assignment, main group, logging, and View usage are …
Document Sophos Firewall rules effectively
A clear rule description explains its purpose, ownership and expiry date. Logs, the Rule ID and usage data then show whether the rule is still needed.
Configure and test an alias IP on Sophos Firewall
An alias IP adds an address to a physical interface. The provider path, NAT, Device Access, ARP, and a real traffic test are essential.
Configure and verify a PPPoE WAN on Sophos Firewall
PPPoE only works when the provider device, VLAN, credentials, gateway, DNS, and firewall rule all match.
Set up and test VLANs on Sophos Firewall
VLANs on Sophos Firewall need more than a VLAN ID: parent interface, switch tagging, zone, IP objects, DHCP, DNS, rules, NAT and tests must match.
Configure and test a Sophos Firewall bridge interface
A bridge inserts Sophos Firewall transparently into an existing Layer 2 path. The key requirements are correct zones and rules, independent management …
Configure and verify Sophos Firewall breakout interfaces
A breakout divides a fast QSFP port into two or four slower interfaces. The model, port mode, restart, and peer device must match exactly.
Replace legacy bridge VLAN tagging before SFOS 22 MR2
Legacy CLI VLAN tags on bridges disrupt firewall traffic in SFOS 22 GA and MR1 and block upgrades from MR2 onward.
Select and troubleshoot SFP and SFP+ for Sophos Firewall
A practical workflow for selecting transceivers, configuring ports, and troubleshooting a missing or unstable SFP link.
Set up and test a Sophos Firewall LAG with LACP
A LAG bundles two to four ports. The right bonding mode, safe migration, switch configuration, and real failover and load tests are essential.
Set up LAN Bypass and Fail-to-Wire on Sophos Firewall
Fail-to-Wire keeps the physical path open during power or hardware failure. Traffic then passes without firewall rules, scanning, or logs.
Configure and Test Proxy ARP on Sophos Firewall
Proxy ARP answers ARP requests for an additional IPv4 address. Firewall rules, NAT, routing, and the return path remain separate checks.
Configure Sophos Firewall Discover Mode with TAP and SPAN
Discover Mode analyzes mirrored network traffic without being inline. A clean SPAN port, separate management, and a clear boundary are essential: TAP …
Use Sophos Firewall FQDN hosts and wildcard FQDNs correctly
FQDN hosts help with dynamic cloud and service destinations. Wildcard FQDNs are different because the firewall learns matching IP addresses from DNS …
Sophos Firewall Rule Not Matching: Check Causes
A reproducible test shows whether rule order, matching, NAT, routing, user matching, or a security module affects the connection.
Set up Microsoft Entra ID SSO for Sophos Firewall Captive Portal
Captive Portal with Entra ID SSO maps local users through browser login. Redirect URI, Device Access, group matching, and logs are important.
Test Sophos Firewall Rules Cleanly
Rule tests need clear test data and real events. Log Viewer, Policy Tester, Packet Capture, tcpdump, Central Reporting, and Syslog answer different …
Configure IPv6 Prefix Delegation on Sophos Firewall
IPv6 Prefix Delegation brings provider prefixes into internal networks. Key aspects include WAN configuration, Router Advertisement, rules, and …
Sophos Firewall IPv6 support and limitations in SFOS 22
SFOS 22 supports IPv6 for many core features, but not everywhere. Knowing the limits prevents design mistakes involving VPN, WAF, DNS, updates, and …
Configure IPv6 Router Advertisement on Sophos Firewall
Router Advertisement provides IPv6 clients with a prefix, default gateway, and operating flags. A suitable /64, the correct DHCPv6 role, and a real …
Understanding NAT on Sophos Firewall: SNAT, DNAT, MASQ, PAT
NAT translates addresses or ports but does not allow traffic. The key factors are Original and Translated, rule order, routing, the return path, and …
Publishing a Server via DNAT on Sophos Firewall
DNAT publishes internal services through public IP addresses or ports. Narrow source restrictions, matching firewall rules, NAT order, the post-NAT …
Set up and verify Dynamic DNS on Sophos Firewall
Configure DDNS for a dynamic public IPv4 address, test it externally and resolve common provider, NAT, Multi-WAN and Cloudflare issues.
Configure and test DNS host entries on Sophos Firewall
A DNS host entry answers a fixed name directly on the firewall. The actual client resolver, TTL, reverse lookup, and deliberately limited WAN …
Configure DNS Request Routes on Sophos Firewall
DNS Request Routes forward selected DNS zones to internal resolvers. The actual client path, Device Access, suitable target servers, and separate …
Check Sophos Firewall MTU and MSS for VPN Issues
Identify MTU and MSS issues with VPN, XFRM, SD-WAN, or PPPoE using DF tests, Packet Capture, and controlled changes.
How to set up Sophos Firewall as a DHCP server
A DHCP server on Sophos Firewall distributes IP addresses and the corresponding network settings. A clean address range, correct DNS settings and a …
Set up and test a DHCPv6 server on Sophos Firewall
A DHCPv6 server can distribute IPv6 addresses and additional parameters. Router advertisement, DUID, lease times and the real client test remain …
Sophos Firewall DHCP Options (SFOS)
DHCP options distribute PXE, WDS, thin client, or RED parameters. WebAdmin, CLI fallbacks, and common error patterns are important.
Set up and test DHCP Relay on Sophos Firewall
DHCP Relay forwards client requests to a central DHCP server. The client interface, scope, return path, and correct IPsec variant are essential.
Configure and test a static route on Sophos Firewall
A static route sends a fixed destination network through a defined next hop. This example covers configuration, firewall access, testing and rollback.
Configure and test Sophos Firewall WAN failover
A second WAN connection is initially active. For a true backup link, configure the gateway type, probe targets, activation and failback deliberately.
Configure and test Sophos Firewall SD-WAN routes
SD-WAN routes steer defined traffic flows through specific gateways. Narrow criteria, suitable NAT and testing with real traffic are essential.
Configure and validate RIP on Sophos Firewall
RIP distributes IPv4 routes in small or existing networks. The decisive factors are RIPv2, narrow peer access, passive client interfaces, and real …
Configure and verify OSPF on Sophos Firewall
Configure OSPFv2 for IPv4 with an end-to-end example, advertise routes selectively, and verify neighbors; OSPFv3 is covered separately.
Configure and test BGP on Sophos Firewall
Set up BGP with a complete eBGP example, permit it selectively, and test it from Neighbor status through to actual packet flow.
Safely change route precedence on Sophos Firewall
Route precedence decides whether Static, SD-WAN or VPN takes priority. The SFOS version, competing routes and a prepared rollback are critical.
Configure and test static multicast routing on Sophos Firewall
A static multicast route forwards the data stream from a known sender to fixed interfaces. The group, receiver join, and testing on both sides are …
Configure and validate PIM-SM on Sophos Firewall
PIM-SM dynamically connects multicast senders and receivers across multiple routers. The decisive factors are a reachable RP, correct unicast routes …
SFOS 22: Policy-based IPsec routes in OSPF and BGP
Classify missing VPN prefixes after an upgrade, use documented checks, and plan the routing architecture.
Create and test a custom gateway on Sophos Firewall
A custom gateway combines a defined next hop with health checks and SD-WAN routing. Test status, rule, return path, and actual traffic separately.
Configure and test a GRE tunnel on Sophos Firewall
A GRE tunnel encapsulates IP traffic between two fixed endpoints. Static WAN addresses, matching tunnel IPs, routes, rules, and tests of both the …
Configure a Sophos Firewall IP tunnel with 6in4, 6to4, 6rd, or 4in6
WebAdmin IP tunnels carry IPv6 over IPv4 or IPv4 over IPv6. The tunnel type, endpoint address family, route, and return path must all match.
Set up and verify a Sophos Central SD-WAN connection group
Central creates route-based IPsec connections between multiple firewalls. Planning, conflict resolution, and local validation remain essential.
Check Sophos Firewall SD-WAN Reply and System Traffic
Two CLI switches extend SD-WAN to reply packets and firewall traffic. Narrow routes, real packet tests and a documented rollback are essential.
Configure a VLAN on Sophos Firewall and a UniFi Switch
Sophos Firewall provides the gateway, DHCP, and rules; UniFi transports the VLAN. The parent interface, port roles, NAT, and clean tests are critical.
Set Up Sophos Firewall Cellular WAN and Test 4G/5G Failover
Cellular WAN is usually a backup link. Reliable 4G/5G failover depends on the SIM, APN, PIN, gateway, signal quality, SD-WAN checks, and failback …
Sophos Firewall as NTP relay: forward NTP via NAT
Sophos Firewall is not a full-fledged NTP server, but can forward NTP requests to external or internal time servers via NAT.
Create IPsec Route on Sophos Firewall
Classify ipsec_route correctly, capture the initial state, and route translated traffic through a policy-based tunnel in a controlled manner.
Configure Application Traffic Shaping on Sophos Firewall
This guide explains the difference between application-based and rule-based Traffic Shaping, with specific example values and operational checks.
Fix VoIP problems with SIP and RTP on Sophos Firewall
A safe VoIP test separates SIP from RTP, verifies the actual rule, NAT and routing path, and changes global values only with a documented rollback.
VPN, RED, and Remote Access 36
Sophos Connect, SSL VPN, Entra ID SSO, IPsec, SD-RED, and VPN troubleshooting.
Sophos Connect or SSL VPN: Which remote access solution fits?
Sophos Connect is a client for IPsec and SSL VPN. Protocol, platform, profile delivery, and access scope determine the right solution.
Configure Sophos Connect on Sophos Firewall
A practical firewall-side guide to Sophos Connect with IPsec Remote Access on SFOS 22—from authentication and tunnel parameters to rules, rollout and …
Set up Sophos Connect provisioning with .pro and GPO
A .pro file automatically retrieves IPsec and SSL VPN profiles through the VPN portal. This guide explains its structure, secure deployment, GPO …
Set up Sophos Firewall SSL VPN Remote Access
SSL VPN Remote Access only works reliably when global settings, portal, policy, current profile, DNS, MFA, Device Access, firewall rules and routing …
Protect Sophos Firewall VPN Portal against brute force
First document failed VPN Portal logins, then limit them with ACLs, separate ports, Login Security, identity protection, and Threat Feeds.
Set up Sophos Firewall Clientless SSL VPN for RDP and SSH
Clientless SSL VPN provides individual RDP, SSH, or file server connections in the browser without opening a general network tunnel.
Migrate legacy Remote Access IPsec before SFOS 22 MR1
An existing legacy IPsec configuration blocks SFOS 22 MR1. This guide covers everything from the initial assessment to a tested replacement.
Set up and test L2TP remote access on Sophos Firewall
L2TP remains a compatibility option for native VPN clients. This guide covers secure SFOS 22 configuration, validation, and common failures.
Install Sophos Connect Client on Windows
Sophos Connect on Windows requires the right client version, profile, platform, MFA/SSO and rules. Then verify the connection, DNS and access.
Install Sophos Connect Client on macOS
Sophos Connect on macOS depends on the client version, Apple Silicon and Rosetta, the IPsec or SSL VPN profile, DNS, MFA and tested firewall rules.
Set up Microsoft Entra ID SSO for Sophos Connect and VPN Portal
Entra ID SSO connects Remote Access with OAuth 2.0, OpenID Connect, and Entra-MFA. Key elements include Redirect URIs, groups, and Device Access.
Check and safely update Sophos Connect Client version
Sophos Connect updates affect VPN profiles, platforms, MFA, SSO, helpdesk and rollback. Version checks, pilots, profile tests and known issues matter.
Set up Sophos SSL VPN with Sophos Connect on Windows
SSL VPN with Sophos Connect on Windows needs a current OVPN profile, VPN Portal access, MFA, client version, DNS test, profile cleanup, and matching …
Set up Sophos SSL VPN with Sophos Connect on macOS
SSL VPN on macOS now often uses Sophos Connect instead of Tunnelblick. The OVPN profile, Apple Silicon/Rosetta, DNS, MFA and maintenance are key.
Set up Sophos SSL VPN on iPhone and iPad
SSL VPN on iPhone and iPad uses an OpenVPN-compatible client. OVPN profile, VPN Portal, MFA, DNS and firewall rules are important.
Set up Sophos SSL VPN on Android
SSL VPN on Android requires an OpenVPN client, a current OVPN profile, VPN portal access, MFA, DNS tests, firewall rules, and device-change handling.
Set Up Sophos Firewall Remote Access on Linux
On Linux, SSL VPN with OpenVPN is the documented path. Sophos Connect is unavailable, and NetworkManager-strongSwan is incompatible because of …
Sophos Firewall: .ovpn missing or 0 bytes
A missing .ovpn file has different causes than a 0-byte download. This process separates policy, user, certificate, and system errors.
Replace the old Sophos SSL VPN Client and migrate startup
The old Sophos SSL VPN Client is EOL and incompatible from SFOS 20.0 MR1. Migrate its profile and startup safely to Sophos Connect.
Set up an SSL Site-to-Site VPN on Sophos Firewall
SSL Site-to-Site connects two Sophos Firewalls in a client-server model. Roles, global SSL VPN settings, networks, APC import, rules and tests must …
Understand and securely configure Sophos Firewall IPsec profiles
This guide explains every important IPsec profile field and shows a modern and a compatible baseline for Site-to-Site VPNs.
Set up Sophos Firewall Site-to-Site IPsec VPN
Site-to-Site IPsec requires clear networks, profiles, gateway types, IDs, rules, routing, NAT and acceptance tests. Choose route-based or policy-based …
Configure and test an IPsec failover group on Sophos Firewall
Two tested IPsec tunnels form a prioritized failover group. This guide explains selection, monitoring, failback, logs, and acceptance testing.
Connect Sophos Firewall to Azure VPN Gateway
Azure Site-to-Site VPN needs Local Network Gateway, Virtual Network Gateway, matching IPsec/IKE parameters, Sophos XFRM, routes and firewall rules.
Route branch internet through the head office over IPsec
A branch full tunnel requires Any selectors, VPN before Static before SD-WAN, three targeted rules, MASQ, and a clear system-traffic decision.
Connect Sophos Firewall to AWS Site-to-Site VPN
AWS Site-to-Site VPN needs a customer gateway, target gateway, two tunnels, matching IPsec settings, routing and validation on both sides.
Set up Sophos Firewall IPsec Site-to-Site with certificates
Certificate-based IPsec replaces the shared PSK with mutual trust. CA exchange, Certificate ID, peer certificate, rules and a planned renewal test are …
Use NAT for overlapping IPsec networks on Sophos Firewall
Overlapping IPsec networks require unique translated networks on both sides. Policy-based, route-based with selectors and Any-to-Any use different NAT …
Forward a Virtual IP over IPsec to Multiple Servers
The remote site uses one stable virtual IP; SFOS 22 translates new connections to a monitored server list.
Make Route-Based IPsec Resilient with Two Internet Connections
Two any-to-any tunnels use separate XFRM paths. Monitored gateways and static routes determine primary, backup, and failback behavior.
Sophos Firewall: Systematically diagnose an IPsec VPN
A clear diagnostic path for IPsec problems: first tunnel establishment and the Child SA, then rules, NAT, routing, the return path, and packet flow.
Use global VPN settings on Sophos Firewall safely
set vpn contains global advanced settings. This guide explains their effect, risk, baseline, and controlled testing on SFOS 22.
Fix Sophos Firewall IPsec Remote Access 4-Hour Timeout
This guide distinguishes rekeying from idle timeouts and network faults and shows how to safely adjust a custom IPsec profile.
Setting Up and Troubleshooting Sophos SD-RED
Sophos SD-RED connects remote sites to the firewall. This guide covers setup, firewall rules, diagnostics, and reproducible throughput tests.
Choose the right Sophos RED operation mode
The RED mode determines the gateway, DHCP, internet path, and central control. This guide helps with the choice and shows safe functional tests.
Set up Site-to-Site RED between two Sophos Firewalls
Two Sophos Firewalls can connect through a Site-to-Site RED tunnel without RED hardware. This guide covers setup, security, and validation.
Security Features and Inspection 49
MFA, TLS Inspection, WAF, Threat Feeds, IPS, Web Protection, NDR, DNS Protection, and hardening.
Enable FIPS 140-3 on Sophos Firewall
FIPS mode enforces FIPS-compliant cryptography, but enabling it resets the firewall completely to factory settings.
Sophos Firewall Hardening: Best Practices for secure configuration
Hardening reduces the attack surface of Sophos Firewall. Key areas are management access, MFA, updates, published services, threat feeds, logging and …
Understand and enable LINCE mode on Sophos Firewall
LINCE mode restricts cryptography and restarts SSH. It doesn't automatically prove that the installed SFOS build is certified.
Effectively Using Sophos Firewall Health Check
This guide classifies all 31 Health Check findings by real risk, operational value, and optional Sophos services.
Enable MFA for Sophos Firewall WebAdmin and VPN
Practical guide to Sophos OTP, RADIUS and Entra SSO with a pilot group, app compatibility, password-plus-OTP, recovery and troubleshooting.
Implementing Sophos Firewall TLS Inspection Correctly
TLS Inspection provides visibility into encrypted connections, but requires CA distribution, a clear rule order, a DPI/Web Proxy decision, exclusions, …
Set up a subordinate CA for Sophos Firewall TLS inspection
A dedicated subordinate CA integrates Sophos Firewall with the internal PKI. The key points are a private key generated on the firewall, the correct …
Distribute Sophos Firewall CA Certificate for TLS Inspection
TLS Inspection works without browser warnings only if clients trust the firewall CA. Important steps include download, distribution, and rollback.
Securing Sophos Firewall XML API Access
XML API access on Sophos Firewall should only be allowed from defined management networks, automation systems, or integration hosts.
Use a Sophos Firewall bypass rule safely
A stateful firewall bypass skips firewall inspection. Use it only for a narrow, time-limited test with deletion commands prepared in advance.
Sophos Firewall WAF: Securely Publish Web Servers
Web Server Protection publishes HTTP and HTTPS applications as a reverse proxy. Key points are WAF or DNAT choice, DNS, certificate, web server …
Securing Sophos Firewall WAF with MFA
Sophos Firewall can protect WAF-published web applications with MFA from SFOS 22. Version, Authentication Policy, token rollout, testing, and …
Set up Let's Encrypt certificates on Sophos Firewall
SFOS 22 obtains Let's Encrypt certificates through HTTP-01 over IPv4. Consistent public DNS, an unobstructed port 80 path, and renewal checks are …
Import and assign certificates on Sophos Firewall
How to import external certificates with the correct private key and CA chain into Sophos Firewall and assign them safely to the intended service.
Import CRLs and revoke certificates on Sophos Firewall
Certificate Revocation Lists invalidate revoked certificates before expiry. The correct CA, a current CRL, and a real service test are essential.
Renew the Sophos Firewall Default CA safely
Saving the Default CA creates a new trust anchor. Before doing so, certificates, VPN profiles, peer firewalls, and trusting clients must be fully …
Set up and safely operate Sophos Firewall Threat Feeds
Third-Party Threat Feeds bring known malicious IPs, domains, and URLs into Sophos Firewall. Feed quality, action, logging, and controlled operation …
Configure Sophos Firewall ATP: X-Ops Threat Feeds
Sophos X-Ops Threat Feeds compare outgoing traffic with known malicious destinations. Action, visibility, logging, and narrow exclusions are crucial.
Configure and safely test Sophos Firewall IPS
IPS requires a valid license, up-to-date signatures, and an appropriate policy in the firewall rule that actually handles the traffic. A tightly …
Enable and verify Sophos Firewall MDR threat feeds
Sophos MDR analysts can send customer-specific IoCs to the firewall in real time. Licensing, Central integration, the local action, logging, and a …
Configure and test Sophos Firewall malware scanning
Malware scanning only works when the firewall rule, scan engine, HTTPS decryption, exceptions, and tests are correctly aligned.
Create and test custom IPS signatures on Sophos Firewall
Custom IPS signatures detect your own network and application patterns. A narrow syntax, an observation-only pilot, correct IPS policy assignment, and …
Check global IPS settings on Sophos Firewall safely
Set ips changes the IPS engine firewall-wide. A baseline, focused test, and prepared rollback must precede fail-close, scan, or performance changes.
Setting Up Sophos Firewall Web Protection with Web Policies
Web Protection requires an appropriate firewall rule, web policy, categories, user context, Web Exceptions, TLS visibility, QUIC decision, logging, …
Choose Sophos Firewall DPI Engine or Web Proxy correctly
DPI Engine and Web Proxy apply the same web policy on different traffic paths. The deciding factors are required proxy features, TLS decryption, and a …
Create and safely use URL groups on Sophos Firewall
URL groups collect domains for web policies and SSL/TLS inspection rules. A narrow domain scope, the correct rule, and a controlled negative test are …
Operating Sophos Firewall NDR and Active Threat Response
NDR Essentials and NDR Active Threat Intelligence enhance Sophos Firewall with network detection. Key aspects include usage limits, operation, and …
Setting up Sophos DNS Protection with Sophos Firewall
Set up, test, and operate DNS Protection with Sophos Firewall, including internal DNS zones, endpoint limitations, and troubleshooting.
Set up Sophos Firewall Direct Web Proxy with a PAC file
A Direct Web Proxy needs more than port 3128. A narrow pilot access, the correct rule, PAC deployment, and real proxy tests are essential.
Check Sophos Firewall HTTP proxy settings safely
The Device Console contains global settings for Web Proxy and Captive Portal. A baseline, focused test, and rollback come before any change.
Check Sophos Firewall Spoof Protection and DoS Settings
Spoof Protection and DoS Settings harden against implausible sources and flooding. This guide explains WebAdmin thresholds, CLI policies, order, tests …
Set up NAT64 on Sophos Firewall with Direct Web Proxy
IPv6-only clients reach IPv4 web destinations through Direct Web Proxy. Two separate rules and a genuine A-only test are essential.
Configure and test an upstream proxy on Sophos Firewall
A parent proxy requires web proxy mode and different rules depending on its location. A narrow pilot, the correct NAT path, and real positive and …
Inspect non-standard ports with Sophos Firewall
service-param extends protocol inspection to additional ports but doesn't replace a firewall service or the matching web, TLS, or mail policy.
Sophos Firewall: Blocking Countries and Malicious IPs
Country blocking, Black Hole DNAT, WAF Blocked countries, and Threat Feeds serve different purposes. Rule position, local services, and monitoring are …
Setting Up and Testing Sophos Firewall Application Control
Application Control detects applications beyond ports alone. The key factors are a narrowly scoped Application Filter, the firewall rule that actually …
Detect and Control Generative AI with Sophos Firewall
Allow and log GenAI applications in a pilot group first, then block them selectively. This guide separates Application Control, Synchronized …
Understand and operate Sophos Firewall Zero-Day Protection
Zero-Day Protection analyses suspicious downloads and email attachments. Firewall rule, web and mail path, TLS visibility, reports, exceptions and …
Set up Sophos Firewall Mail Protection in MTA mode
This guide covers the mail flow and MX record, the MTA policy, validation, and troubleshooting without overlooking relay, TLS, or DKIM risks.
Set up Sophos Firewall SPX email encryption
This guide connects the SPX template, trigger, password delivery, and Reply Portal into a controlled workflow for encrypted outbound email.
Configure Sophos Firewall Mail Protection in legacy mode
This guide combines the existing SMTP path with transparent proxy scanning, tightly scoped NAT and firewall rules, and reliable end-to-end validation.
Create and test Sophos Firewall Web Exceptions safely
Web Exceptions can bypass decryption, certificate validation, malware scanning, zero-day analysis, or policy checks. A narrow match, positive and …
Set up and test the Sophos Firewall quarantine digest
This guide connects digest delivery with the user portal, quarantine area, and user assignment and shows how to test the complete release path.
Scan and test POP3 and IMAP on Sophos Firewall
This guide combines POP/IMAP settings, TLS trust, an optional scan policy, and a firewall rule into a controlled mail retrieval test.
Using Sophos Firewall Web Categories and Instant Alerts
Web categories and instant alerts assist in web policy control. Key aspects include usage, prerequisites, configuration, logging, and error patterns.
Create and test Sophos Firewall email exceptions safely
This guide shows how to correct a confirmed false positive with one tightly scoped email exception without disabling the remaining mail protection.
Set up Sophos Firewall MTA with Microsoft 365
This guide connects Exchange Online and Sophos Firewall in a controlled bidirectional mail flow with tight relay access and reliable validation.
Correctly Blocking QUIC and HTTP/3 on Sophos Firewall
In SFOS 22, Block QUIC protocol drops outbound UDP 80 and 443 within the firewall rule's scope. Verify TCP fallback, Rule ID, web/TLS effect, and a …
Disable Sophos Firewall CAPTCHA: WebAdmin and User Portal
The appropriate Device Console commands for WebAdmin, User Portal, and global or VPN-specific settings.
Analysis, Logs, and Troubleshooting 37
Log Viewer, service logs, audit trail, SSH, CLI, packet capture, tcpdump, syslog, and SIEM.
Map Sophos Firewall Service Logs Correctly
For troubleshooting, know which Sophos Firewall service belongs to which module, which log file fits, and when Log Viewer, CTR, debug, or CLI is …
Use Sophos Firewall Log Viewer correctly
Log Viewer shows logged firewall decisions. This guide explains filters, fields, timing, limitations, and safe correlation.
Sophos Firewall Log Viewer Shows No New Logs
If no new events appear in Log Viewer, first check the view, logging, and packet flow. The old Garner workaround does not apply to SFOS 22.
Secure Sophos Firewall Logs for Support and Analysis
In cases of disruptions, VPN issues, or unclear firewall events, a support case requires clean logs, timestamps, and captures if necessary.
Review Sophos Firewall Configuration Changes with Audit Trail
Configuration Audit shows which administrator changed supported firewall objects, when the change occurred, and what was modified.
Connect Sophos Firewall via SSH
SSH is a powerful support channel on Sophos Firewall. Device Access, ACL exceptions, public keys, host keys and control limits matter.
Sophos Firewall CLI troubleshooting: essential commands
Essential CLI commands support log analysis, network checks, service status, and debug logging. A controlled workflow is what makes them useful.
Check Sophos Firewall outbound services and ports
Sophos Firewall needs its own outbound connections to Sophos services. Current FQDNs, DNS, NTP, routing, egress rules, and a targeted test for each …
Check reserved ports on Sophos Firewall
Check the SFOS 22 list, assess port sharing, and make a port change with validation and a reliable rollback.
Manage Sophos Firewall system modules safely
SFOS loads several protocol helpers by default. Changes are global and require a status check, a test flow and an exact rollback.
Read Sophos Firewall Live Connections correctly
Live Connections groups active sessions by application, source IP address, or user, while Connection List shows individual sessions. This guide …
Using Sophos Firewall Packet Capture in WebAdmin
This guide shows how to capture a single flow in WebAdmin and identify where packets arrive, are forwarded, or are dropped.
Use Sophos Firewall tcpdump Safely
tcpdump provides precise packet captures on the firewall. This guide separates Device Console and Advanced Shell and covers filters, PCAP, analysis, …
Systematically troubleshoot Sophos Firewall authentication errors
A successful server test doesn't prove that a user can sign in. This workflow separates the service, identity, group policy, and subsequent traffic …
Check the Sophos Firewall User-ID Limit and Clean Up AD Users
Sophos Firewall uses the internal ID range through 65535 for users and groups. The specific ID shows whether authentication or VPN Portal problems are …
Sophos Firewall: AD SSO fails after an SFOS 22 upgrade
AD SSO can fail after certain upgrades to SFOS 22.0 GA. A log entry narrows down the issue before a targeted NASM rebuild.
Analyse dropped packets on Sophos Firewall
A compact diagnostic workflow for drops: reproduce traffic, correlate Log Viewer and Packet Capture, then check rules, NAT, return path, and security …
Sophos Firewall: Invalid TCP reserved bit caused by Accurate ECN
Sophos Firewall may drop Accurate ECN as Invalid TCP reserved bit. Diagnosis, global CLI workaround, and a safe return to strict-policy on.
Check Sophos Firewall Advanced Firewall Settings safely
The Device Console groups global firewall parameters for packet inspection, TCP, UDP, and special paths. A baseline, narrow test, and rollback are …
Check the ARP and NDP neighbor cache on Sophos Firewall
The neighbor cache maps IPv4 and IPv6 addresses to MAC addresses. This guide shows how to check stale entries, relearn them, and safely use static …
Diagnose Sophos Firewall Wireless Controller from CLI
A safe Wireless Controller workflow: read and narrow down first, capture only what is needed, and restore every temporary value.
Resolve Sophos Firewall ARP Issues After Migration
After a firewall replacement, old ARP entries can block individual WAN or alias IP addresses. Packet Capture separates ARP from NAT and rule issues.
How to investigate Sophos Firewall Missing Heartbeat Alerts
Missing Heartbeat means that the firewall continues to see traffic but no longer receives a matching Security Heartbeat. Scope, path and timing are …
Synchronized Application Control: Safely Check Database Issues
Synchronized Application Control data should not be cleaned up using public PostgreSQL commands. This guide covers diagnosis, evidence collection, and …
How to interpret Sophos Firewall User & Device Insights
The Control Center widget combines endpoint, user, file, TLS, and session signals. This guide explains their meaning, drill-downs, safe changes, …
Test Sophos Firewall performance correctly with iPerf3
iPerf3 measures throughput over a defined path. The test becomes meaningful with a baseline, clear direction, narrow firewall rule, and proper …
Check Sophos Firewall temperature and fan via SSH
The sensor view and hardware log show host CPU, NPU, and fan values. Model limits, trends, load, rack temperature, and symptoms determine the …
Configure sFlow Monitoring on Sophos Firewall
sFlow makes traffic patterns and noticeable flows visible. Important aspects include Collector, Sampling, Interface Selection, Limits, and Operational …
Set up SNMP hardware monitoring on Sophos Firewall
Set up SNMPv3 securely on Sophos Firewall, test it with snmpget and snmpwalk, and correctly interpret the SFOS 22 hardware metrics.
Configure and test NetFlow on Sophos Firewall
NetFlow exports metadata from logged rule connections to an external collector. The key requirements are v5 compatibility, the UDP path, data …
Check Sophos Firewall daily: operations checklist for admins
The daily admin checklist combines current system status, trends, security events, and documented escalation without turning a single spike into a …
Conducting an Internet Speed Test on Sophos Firewall via SSH
A speed test on the Sophos Firewall helps isolate WAN and client issues. Key aspects include SSH testing, WAN path, unit, test file, and …
Configure and test Sophos Firewall email notifications
The mail server and event selection are separate settings. Only a delivered test email and a real selected event confirm the complete alert path.
Configure Sophos Firewall Data Anonymization
Data Anonymization encrypts usernames, IP, MAC, and email addresses in logs and reports. At least two authorizers and real output tests are important.
Schedule Sophos Firewall reports and send them by email
Scheduled on-box reports send local analyses daily or weekly as a PDF. Report selection, mail transport, functional testing, and content review are …
Enable and Operate Sophos Firewall Central Reporting
Central Firewall Reporting transfers firewall logs to Sophos Central. Important aspects include log selection, retention, Report Hub, and syslog …
Send Sophos Firewall Syslog securely to a SIEM
How to send the right Sophos Firewall logs reliably and securely to a Syslog server, SIEM, or SOC.
Operations, Maintenance, and Recovery 27
Backup, firmware, SFOS upgrades, task queue, services, Config Studio, reimage, SSD, HA, and RMA.
Create or Restore a Sophos Firewall Backup
Backups require the file, password, Secure Storage Master Key, target version, management access, and restore compatibility. Essential before updates, …
Selectively export and import Sophos Firewall configuration
A selective configuration import adds or overwrites objects, but isn't a restore. Dependencies, SSMK, compatibility, and real tests are decisive.
Sophos Firewall Firmware Update: Preparation and Best Practices
A compact go/no-go checklist for the upgrade path, recovery, HA, Central scheduling, and technical validation after a firmware update.
Perform a Sophos Firewall Firmware Update
How to download and install a suitable SFOS image and verify the firewall with real functional tests after the restart.
Replace corrupt Sophos Firewall firmware with SFLoader
SFLoader replaces corrupt firmware when WebAdmin is no longer accessible. This recovery path doesn't apply to XGS Appliance, overwrites a firmware …
Sophos Firewall FWDS501: Enlarge the Primary Disk before SFOS 22
Some older virtual Sophos Firewalls require a larger Primary Disk and adjusted partitions before SFOS 22.
Sophos Firewall SFOS 22 Upgrade Check: Find Blockers
The most important blockers and checks before an upgrade to SFOS 22.
Use Sophos Central Firewall Groups and Full Sync Safely
Manage multiple Sophos Firewalls with one group policy without overwriting local configurations without control.
Check the Sophos Central Firewall Task Queue
Distinguish both queues, use Retry, Skip, and Force sync deliberately, and verify the result on the firewall.
Sophos Firewall: Migrate eDirectory Before SFOS 23
SFOS 23 no longer supports the native eDirectory server type. This runbook covers target selection, parallel operation, group validation, cutover and …
Configure and check Sophos Firewall pattern updates
Pattern updates keep protection signatures, engines and device firmware current. This guide covers automation, status, manual updates and …
Export and import Sophos Firewall via the Central API
Export complete or selective firewall configurations via the Sophos Central REST API, verify them, and import them in a controlled manner.
Set Sophos Firewall USB setup delay correctly
SFOS waits 3 seconds by default for a ready USB drive. Increase the value only for a confirmed detection problem and test again.
Restart Sophos Firewall services safely
Restarting a service can recover an individual firewall module. The correct service, secure access and a real functional test are essential.
Using Sophos Firewall Config Studio
Config Studio makes firewall configurations readable, compares multiple versions and prepares changes or migrations.
Forgotten Sophos Firewall Admin Password: Reset and Recover
The documented recovery method for physical appliances resets only the default admin password. Option 4, HA, and the follow-up checks are essential.
Restart the Sophos Firewall WebAdmin GUI
If only WebAdmin stops responding, tomcat and apache can be checked and restarted individually. Different requirements apply to HA.
Sophos Firewall restarts unexpectedly: Check the cause
After an unplanned restart, first preserve uptime, build, HA role, and logs. Then distinguish between software, load, power, hardware, and VM causes.
Reset Sophos Firewall to factory settings
A factory reset removes the custom configuration but not all local data. Backup, recovery access, and the exact XGS Appliance model must be known …
Sophos Firewall in failsafe mode: proceed safely
Preserve the failsafe message and system state first. The platform, HA role, and firmware build then guide a safe decision between correction and …
Reinstall Sophos Firewall OS: USB reimage
A reimage fully overwrites the firewall. Before starting, backup, SSMK, installer image, restore compatibility, HA and post-checks matter.
Check Sophos Firewall SSD Health via SMART
A read-only smartctl query can show the endurance raw value on a physical XGS Appliance. The device path, attribute, and threshold remain …
Check Sophos Firewall storage and manage reports
Storage warnings require root-cause analysis. /var, reports, event logs, troubleshooting logs, mail queue, warning thresholds and data retention are …
Setting Up Sophos Firewall High Availability (HA)
HA connects two Sophos Firewalls into a cluster. Important aspects include prerequisites, licensing, HA link, Monitored Ports, QuickHA, updates, RMA …
Sophos Firewall scripts without cron jobs: safe alternatives
Custom cron jobs and startup scripts are not part of the normal SFOS operating model. This guide explains supported alternatives and a safe migration …
Open a Sophos support ticket with Support Assistant
Since July 2026, Sophos Support Assistant guides troubleshooting and case creation. Good preparation remains essential for an efficient support case.
Sophos hardware failure: prepare RMA and replacement
A clear Sophos RMA process: isolate the fault, secure data and backups, open a support case, check the replacement and meet the return deadline.
Miscellaneous and Legacy 2
Special cases, older clients, and topics that do not fit neatly into the main areas.
Compare Sophos Firewall Home Edition and Sophos Home
Home Edition, an XGS Appliance with a Base License, and Sophos Home suit different personal scenarios. Understand their limits, benefits, and …
Connect UniFi Device to Cloud Controller via Sophos Firewall
L3 adoption requires TCP 8080 from the UniFi device to the controller and a valid Inform URL. DNS, SSH, and DHCP Option 43 are explained with …