Sophos Firewall

New Backup-restore assistant

SFOS 20.0 MR2 introduces the new backup-restore assistant and offers greater flexibility in restoring backups. The version also eliminates all practical restrictions.

Backup-restore assistant: The enhanced backup-restore functionality allows you to see and change the default port mapping in the new assistant. The assistant is available for backups from 19.5 MR4 and later versions restored to 20.0 MR2 and later.

Great flexibility: The following features are available for backups from all supported versions restored to 20.0 MR2 and later:

• Wider model compatibility: You can move from a higher to a lower-capacity appliance model and restore existing backups. For example, you can restore backups from a 1US XG Series firewall model to the desktop XGS 126 model of the more powerful XGS Series firewalls. You can also restore backups among hardware appliances, cloud, virtual, and software firewalls.
• Change the interface mapping: You can change the default interface mapping and map a physical interface to a different one, including higher-speed ports. For example, you can map a 10 GbE port to a 40 GbE port. You can change the parent interfaces of VLAN and LAG interfaces.
• High availability ports: You can restore HA backups to devices with fewer or more interfaces. The dedicated HA link can be on a different port in the target device. See the help page Key interface mapping concepts in 20.0 MR2.

The release eliminates previous limitations that required the target device to have the same number of interfaces and the same dedicated HA link port as the backup.

Backup-restore links

• Use the tool to check if you can restore backups between appliance models and platforms. Check compatible devices to restore backups.
• Watch the video Backup-restore enhancements.
• See the help page Restore backups to 20.0 MR2.

Other security and flexibility enhancements

• More transparent AD SSO experience when HSTS is enforced, enabling the Kerberos or NTLM handshake to take place over HTTP or HTTPS.
• Improved interactions with an Active Directory domain when a high availability failover occurs.
• Enhanced Web Protection performance with reduced system load when enforcing SafeSearch, YouTube restrictions, Google App login domain restrictions, and Azure AD tenant restrictions.
• Cipher compliance: You can set your security balance for cipher compatibility or audit compliance (PCI) by customizing the allowed cipher suites. Read the knowledgebase article TLS 1.1 and cipher support in captive portal and web proxy.

Important points to know before you upgrade

SSL VPN compatibility for 20.0 MR1 and later with EoL SFOS versions and UTM9 OS

OpenVPN has been upgraded to 2.6.0 in this version. Firewalls upgraded to 20.0 MR1 and later versions won't establish SSL VPN tunnels with the following clients and firewall versions:

• SFOS 18.5 and earlier versions (end-of-life): Site-to-site SSL VPNs won't be established between SFOS 18.5 or earlier versions and SFOS 20.0 MR1 and later. We recommend that you upgrade both firewalls to 20.0 MR1 and later versions at the same time. Alternatively, you can use site-to-site IPsec or RED tunnels.
• Legacy SSL VPN client (end-of-life): Remote access SSL VPN tunnels won't be established with the legacy SSL VPN client, which is already end-of-life. You can use the Sophos Connect client or third-party clients, such as OpenVPN client, or use remote access IPsec tunnels. See Remote access SSL VPN with the Sophos Connect client. See Remote access IPsec VPN.
• UTM9 OS: Site-to-site SSL VPNs won't be established between UTM9 OS and SFOS 20.0 MR1 and later versions. We recommend that you migrate these to 20.0 MR1 and later versions. Alternatively, you can use site-to-site IPsec or RED tunnels.

For site-to-site IPsec tunnels, see Route-based VPN. For RED tunnels, see Site-to-site RED tunnel.

End-of-life RED devices

20.0 MR1 and later versions won't support the following legacy RED devices: RED 15, 15w, and 50. They have been declared end-of-life in 2023. For more details, see the article Sophos RED: End-of-life of RED 15/15(w) and RED 50.

LINCE certification

You can configure the following Sophos Firewall platforms to use a cryptography library that meets Spain's National Essential Security Certification (LINCE):

• XGS series hardware appliances
• Cloud, virtual, and software firewalls

For more details, read National Essential Security Certification (LINCE).

Device access and Local service ACL exception rules

Device access: This release offers enhancements to the device access grid for access from zones to certain services. The grid has also been grouped to offer intuitive configurations and granular control:

• IPsec and RED: IPsec and RED services are available on Device access to allow or block traffic based on zones. For example, you can block access to RED service from WAN while allowing access from other zones.
• VPN services: IPsec, SSL VPN, VPN portal, and RED are grouped under VPN services.

Local service ACL exception rule:

• List view: The list view of exception rules provides detailed information, such as source, destination, service, and action, with full visibility into the rules, eliminating the need to open the rule to check information.
• Services: All the services in the device access grid are now available under services in the exception rule, including RED and IPsec services, offering granular control. For example, you can create an exception rule to allow or block VPN on a specific interface when the service is allowed from WAN. You can also specify the country and IP address, dropping VPN requests from specific countries, such as China, and allow VPN traffic from known FQDNs. The additional services available in exception rules are AD SSO, RADIUS SSO, Captive portal, Client authentication, Chromebook, Wireless, SMTP, SNMP, RED, and IPsec.
• Additional object types: The object types, FQDN host, FQDN host group, MAC address, and MAC address list, are available for selection in source and destination hosts, eliminating the need to update dynamic IP addresses in local ACL exception rules.

SD-WAN enhancements for scalability

• Scalability: This version brings 4x improvements in the gateway availability time during HA failover and device restart, ensuring minimal traffic disruption.
• Detailed information view: SD-WAN routes show important gateway information, such as IP address, interface, and name, when you hover over the gateway while configuring the route.

VPN enhancements

SSL VPN

• OpenVPN 3.0: Sophos Firewall is now compatible with OpenVPN 3.0 clients. Users can download the compatible configuration file from the VPN portal.

IPsec VPN

• Phase I ciphers: The GCM suite-B ciphers, AES256GCM16, AES192GCM16, and AES128GCM16, are available for Phase I IKEv2 tunnels, offering better throughput and greater interoperability with third-party devices.
• System-generated traffic: CLI commands are available to prevent system-generated traffic from flowing through policy-based IPsec tunnels when the remote subnets are set to Any. For details, see the routing commands.
• The firewall now uses the upgraded strongSwan version 5.9.11.

Logging enhancements

• Download log files: You can download individual log files from the web admin console on the Diagnostics page under Troubleshooting logs. The Consolidated Troubleshooting Report (CTR) continues to have all the log files.
• Default log lines in CTR: The default number of log lines for log files in the Consolidated Troubleshooting report is now 10,000.
• Syslog delimiter: You can customize the delimiter in syslog event messages, offering flexibility in managing log data.

True Zero Touch configuration

TPM-based True Zero Touch is available to remotely deploy firewalls in branch offices through Sophos Central. You'll specify the firewall configuration in Sophos Central. The remote firewall administrator connects the firewall to the internet and turns it on. The firewall connects to Sophos Central, downloads and applies the configuration, and then registers with Sophos Central. For more details, see the Sophos Central help.

RED

SD-RED now supports bridge configuration for WAN interfaces with the RED tunnel.

Other enhancements

• Generative AI assistant: The firewall now provides assistance using Generative AI through Sophos Assistant with dynamic help and configuration steps.
• Automatic language detection: The web admin console and user portal automatically select and store the browser's preferred language for languages the firewall supports, offering a seamless sign-in experience.
• Custom gateways: Custom gateways now support the link-local address.
• Data optimization in Synchronized Application Control: The firewall only retains the recent five occurrences for each application detected by SAC per endpoint.
• IPv4 internet host group: Updated the default public IPv4 host ranges to contain all the public IPv4 address ranges.
• Object descriptions: Added description fields for IP, MAC, FQDN, and service objects.
• Country list: Updated the country list.
• Web: In the web proxy, we've refined the Pharming protection feature to address a potential vulnerability arising from modifications to the destination IP address during proxy DNS resolution. With the updated behavior, the firewall policy will now undergo re-evaluation using the DNS-resolved IP address from Pharming protection.
• XML API: 20.0 MR1 and later versions don't support the XML API version for the end-of-life versions 17.5 and 18.0. If the APIVersion tag you use shows old versions, change the tag to the supported API versions.

Active threat response

Active threat response integrates Managed Detection and Response (MDR) threat feeds with Sophos Firewall. Synchronized Security extends to Active threat response, enabling the firewall to automatically shut down active threats in the network.

MDR threat feeds

Active threat response brings the MDR service to Sophos Firewall through MDR threat feeds. Security analysts from the Sophos MDR team (or your XDR SOC team in the future) can share threat intelligence related to your network, pushing active threat information in real time to the firewall. Based on the threat feeds, the firewall automatically blocks traffic, including DNS requests and HTTPS traffic, from any host in the network that tries to communicate with malicious IP addresses, domains, or URLs. Additional rules and policies aren't required for the Active threat response action. Watch the video Active threat response with MDR threat feeds.

Synchronized Security: Active threat response extends Synchronized Security with its automated response based on RED Security Heartbeat to MDR threat feeds in the firewall. Based on the threat feed, the firewall automatically queries any Sophos-managed endpoint attempting to communicate with malicious servers for additional information, such as the host, user, and process, which enables you to determine any Indicators of Compromise (IoC). It prevents compromised endpoints from moving laterally or communicating outward, shutting down active threats in the network.

The release enhances Synchronized Security with added scalability and reduced false missing heartbeats for endpoints in sleep or hibernate status.

Dynamic threat feeds

Sophos X-Ops threat feeds: Advanced threat protection has been renamed Sophos X-Ops threat feeds. It offers periodic updates of threat feeds from SophosLabs.

Extensible framework for dynamic threat feeds: Active threat response introduces a new extensible API framework for dynamic threat feeds in the firewall. The framework enables the following threat intelligence to be shared with the firewall:

• Sophos products and services, such as Sophos X-Ops and MDR threat feeds.
• Third-party threat feeds in a future release.

Network scalability and resiliency for distributed enterprises

The release offers VPN, IPv6, and SD-WAN enhancements with scalability, security, and interoperability.

VPN enhancements

• VPN portal: A new, hardened, and highly secure, containerized self-service VPN portal is available for remote access VPN users. It contains remote access downloads, such as the Sophos Connect Client and configurations, and performs auto-provisioning for remote access VPN connections. It also contains clientless VPN bookmarks.

  These services are no longer available in the user portal, minimizing the need to expose the user portal to WAN and tightening its security. To maintain compatibility, the VPN portal is available by default on the previous user portal port (443). It can share a common port with WAF or SSL VPN. The user portal now uses port 4443 by default. See the help for Port sharing among services.

  For migration details and how port settings apply from Sophos Central, see the knowledge base article New VPN portal in SFOS 20.0 and later.

• FQDNs in SSL VPN: Fully qualified domain name (FQDN) host and group support is available for remote access and site-to-site SSL VPNs. You can select these under permitted, local, and remote networks.
• IPsec VPN:
  • Stateful HA failover: Seamless transition for route-based, policy-based, and remote access VPNs without losing tunnel connectivity during high-availability failover. Also supports seamless connection failover for stateless protocols with minimal packet loss.
  • SNMP monitoring for tunnel status: Added MIB entries to monitor the following IPsec VPN tunnel statuses through SNMP: activate, deactivate, connected. You can download the new MIB file from the web admin console.
  • Multiple remote gateway support for route-based VPN: You can enter a wildcard address (*) for the remote gateway in route-based VPNs. This eliminates the need for explicit DDNS or FQDN configuration in dynamic gateway IP deployments.
  • Unique preshared keys: You can have unique preshared keys (PSK) for VPN connections with the same local and remote gateway settings if you use IKEv2 profiles and configure a unique set of local and remote IDs.
  • DH groups 27 to 30: DH groups 27 to 30 are available for IKEv2 IPsec profiles based on RFC 6954.

Watch the video VPN enhancements.

IPv6 DHCP prefix delegation and BGP, SD-WAN

• IPv6 DHCP prefix delegation: Seamless integration with DHCP prefix delegation by ISPs for internal networks. This automates the assignment of IPv6 prefixes to internal subnets, simplifying network setup and reducing manual configuration. Watch the video DHCP prefix delegation.
• BGP IPv6: Enhancements to the dynamic routing engine now support BGPv6 for improved IPv6 interoperability. Watch the video IPv6 dynamic routing in Border Gateway Protocol.
• SD-WAN scalability: Increased scalability for SD-WAN gateways by 3 times to 3072 gateways and the number of SD-WAN profiles to 1024.

Quality of life enhancements

• Turn interfaces on or off: Turn interfaces on or off while retaining their configurations. The turned-off status appears on the Control center.

  You can't turn off alias or tunnel interfaces and members of a LAG or bridge interface, but you can turn off the entire LAG or bridge interface.

• Object reference lookup: You can see the usage count of all host and service objects and the list of all locations where the object is in use, such as in rules, policies, and routes. You can edit or remove objects from the object list without going to the location for many locations.
• High resolution for web admin console: The web admin console now uses a high-resolution display, delivering a scalable user interface. Tables use the Full HD width (1920 pixels) to show more information, reducing the need to scroll horizontally.
• Automatic rollback for failed firmware updates: If a firewall, including high-availability devices, can't complete a firmware upgrade, the firewall (or the cluster) is automatically rolled back to the previous firmware version. An alert appears in the Control center.
• Backup-restore: You can restore backups from a firewall with integrated Wi-Fi to a firewall without integrated Wi-Fi. You must remove the wireless networks in the firewall before taking the backup.
• Microsoft Entra ID (Azure AD) SSO: Watch the video Captive portal SSO and group import.
  • Captive portal: Microsoft Entra ID (Azure AD) SSO now supports user authentication through the captive portal. Version 19.5 added Azure AD SSO authentication for the web admin console.
  • Import groups: You can use the new import assistant to import all Microsoft Entra ID (Azure AD) groups or those that match the attributes you specify from Azure Portal. This eliminates the need to create groups manually in the firewall.
  • Automatic Azure RBAC: Introduces Role-based Access Control (RBAC). If you change a user's role in Azure Portal, the firewall automatically applies their new role when they next sign in. It also applies the profile and privileges that apply to the new role.

Watch the video Quality of life enhancements.

Web Application Firewall (WAF)

• Geo-IP policy enforcement: You can block users from accessing resources protected by WAF from the countries you specify or IP addresses that can't be associated with a specific country.
• Custom ciphers and TLS version settings: Enables the use of more secure ciphers while excluding less secure ciphers.
• Improved security: Adds HTTP Strict Transport Security (HSTS) for HTTPS enforcement in the client (browser) and X-Content-Type-Options enforcement to provide MIME-type sniffing protection.

Azure enhancements

Azure Single Arm Deployment Support: For Microsoft Azure public cloud deployments, you can choose a smaller instance size with single arm deployments and save your infrastructure costs. This reduces network and operational complexity.