Skip to content
The XG Series hardware appliances will reach end-of-life (EOL) on March 31, 2025. Click here to see the XG to XGS migration documentation.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/21.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=network-interfaces-RED-automatic-deployment

Set up a RED device automatically

You can create a tunnel between Sophos Firewall and a RED appliance automatically using the Sophos provisioning server.

How automatic provisioning works

Here's how the provisioning server sets up a RED tunnel with the firewall:

  1. You turn on the RED provisioning service in the firewall.
  2. You add the RED to the firewall by adding a RED interface.
  3. The firewall uploads the RED configuration to the Sophos provisioning server.
  4. The RED downloads the configuration from the provisioning server.
  5. The RED creates a tunnel with the firewall.

In this setup, the RED and firewall must have internet access.

Objectives

To set up a RED device automatically, do as follows:

  1. Turn on the RED provisioning service.
  2. Add a custom zone for RED devices.
  3. Add a RED interface.
  4. Create a firewall rule for tunnel traffic.

Turn on the RED provisioning service

Before you can configure RED interfaces you must turn on the RED provisioning service in the firewall. Do as follows:

  1. Go to System services > RED.
  2. Under RED configuration, turn RED status on.
  3. Enter your information.
  4. Select the box to agree to the Sophos End User Terms of Use.
  5. Click Apply.

Add a custom zone for RED devices

When adding the RED interface, if you've set the RED device in the LAN zone, the firewall applies the same rules to the RED device as the rest of the LAN network. To maintain a logical separation between the RED and LAN networks, add a custom zone for RED devices or use an existing zone, such as VPN or WiFi.

To add a custom zone for RED devices, do as follows:

  1. Go to Network > Zones and click Add.
  2. Enter a name for the zone. For example, RED.
  3. For Type, select LAN or DMZ. See Add a zone.
  4. For Device access, select the service you want for this zone.
  5. Click Save.

Add a zone for RED devices.

Add a RED interface

To create an interface for the RED, do as follows:

  1. Go to Network > Interfaces, click Add interface, and select Add.
  2. Enter a branch name and select your RED device type.
  3. For Device deployment, select Automatically via provisioning service.
  4. Specify the other RED model settings as required.
  5. Under RED network settings, select the zone you created for RED devices.
  6. Click Save.

Allow RED services

To allow RED services from the required zones, do as follows:

  1. Go to Administration > Device access.

  2. Under RED, select the zones in which your RED devices are located.

    Tip

    You can also create a Local service ACL exception rule for RED services. See Add local service ACL exception rule.

  3. Click Apply.

Select the zones in which your RED devices are located.

(Optional) Synchronize time for offline REDs

RED devices must synchronize their time to complete the TLS handshake with the firewall. To ensure that RED devices in offline mode can do so, allow them internet access to connect with the Sophos NTP server pool. Alternatively, create a Local service ACL exception rule allowing them to connect to the firewall from the WAN zone as follows:

  1. Click Add.
  2. Enter a rule name.
  3. Set Source zone to WAN.
  4. Set Source network or host to the RED device's IP address.
  5. Set Destination host to the firewall's WAN port.
  6. Set Services to HTTPS.
  7. Set Action to Accept.
  8. Click Save.

Create a firewall rule for tunnel traffic

You can configure firewall rules for RED devices based on their zones.

If you use an existing zone, previously created firewall rules determine how traffic is routed. Make sure the rules that apply to the selected zone don't break security for your internal networks. For example, the VPN zone prevents the firewall from resolving DNS requests. The VPN zone instead uses DHCP to distribute a different DNS server.

To create a firewall rule for tunnel traffic, do as follows:

  1. Go to Rules and policies > Firewall rules.
  2. Select IPv4 or IPv6, select Add firewall rule, and then select New firewall rule.
  3. For Source zones, select the zone you created for RED devices.
  4. Select a network in Source networks and devices if you want the firewall rule to match a network within the zone. Otherwise, select Any.
  5. For Destination zones, select LAN and WAN.
  6. Select a network in Destination networks if you want the firewall rule to match a network within the zone. Otherwise, select Any.
  7. Click Save.