Sophos Firewall Sizing Guide: Properly Dimensioning XGS
Sophos Firewall sizing is not just about the number of users. Key factors include bandwidth, TLS Inspection, IPS, VPN, HA, logging, and reserve …
Sophos Firewall
Practical German Sophos Firewall guides for setup, hardening, VPN, network rules, licenses, updates, logs, and troubleshooting.
Table of Contents
Sophos Firewall Topic Overview
The articles are organised by typical admin tasks: select, set up, secure, publish, connect remotely, analyse, and restore.
Getting Started, Selection, and Licensing 13
Sizing, XGS selection, Base License, bundles, Air Gap, lifecycle, portals, and license operation.
Comparing Sophos Firewall Bundles
When purchasing or renewing a Sophos Firewall, Standard Protection, Xstream Protection, and Epic Protection must match the protection needs.
Understanding the Sophos Firewall Base License
The Base License is the foundation of Sophos Firewall, but it does not replace support or security subscriptions. Licence status, support, updates, HA …
Activate Sophos Firewall Licence Key
How to activate a Sophos Firewall Subscription Key and check its licence status, assignment, and synchronization.
Operating Sophos Firewall Air-Gap Licensing and Pattern Updates
Air-gap operation on Sophos Firewall requires approval, license file, manual synchronization, pattern updates, and a clear operational routine.
Correctly Interpreting Sophos Firewall Performance Data
Sophos Firewall datasheet values are comparative figures. Key factors include firewall, IMIX, IPS, NGFW, TLS Inspection, VPN, and reserves.
Sophos Firewall: Hardware, virtual or cloud?
Hardware, virtual appliance, Software Appliance and Cloud Deployment differ in operation, HA, recovery, sizing and responsibilities.
Sophos XG vs XGS: differences, EOL and migration
This article explains XG End of Life, XG vs XGS differences, SFOS 21/22 limits and how to prepare migration to XGS cleanly.
Sophos Product Lifecycle Calendar - End-of-Sale / End-of-Life
Sophos lifecycle planning needs End-of-Sale, Last Renewal, End-of-Life, successor products and clear checks before renewal, migration or hardware …
Classify Sophos hardware warranty, support and RMA
Warranty, support contract and RMA must be checked separately for Sophos hardware: serial number, purchase date, lifecycle, contract and replacement …
Sophos portals: SophosID, Central, Support and firewall access
SophosID, Central, Support Portal and firewall portals serve different purposes. Login, licensing, access and Remote Access are key considerations.
Find the Sophos Firewall serial number
The serial number uniquely identifies a Sophos Firewall. It is needed for support, licensing, RMA, Central registration, HA and inventory.
Transfer Sophos Firewall to another Sophos Central account
How to safely transfer a Sophos Firewall license and account assignment to another Central account.
Setup and Basic Configuration 9
Setup Wizard, Central connection, Active Directory, STAS, SATC, Device Access, and support access.
Properly Configure Sophos Firewall After the Setup Wizard
After the Setup Wizard, the firewall is accessible but not yet fully hardened. Following this, backup, firmware, Device Access, rules, and logs are …
Connect Sophos Firewall with Sophos Central
A Sophos Firewall can operate locally but offers additional features for management, backups, reporting, and security with Sophos Central.
Connect Active Directory to Sophos Firewall
Active Directory provides users, groups and authentication for Sophos Firewall. LDAPS, search base, group import, Main Group and AD SSO matter.
Connect a Generic LDAP Server to Sophos Firewall
Not every environment runs Active Directory. LDAP connects Sophos Firewall to OpenLDAP, 389-ds, FreeIPA, or Google Secure LDAP. Bind DN, Base DN, and …
Set up a Sophos Firewall RADIUS server
RADIUS connects Sophos Firewall to NPS, MFA systems or other identity services. Shared secret, services, groups, timeouts and tests matter.
Set up STAS on Sophos Firewall
STAS maps AD logons to client IPs so Sophos Firewall can use user-based rules. This guide covers setup, testing and troubleshooting.
Set up Sophos Firewall SATC for Remote Desktop Services
SATC maps users on Remote Desktop Session Hosts to Sophos Firewall. Server Protection, registry, Device Access and Live Users matter.
Sophos Firewall: Device Access and Local Service ACL
Device Access protects local firewall services. This guide covers narrow ACL exceptions, safe rollout, proxy and port-sharing pitfalls, and targeted …
Set up Avanet support access on Sophos Firewall
Avanet support access is restricted to the agreed source and period. This guide covers WebAdmin, Local Service ACL, MFA, optional SSH, testing and …
Firewall Rules, NAT, and Network Design 25
Firewall rules, zones, interfaces, VLAN, NAT, DNS, DHCP, SD-WAN, NTP, and VoIP.
Plan Sophos Firewall zones and interfaces correctly
Zones define security areas, while interfaces connect networks. Clear assignments, restrictive Device Access and suitable firewall rules are …
Understand and safely configure Sophos Firewall rules
Firewall rules are at the heart of the Sophos Firewall. What is important is the rule structure, sequence, limits, rule types, practical examples, …
Document Sophos Firewall rules effectively
A clear rule description explains its purpose, ownership and expiry date. Logs, the Rule ID and usage data then show whether the rule is still needed.
Set up and test VLANs on Sophos Firewall
VLANs on Sophos Firewall need more than a VLAN ID: parent interface, switch tagging, zone, IP objects, DHCP, DNS, rules, NAT and tests must match.
Sophos Firewall Check bridge VLANs for SFOS 22
After SFOS 22, bridge VLANs are particularly noticeable for traffic to or from the firewall. CLI VLAN tags, br0 interfaces and tests are important.
Set up and test a Sophos Firewall LAG with LACP
A LAG bundles two to four ports. The right bonding mode, safe migration, switch configuration, and real failover and load tests are essential.
Use Sophos Firewall FQDN hosts and wildcard FQDNs correctly
FQDN hosts help with dynamic cloud and service destinations. Wildcard FQDNs are different because the firewall learns matching IP addresses from DNS …
Sophos Firewall Rule Not Matching: Check Causes
If a firewall rule is not matching, it is usually due to order, zone, source, destination, service, user matching, NAT, routing, or logging.
Set up Microsoft Entra ID SSO for Sophos Firewall Captive Portal
Captive Portal with Entra ID SSO maps local users through browser login. Redirect URI, Device Access, group matching, and logs are important.
Test Sophos Firewall Rules Cleanly
Rule tests need clear test data and real events. Log Viewer, Policy Tester, Packet Capture, tcpdump, Central Reporting, and Syslog answer different …
Configure IPv6 Prefix Delegation on Sophos Firewall
IPv6 Prefix Delegation brings provider prefixes into internal networks. Key aspects include WAN configuration, Router Advertisement, rules, and …
Understanding NAT on Sophos Firewall: SNAT, DNAT, MASQ, PAT
NAT translates addresses or ports but does not allow traffic. Important are SNAT, DNAT, MASQ, PAT, loopback, reflexive rules and troubleshooting.
Publishing a Server via DNAT on Sophos Firewall
DNAT publishes internal services over public IPs or ports. Close sources, appropriate firewall rules, NAT order and tests are crucial.
Configure DNS Request Routes on Sophos Firewall
DNS Request Routes forward specific DNS queries to defined DNS servers. Key points are firewall as resolver, internal domains, reverse lookups, DNS …
Check Sophos Firewall MTU and MSS for VPN Issues
MTU and MSS issues manifest as stalled downloads, RDP, HTTPS, or VoIP. Path checking, VPN overhead, PPPoE, and XFRM are important.
Sophos Firewall DHCP Options (SFOS)
DHCP options distribute PXE, WDS, thin client, or RED parameters. WebAdmin, CLI fallbacks, and common error patterns are important.
Configure and test Sophos Firewall SD-WAN routes
SD-WAN routes steer defined traffic flows through specific gateways. Narrow criteria, suitable NAT and testing with real traffic are essential.
Safely change route precedence on Sophos Firewall
Route precedence decides whether Static, SD-WAN or VPN takes priority. The SFOS version, competing routes and a prepared rollback are critical.
Check Sophos Firewall SD-WAN Reply and System Traffic
Two CLI switches extend SD-WAN to reply packets and firewall traffic. Narrow routes, real packet tests and a documented rollback are essential.
Configure VLAN on Sophos Firewall and UniFi Switch
VLANs with Sophos Firewall and UniFi need clean tagging. Important are Gateway, parent interface, UniFi network, Access-Port, Trunk, DHCP and rules.
Check Sophos Firewall Cellular WAN and 4G/5G Failover
Cellular WAN is usually a backup line. For 4G/5G failover, SIM, APN, PIN, Gateway, signal quality, SD-WAN checks, and fallback logic are crucial.
Sophos Firewall as NTP relay: forward NTP via NAT
Sophos Firewall is not a full-fledged NTP server, but can forward NTP requests to external or internal time servers via NAT.
Create IPsec Route on Sophos Firewall
Learn how to classify ipsec_route correctly, capture the initial state, and test a manual route with policy-based IPsec.
Configure Application Traffic Shaping on Sophos Firewall
Application Traffic Shaping prioritises important applications and limits other traffic. Key aspects include policy, match, direction, testing, and …
Sophos Firewall Fix VoIP problems with SIP and RTP
VoIP problems often arise from SIP ALG, UDP timeouts, NAT, RTP ports or routing. SIP/RTP analysis, capture and CLI testing are important.
VPN, RED, and Remote Access 20
Sophos Connect, SSL VPN, Entra ID SSO, IPsec, SD-RED, and VPN troubleshooting.
Sophos Connect or SSL VPN: Which remote access solution is right?
Sophos Connect with IPsec, Sophos Connect with SSL VPN, classic OpenVPN clients and ZTNA fit different remote access scenarios.
Configure Sophos Connect on Sophos Firewall
Sophos Connect needs matching IPsec/SSL VPN profiles, users, IP pool, DNS, MFA, firewall rules, provisioning and update process.
Set up Sophos Firewall SSL VPN Remote Access
SSL VPN Remote Access only works cleanly when global settings, portal, policy, current profile, DNS, MFA, Device Access, firewall rules and routing …
Migrate legacy Remote Access IPsec before SFOS 22 MR1
An existing legacy IPsec configuration blocks SFOS 22 MR1. This guide covers everything from the initial assessment to a tested replacement.
Install Sophos Connect Client on Windows
Sophos Connect on Windows requires the right client version, profile, platform, MFA/SSO and rules. Then verify the connection, DNS and access.
Install Sophos Connect Client on macOS
Sophos Connect on macOS depends on the client version, Apple Silicon and Rosetta, the IPsec or SSL VPN profile, DNS, MFA and tested firewall rules.
Set up Microsoft Entra ID SSO for Sophos Connect and VPN Portal
Entra ID SSO connects Remote Access with OAuth 2.0, OpenID Connect, and Entra-MFA. Key elements include Redirect URIs, groups, and Device Access.
Check and safely update Sophos Connect Client version
Sophos Connect updates affect VPN profiles, platforms, MFA, SSO, helpdesk and rollback. Version checks, pilots, profile tests and known issues matter.
Set up Sophos SSL VPN with Sophos Connect on Windows
SSL VPN with Sophos Connect on Windows needs a current OVPN profile, VPN Portal access, MFA, client version, DNS test, profile cleanup, and matching …
Set up Sophos SSL VPN with Sophos Connect on macOS
SSL VPN on macOS now often uses Sophos Connect instead of Tunnelblick. The OVPN profile, Apple Silicon/Rosetta, DNS, MFA and maintenance are key.
Set up Sophos SSL VPN on iPhone and iPad
SSL VPN on iPhone and iPad uses an OpenVPN-compatible client. OVPN profile, VPN Portal, MFA, DNS and firewall rules are important.
Set up Sophos SSL VPN on Android
SSL VPN on Android requires an OpenVPN client, a current OVPN profile, VPN portal access, MFA, DNS tests, firewall rules, and device-change handling.
Set Up Sophos Firewall Remote Access on Linux
On Linux, SSL VPN with OpenVPN is the documented path. Sophos Connect is unavailable, and NetworkManager-strongSwan is incompatible because of …
Safely Categorise Sophos SSL VPN Client in Autostart
The old Sophos SSL VPN Client can start automatically. Auto-Login with password.txt is risky. Important are risk, autostart, and alternatives.
Set up Sophos Firewall Site-to-Site IPsec VPN
Site-to-Site IPsec needs clear networks, profiles, rules, routing, NAT and acceptance tests. Choose policy-based or route-based designs deliberately.
Connect Sophos Firewall to Azure VPN Gateway
Azure Site-to-Site VPN needs Local Network Gateway, Virtual Network Gateway, matching IPsec/IKE parameters, Sophos XFRM, routes and firewall rules.
Connect Sophos Firewall to AWS Site-to-Site VPN
AWS Site-to-Site VPN needs a customer gateway, target gateway, two tunnels, matching IPsec settings, routing and validation on both sides.
Sophos Firewall IPsec VPN Troubleshooting
IPsec troubleshooting requires a clear sequence: IKE, Phase 2, Security Associations, StrongSwan logs, XFRM, routing, NAT, firewall rules and packet …
Fix Sophos Firewall IPsec Remote Access 4-Hour Timeout
This guide distinguishes rekeying from idle timeouts and network faults and shows how to safely adjust a custom IPsec profile.
Setting Up and Troubleshooting Sophos SD-RED
Sophos SD-RED connects remote sites to the firewall. Key aspects include provisioning, NTP, ports, LED status, RED interface, DHCP, VLANs, and rules.
Security Features and Inspection 23
MFA, TLS Inspection, WAF, Threat Feeds, IPS, Web Protection, NDR, DNS Protection, and hardening.
Sophos Firewall Hardening: Best Practices for secure configuration
Hardening reduces the attack surface of Sophos Firewall. Key areas are management access, MFA, updates, published services, threat feeds, logging and …
Effectively Using Sophos Firewall Health Check
This guide classifies all 31 Health Check findings by real risk, operational value, and optional Sophos services.
Enable MFA for Sophos Firewall WebAdmin and VPN
MFA protects WebAdmin, VPN Portal and Remote Access well only when Device Access, OTP tokens, groups, fallback, tests and operations are planned …
Implementing Sophos Firewall TLS Inspection Correctly
TLS Inspection increases visibility in encrypted connections, but needs CA distribution, clear rule order, DPI/Web Proxy decision, exclusions, tests …
Distribute Sophos Firewall CA Certificate for TLS Inspection
TLS Inspection works without browser warnings only if clients trust the firewall CA. Important steps include download, distribution, and rollback.
Securing Sophos Firewall XML API Access
XML API access on Sophos Firewall should only be allowed from defined management networks, automation systems, or integration hosts.
Use Sophos Firewall Bypass Rule safely
Bypass rules bypass the normal stateful firewall path. What is important is clear demarcation, tight networks, opposite directions, tests and …
Sophos Firewall WAF: Securely Publish Web Servers
Web Server Protection publishes HTTP and HTTPS applications as a reverse proxy. Key points are WAF or DNAT choice, DNS, certificate, web server …
Securing Sophos Firewall WAF with MFA
Sophos Firewall can protect WAF-published web applications with MFA from SFOS 22. Version, Authentication Policy, token rollout, testing, and …
Set up Sophos Firewall Let's Encrypt certificates
Sophos Firewall can obtain and renew Let's Encrypt certificates directly. HTTP validation, hosted address, port 80, supported services and monitoring …
Set up and operate Sophos Firewall Threat Feeds
Threat Feeds bring known malicious IPs, domains and URLs into Sophos Firewall as IoCs. Licence, indicator type, feed format, action, logging and …
Set up and safely test Sophos Firewall IPS
IPS needs a licence, global enablement, the right policy per firewall rule, signature awareness, logging, tests, performance checks and a …
Setting Up Sophos Firewall Web Protection with Web Policies
Web Protection requires an appropriate firewall rule, web policy, categories, user context, Web Exceptions, TLS visibility, QUIC decision, logging, …
Operating Sophos Firewall NDR and Active Threat Response
NDR Essentials and NDR Active Threat Intelligence enhance Sophos Firewall with network detection. Key aspects include usage limits, operation, and …
Setting up Sophos DNS Protection with Sophos Firewall
Set up, test, and operate DNS Protection with Sophos Firewall, including internal DNS zones, endpoint limitations, and troubleshooting.
Sophos Firewall Spoof Protection and DoS Settings check
Spoof Protection and DoS Settings harden against implausible sources and simple flooding patterns. Routing, Packet Rate, Burst Rate, bypass order, …
Sophos Firewall: Blocking Countries and Malicious IPs
Country blocking, Black Hole DNAT, WAF Blocked countries, and Threat Feeds serve different purposes. Rule position, local services, and monitoring are …
Setting Up and Testing Sophos Firewall Application Control
Application Control identifies applications beyond simple ports. Important aspects include application filters, signatures, rule position, TLS …
Understand and operate Sophos Firewall Zero-Day Protection
Zero-Day Protection analyses suspicious downloads and email attachments. Firewall rule, web and mail path, TLS visibility, reports, exceptions and …
Set up Sophos Firewall Mail Protection in MTA mode
Mail Protection in MTA mode makes the firewall the SMTP acceptance point. MX, TLS, relay, policies, quarantine and logs are decisive.
Using Sophos Firewall Web Categories and Instant Alerts
Web categories and instant alerts assist in web policy control. Key aspects include usage, prerequisites, configuration, logging, and error patterns.
Correctly Blocking QUIC and HTTP/3 on Sophos Firewall
QUIC operates over UDP 80 and UDP 443. On the Sophos Firewall, it's important to understand when Block QUIC protocol is necessary and how to verify …
Disable Sophos Firewall CAPTCHA: WebAdmin and User Portal
The appropriate Device Console commands for WebAdmin, User Portal, and global or VPN-specific settings.
Analysis, Logs, and Troubleshooting 18
Log Viewer, service logs, audit trail, SSH, CLI, packet capture, tcpdump, syslog, and SIEM.
Map Sophos Firewall Service Logs Correctly
For troubleshooting, know which Sophos Firewall service belongs to which module, which log file fits, and when Log Viewer, CTR, debug, or CLI is …
Secure Sophos Firewall Logs for Support and Analysis
In cases of disruptions, VPN issues, or unclear firewall events, a support case requires clean logs, timestamps, and captures if necessary.
Review Sophos Firewall Configuration Changes with Audit Trail
Configuration Audit shows which administrator changed supported firewall objects, when the change occurred, and what was modified.
Connect Sophos Firewall via SSH
SSH is a powerful support channel on Sophos Firewall. Device Access, ACL exceptions, public keys, host keys and control limits matter.
Sophos Firewall CLI troubleshooting: essential commands
Essential CLI commands support log analysis, network checks, service status, and debug logging. A controlled workflow is what makes them useful.
Using Sophos Firewall Packet Capture in WebAdmin
This guide shows how to capture a single flow in WebAdmin and identify where packets arrive, are forwarded, or are dropped.
Use Sophos Firewall tcpdump Safely
tcpdump provides precise packet captures on the firewall. Key aspects include Advanced Shell, tight filters, PCAP files, interface comparison, support …
Check the Sophos Firewall User-ID Limit and VPN Portal Downloads
Sophos Firewall shares 65,535 internal User IDs between users and groups. The specific ID is visible in WebAdmin and helps diagnose failed VPN Portal …
Analyse Dropped Packets on Sophos Firewall
Drops are not automatically errors. For analysis, Log Viewer, Invalid Traffic, Packet Capture, Firewall ID 0, Rule ID, NAT ID, routing, and return …
Resolve Sophos Firewall ARP Issues After Migration
After a firewall replacement, old ARP entries can block individual WAN or alias IP addresses. Packet Capture separates ARP from NAT and rule issues.
How to investigate Sophos Firewall Missing Heartbeat Alerts
Missing Heartbeat means that the firewall continues to see traffic but no longer receives a matching Security Heartbeat. Scope, path and timing are …
Synchronized Application Control: Safely Check Database Issues
Synchronized Application Control data should not be cleaned up using public PostgreSQL commands. This guide covers diagnosis, evidence collection, and …
Test Sophos Firewall performance correctly with iPerf3
iPerf3 measures throughput over a defined path. The test becomes meaningful with a baseline, clear direction, narrow firewall rule, and proper …
Configure sFlow Monitoring on Sophos Firewall
sFlow makes traffic patterns and noticeable flows visible. Important aspects include Collector, Sampling, Interface Selection, Limits, and Operational …
Sophos Firewall SNMP Set up hardware monitoring
SFOS 22 expands SNMP to include temperature, fans, power supplies and PoE. Important are Device Access, MIBs, SNMP version, monitoring targets and …
Conducting an Internet Speed Test on Sophos Firewall via SSH
A speed test on the Sophos Firewall helps isolate WAN and client issues. Key aspects include SSH testing, WAN path, unit, test file, and …
Enable and Operate Sophos Firewall Central Reporting
Central Firewall Reporting transfers firewall logs to Sophos Central. Important aspects include log selection, retention, Report Hub, and syslog …
Send Sophos Firewall Syslog securely to SIEM
Syslog brings Sophos firewall logs to SIEM, SOC or central log servers. Log types, transport, TLS compatibility, parsers, validation and operational …
Operations, Maintenance, and Recovery 15
Backup, firmware, SFOS upgrades, task queue, services, Config Studio, reimage, SSD, HA, and RMA.
Create or Restore a Sophos Firewall Backup
Backups require the file, password, Secure Storage Master Key, target version, management access, and restore compatibility. Essential before updates, …
Sophos Firewall Firmware Update: Preparation and Best Practices
A compact go/no-go checklist for the upgrade path, recovery, HA, Central scheduling, and technical validation after a firmware update.
Perform a Sophos Firewall Firmware Update
How to download and install a suitable SFOS image and verify the firewall with real functional tests after the restart.
Sophos Firewall SFOS 22 Upgrade Check: Find Blockers
The most important blockers and checks before an upgrade to SFOS 22.
Check the Sophos Central Firewall Task Queue
How to distinguish the two queues, handle errors safely, and then verify the change on the firewall.
Restart Sophos Firewall services safely
Restarting a service can recover an individual firewall module. The correct service, secure access and a real functional test are essential.
Using Sophos Firewall Config Studio
Config Studio makes firewall configurations readable, compares multiple versions and prepares changes or migrations.
Sophos Firewall Restart WebAdmin GUI
WebAdmin GUI not responding? A targeted restart of tomcat and apache often helps. You should check access, system status and logs beforehand.
Reinstall Sophos Firewall OS: USB reimage
A reimage fully overwrites the firewall. Before starting, backup, SSMK, installer image, restore compatibility, HA and post-checks matter.
Check Sophos Firewall SSD Health via SMART
The SMART endurance value helps assess SSD wear. Trends, symptoms, storage checks, HA nodes, and support data are decisive.
Check Sophos Firewall storage and manage reports
Storage warnings require root-cause analysis. /var, reports, event logs, troubleshooting logs, mail queue, warning thresholds and data retention are …
Setting Up Sophos Firewall High Availability (HA)
HA connects two Sophos Firewalls into a cluster. Important aspects include prerequisites, licensing, HA link, Monitored Ports, QuickHA, updates, RMA …
Sophos Firewall scripts without cron jobs: safe alternatives
Custom cron jobs and startup scripts are not part of the normal SFOS operating model. This guide explains supported alternatives and a safe migration …
Open a Sophos support ticket: preparation and portal
A good Sophos support ticket reduces follow-up questions. Serial number, licence status, error description, logs, screenshots and portal flow are …
Sophos hardware defect and prepare RMA properly
With a Sophos hardware defect, serial number, warranty, support case, backup, HA status, replacement device and return are important.
Miscellaneous and Legacy 2
Special cases, older clients, and topics that do not fit neatly into the main areas.
Classify Sophos Firewall Home Edition and Sophos Home
Sophos Home Edition, XGS with Base License and Sophos Home suit different private scenarios. The CPU limit, benefits, limits and operation are …
Connect UniFi Device to Cloud Controller via Sophos Firewall
UniFi devices need a controller address for L3 adoption, suitable outbound ports and often DNS. Firewall rules, Inform URL and tests are important.