Add a firewall with Controlled Zero Touch

With Controlled Zero Touch, you specify your firewall configuration settings in Sophos Central. Your firewall administrator then connects the firewall to the internet and turns it on. The firewall connects to Sophos Central, downloads and applies the configuration, and then registers with Sophos Central.

Requirements

If your firewalls are on version 19.0 MR1 or later, you can deploy them using Controlled Zero Touch (CZT) configuration.

Controlled Zero Touch configuration is available for SG, XG, and XGS firewall devices.

The firewall must have DHCP enabled on the WAN port your firewall administrator uses to connect to the internet. New Sophos firewalls have DHCP enabled on WAN Port2 by default.

If you add multiple firewalls, a cache issue may arise, and the process may not work. To prevent this, use a separate private browsing tab to connect each firewall.

What to do in Sophos Central

To add a new firewall with Controlled Zero Touch, do as follows:

1. Go to My Products > Firewall Management > Firewalls.
2. Click Add Firewall.

3. Under Add firewalls to Sophos Central, click Start Setup.

   

4. Under Add Firewall, enter the serial number of your Sophos Firewall, and click Next.

   

   Claim firewall appears. You'll see your firewall's serial number and model.

5. Click Next.

   

6. Accept the license agreement and click Continue.

7. Select the name and time zone of the firewall and click Continue.
8. Check the licensed features, opt into the customer experience improvement program if you want to, and click Continue.

9. Configure your LAN settings and enable DHCP if you want to.

   If you enable DHCP, you must enter a DHCP lease range. You can cancel or reset these settings if needed.

10. Optional: Click Edit Internet Connection to configure your WAN settings, and click Apply. You can cancel or reset these settings if needed.

11. Click Continue.

12. Select your Network protection settings, then click Continue.

    

13. Check your Configuration summary, then click Finish.

    You'll see the Zero Touch configuration options.

    

14. Under Zero Touch configuration, select Firewall downloads configuration from Sophos Central.

15. Optional: Under Central Management auto-approval, select Auto approve for Central management, and click Continue.

    If you don't select this option, you can accept your firewall later in Sophos Central.

16. You see information about the firewall deployment steps. Click Finish.

    

    You see your firewall under Firewall Management - Firewalls. Its status is Waiting for deployment.

What to do on Sophos Firewall

Your firewall administrator must do as follows:

1. Connect the firewall to the internet on a DHCP-enabled port at the site where you want to deploy the firewall.

   The firewall connects to Sophos Central, downloads and applies the configuration, and registers with Sophos Central.

2. Optional: Type the web admin console address into your browser, followed by port 4444, to see the setup progress in the Sophos Firewall wizard. Example: 172.16.16.16:4444. The Zero Touch setup window will show.

   

   Note

   If the firewall can't connect to Sophos Central, the firewall administrator can troubleshoot the issue. See Zero Touch FAQ.

   When the Zero Touch setup is complete, the firewall administrator sees the firewall's web admin console sign-in page.

   You can now add the firewall to a group and manage it through Sophos Central.

Accept the firewall if you didn't select auto approve

1. In Sophos Central, go to My Products > Firewall Management > Firewalls.
2. Search for your firewall's serial number.

3. Click Accept services.

   Once you accept the firewall, the remaining settings are applied. You can now add the firewall to a group and manage it through Sophos Central.

Set your admin password

1. In Sophos Central, go to My Products > Firewall Management > Firewalls.

   You see your firewall is now connected.

2. Click your firewall's name.

   You're connected to your firewall's web admin console.

   In the Control Center, under Messages, you see the following alert message: "Click here to set the local firewall admin password".

3. Click the Click here link.

4. You're redirected to Administration. Scroll down to Default admin's password settings.
5. Enter and confirm your password, click Apply, then click OK to confirm.

6. At the top left of the screen, click Back to FW Management.

   You're redirected back to Sophos Central firewall management.

Sign into your firewall

Your firewall administrator must do as follows:

1. Type the web admin console address into your browser, followed by port 4444. Example: 172.16.16.16:4444.
2. Sign in to the web admin console using the password you set.

3. Under the System section, go to Sophos Central.

   

   Under Sophos Central registration, the Device status is Registered.

   Under Sophos Central services, the status is Managed.