set

Add a host or network where the outbound and return traffic does not always pass through Sophos Firewall.

You can add or delete either single hosts or entire networks.

Allow or deny access to the web admin console from all WAN sources.

If you enter enable, you turn off access from all WAN sources. This ensures higher security levels. See Best practices.

Default: enable

With TCP selective acknowledgement (SACK), the firewall allows the receiver to inform the sender about the specific segments it receives. The sender can then retransmit only the lost and out-of-order segments rather than the entire TCP window, ensuring efficient retransmission.

It minimizes unnecessary retransmissions, reduces latency, and enhances the throughput, ensuring more reliable data transmission.

With window scaling, the firewall extends the TCP window size beyond the traditional 16-bit limit (64 KB) supporting high-bandwidth networks. By increasing the window size, it ensures larger data transfers in a single TCP connection, enhancing the throughput and reducing latency.

It optimizes flow control by dynamically adjusting the window size based on network capacity, avoiding congestion, and optimizing data transmission. See RFC1232.

Administrators can NAT the traffic generated by the firewall so that the IP addresses of its interfaces aren't exposed or to change the NAT'd IP for traffic going to a set destination.

Example: set advanced-firewall sys-traffic-nat add destination 172.16.16.5 snatip 192.168.2.1

Interval (in seconds) at which DNS lookups for domains that resolve to localhost occur.

Range: 60 to 655360 seconds
Default: 655360 seconds

Set cache-ttl value for FQDN Host. The cache-ttl value represents the time in seconds after which the cached FQDN host to IP address binding will be updated.

Range: 1 to 86400 seconds

Default: 3600 seconds

dns-reply-ttl: use the ttl value in the DNS reply packet as cache-ttl

The idle-timeout value represents the time in seconds after which the cached FQDN host to IP address binding is removed.

Range: 60 to 86400 seconds

Default: 3600 seconds

Turn proxy loop blocking on or off. A proxy loop occurs when a proxy forwards a request to itself or receives a request from another proxy. When you turn on block_proxy_loop, the firewall drops traffic when it detects duplicate Via headers in packets.

To trace proxy loop logs, make sure block_proxy_loop is turned on and that the awarrenhttp service is in debug mode. This is turned off by default. Turning it on impacts performance, and you must turn it on only for troubleshooting purposes.

The awarrenhttp.log file shows the message "Duplicate Via header values, proxy loop" when a proxy loop is detected.

Allow or deny connections using TLS 1.0 to the captive portal.

We don't recommend using TLS 1.0 because it isn't secure. This should only be turned on if you require it for a specific business need.

Allow or deny connections using TLS 1.1 to the captive portal.

We don't recommend using TLS 1.1 because it isn't secure. This should only be turned on if you require it for a specific business need.

Allows you to turn on or turn off category lookup for SSL/TLS inspection rules. If disable_tls_url_categories is on, traffic isn't categorized.

This affects which SSL/TLS inspection rule is chosen. For SSL/TLS inspection rules, it'll only match those with ANY specified for Categories and websites and nothing else. For example, if there's no SSL/TLS rule with value ANY for Categories and websites, no rule will be matched if disable_tls_url_categories is on. The default behavior applies.

These settings also affect any web policy applied to the traffic. The traffic is uncategorized when a web policy is applied during the TLS handshake. The disable_tls_url_categories setting does not affect the categorization of URLs for HTTP or decrypted HTTPS traffic, as the full packet contents are seen in these scenarios.

Allow or deny connections using TLS 1.0 through the proxy when HTTPS is decrypted.

We don't recommend using TLS 1.0 because it isn't secure. This should only be turned on if you require it for a specific business need.

Allow or deny connections using TLS 1.1 through the proxy when HTTPS is decrypted.

We don't recommend using TLS 1.1 because it isn't secure. This should only be turned on if you require it for a specific business need.

Sets the supported ciphers for both captive portal and the proxy. This is specified in cipher string format.

Example:

HIGH:!RC4:!MD5:!aNULL

Specifies IPS inspection for all or untrusted content.

untrusted-content: Inspects untrusted content only. Doesn't inspect content trusted by SophosLabs. Provides the best performance.

all-content: Inspects all content. Provides the best security.

Default: Inspects untrusted content only. This is secure enough for most users.

The number of packets scanned in new and updated connections from the client and the server. For example, the firewall scans the first eight packets from the client and the first eight packets from the server.

Default: 8

To identify complex or evasive applications, such as proxy or P2P applications, we recommend setting it to 80. See Configure recommended settings for P2P and Proxy and Tunnel.

Setting this value too high results in reduced connection speed.

Determines whether packet streaming is to be allowed or not. Packet streaming is used to restrict the streaming of packets in situations where the system is experiencing memory issues.

If packet-streaming is set to on, which is the default setting, the IPS engine builds an internal table during a session and deletes it at the end. It also reassembles all incoming packets and checks the data for known signatures.

If packet-streaming is set to off, then protocols such as Telnet, POP3, SMTP, and HTTP are vulnerable as reassembly of packets or segments can no longer occur. Data is sometimes broken up into chunks of packets and must be reassembled to check for signatures. These protocols are now vulnerable to malicious files that are hidden by splitting.

Offloads the re-signing of X.509 server certificates for SSL/TLS flows inspected by the DPI engine to the crypto hardware on the Xstream Flow Processor.

Default: Enabled on the supported versions and appliances.

On SFOS versions and XGS Series models that don't support PKI acceleration, its status appears as disabled. See Summary of supporting versions and appliance models.

To see the pki-acceleration status, enter show ips-settings. See show commands.

For PKI acceleration to take effect, firewall acceleration must be turned on. If PKI acceleration is turned on but firewall acceleration is turned off, the status appears as enabled (inactive). See Firewall acceleration.

Set the search method for IPS signature pattern matching.

ac-bnfa: low memory usage, high performance.

ac-q: high memory usage, best performance.

hyperscan: low memory usage, best-performance.

Set whether the audio and video data channels should be ignored. Enable this option to ignore such channels.

Enabled by default.

Set how IPS handles the TCP urgent flag and pointer, if the flag is sent in TCP packets. Default is remove.

allow: Allows the urgent flag and pointer without changing the packet.

remove: Removes and resets the urgent flag and pointer.

Allows you to configure the interface speed and duplex. Values are in Mbps and either full or half duplex. Auto allows the interface to automatically negotiate speed with the connected neighbor device.

Turn auto-negotiation of speed and duplex on or off and select a Forward Error Correction (FEC) mode for the interface. FEC modes depend on the appliance model.

Allows you to set various parameters for any configured lag interfaces. Where the variable is stated as value, the available values are as follows:

down-delay: 0-10000 milliseconds

garp-count: 0-255

monitor-interface: 0-10000 milliseconds

up-delay: 0-10000 milliseconds

Sets the watermark level. Allowed values are from 50 to 75.

Default: 70.

Turn on or off policy-based IPsec VPN routes for system-generated traffic.

Default: On

Warning: This will restart all IPsec tunnels. Plan your downtime accordingly.

Configures WAN load balancing to balance traffic between multiple WAN interfaces.

Session persistence sends traffic for the same session over a specific interface. Weighted round robin passes traffic over different interfaces depending on the load that each interface experiences.

You can define these four ways when using session persistence to balance traffic.

Connection-based sends all traffic related to the same connection over the same interface.

Destination-only send all traffic to a specific source over the same interface.

Source-and-destination based sends all traffic between the same source and destination over the same interface.

Source-only sends all traffic from a specific source over the same interface.

Furthermore, you can choose to balance just IPv4, IPv6, or all traffic.

HTTP [add | <p>delete] [port] {portID}

IMAP [add | <p>delete] [port] {portID}

IM_MSN [add | <p>delete] [port] {portID}

IM_YAHOO [add | <p>delete] [port] [port number]

POP [add | <p>delete] [port] {portID}

HTTPS [add | delete] [port] {portID} [deny_unknown_proto] [on | off] [invalid-certificate] [allow | <p>block]

SMTP [add | delete] [port] {portID} [failure_notification] [on | off] [fast-isp-mode] [on | off] [notification-port] [add] [port] {portID} [strict-protocol-check] [on | <p>off]

SMTPS [add | delete] [port] {portID} [invalid-certificate] [allow | block]

To allow inspection of traffic on non-standard ports for a specific protocol use the add port commands. This works for all services available within the service-param command list.

There are more options available for HTTPS, SMTP, and SMTPS.

ipsec-performance

[ipsec-max-workqueue-items <1024-10240>]

[anti-replay window-size {32 | 64 | 128 | 256 | 512 | 1024 | 2048 | <p>4096}]

[cookie_threshold <number>]

ipsec-max-workqueue-items: You can set the size of the work queue to any value from 1024 to 10240.

anti-replay window-size: The firewall keeps track of which packets it has seen during decryption, according to the limit set, to prevent replay attacks. Default: 1024.

cookie_threshold: Cookie validation is always on. The feature's only available for IKEv2. When the number of simulatenous half-SAs exceeds the cookie threshold, the responder sends a cookie request to initiators to protect from DoS attacks. Default: 30