Sophos Switch

New CLI commands

You can now manage the following features using the CLI:

• Cloud agent: Start, stop, and restart the cloud agent for faster troubleshooting and recovery without the need to restart the device.
• Sophos Central de-registration: De-registers a switch from Sophos Central, simplifying device reprovisioning and decommissioning.
• Port reset: Reset individual ports using the CLI for greater control over network access.
• LACP Interface Speed Query: Query the negotiated speed of LACP interfaces for link aggregation diagnostics and validation.

For a full list of CLI commands, see Sophos Switch command line help.

Port reset

Reset individual ports using the GUI.

Expanded ACL Entries

Increased the maximum number of supported ACL entries for more granular traffic filtering and security policy enforcement.

MAC ACLs have expanded from 16 to 128, IPv4 ACLs have expanded from 16 to 128, and IPv6 ACLs have expanded from 16 to 64 entries.

Admin Password Reset

Another admin account can no longer change the password of the default admin account.

Admin password reset

You can reset the admin password for a switch in Sophos Central on Switch management > System details.

Access control settings

You can manage Access Control Lists (ACLs) and Access Control Entries (ACEs) in Sophos Central on Switch management > Security.

This includes assigning ACEs to ACLs, setting port ranges, and ACL port binding.

Remote network monitoring (RMON)

You can manage RMON settings in Sophos Central on Switch management > System details, including the statistics, event, alarm, and history lists, event logs, and historical log table.

System statistics

You can see detailed system statistics for your switches in Sophos Central on Switch management > System details.

These details include L2 and L3 traffic, 802.1x security, traffic by port, and RMON.

There are no new local user interface features for this release.

There are no resolved issues for this release.

Switch stacking resiliency

Individual switches in a stack now have a resiliency score based on Sophos Central connectivity and firmware availability status.

The overall stack resiliency score is based on the connections within the stack, including the use of LAG interfaces, the topology of the connections, such as network loops and WAN reachability, and the minimum resiliency score for switches in the stack.

There are no new local user interface features for this release.

There are no resolved issues for this release.

Security settings support

You can now configure the following security settings for Switches in Sophos Central.

• 802.1x Port settings: Turn 802.1x authentication on or off and set the authentication server.
• Port security: Limit the number of MAC addresses a port can learn.
• RADIUS server: Configure RADIUS servers for external authentication.
• TACACS+ server: Configure TACACS+ servers for external authentication.

There are no new local user interface features for this release.

There are no resolved issues for this release.

Stacking connection resiliency

The System details page in Sophos Central now shows an icon indicating the resiliency of the connections between switches within a stack.

The icon color changes based on the link speed, Rx and Tx transfer rates, and port utilization of the connection.

• Green: The connection is below 75% of its maximum capacity.
• Orange: The connection is between 75% and 90% of its maximum capacity.
• Red: The connection is over 90% capacity.

There are no new local user interface features for this release.

There are no resolved issues for this release.

System information

You can now change the name of the switch on the System details page in Sophos Central.

You can also add location and contact details for a switch.

Time settings

You can configure SNTP settings for Sophos Switch at the site, stack, and individual switch levels.

There are no new local user interface features for this release.

There are no resolved issues for this release.

Spanning Tree Protocol (STP) updates

You can configure STP settings for Sophos Switch at the site, stack, and individual switch levels.

Sophos Central Global STP configuration supports Rapid Spanning Tree Protocol (RSTP) and Multiple Spanning Tree Protocol (MSTP).

You can create MST instances and configure RSTP, Common and Internal Spanning Tree (CIST), and MST settings for individual ports.

There are no new local user interface features for this release.

There are no resolved issues for this release.

There are no new local user interface features for this release.

There are no new Sophos Central features for this release.

Switch stacking

Switch stacking simplifies switch management by letting you logically group together switches that are physically wired or share identical configurations.

The Stack management page lets you visualize the connections in your stack by showing you the port configuration and connections for all switches in the stack.

Sophos Central stack management includes port settings, VLANs, PoE, QoS, and L3 protocols. All other Sophos Central switch management features are also available.

There are no new local user interface features for this release.

There are no resolved issues for this release.

MAC address blocking

You can block traffic from specific MAC addresses across all VLANs on Monitor > MAC address table > MAC blocking.

You can view the list of blocked MAC addresses on the new Blocking list tab.

There are no new Sophos Central features for this release.

PoE support in Sophos Central

You can configure PoE settings in Sophos Central at both the site and switch levels.

You can set the global PoE power budget or adjust individual settings for each port.

You can turn PoE keepalive on and off and configure it for each port.

Loopback detection

You can configure loopback detection in Sophos Central on Switch management > Port Settings. To prevent loops, the switch sends loopback packets and shuts down any ports that receive a loopback packet from itself.

DoS

DoS configuration is now available in Sophos Central on Switch management > Security. This lets you configure your switches to protect from common denial-of-service attacks.

Log settings

You can configure the log settings for RAM logs flash logs in Sophos Central. This lets you choose the severity level of messages that appear in the logs.

Pagination updates

• If there are more than 10 switches or sites in Sophos Central, the switch overview is separated into pages. You can view your switches and sites 10, 25, or 50 at a time. You can also switch between Tree view and Flat view.
• The Task queue is also separated into pages. You can view 10, 25, or 50 tasks at a time.

Smart logging

Smart logging is now available in Sophos Central under Switch management > Diagnostics > Sophos error reporting. This feature sends agent logs to Sophos Central in the event of any of the following failures:

• Firmware upgrade failure
• Backup failure
• Switch disconnect and reconnect
• Any task synchronization failure

Smart log forwarding is turned on by default. The logging information sent to Sophos Central only contains communication events between switches and Sophos Central. They don't include configuration or network-related data.

Fast Station Creation (FSC) region support

Sophos Central FSC regions (Australia, Brazil, Canada, India, and Japan) now support Sophos Switch.

MAC filter support

You can now add MAC filtering entries from Sophos Central and view synchronized entries.

ARP enhancements

You can now view Address Resolution Protocol (ARP) statistics from Sophos Central.

Active Threat Response on Sophos Central

Sophos Switches registered with Sophos Central with a valid support services license can access the Active Threat Response (ATR) feature. The ATR API ingests threat feed data allowing MDR analysts and network administrators to quickly isolate malicious hosts across the network.

From Sophos Central, an administrator can view an Active Threat Response page and turn the Active Threat Response on or off for Sophos Switches. The ATR page also lists the isolated hosts across all Sophos switches and AP6 access points managed in Sophos Central.

Active Threat Response API

The Active Threat Response APIs are available on Sophos Central. For information on how to access and use APIs from Sophos Central, see Sophos Central APIs. The APIs can enable third-party integrations and workflows to swiftly isolate malicious activity at the network access layer. We're always interested in how third-party integrations are deployed, so please send us feedback regarding your custom integrations.

To view the Switch Management APIs, see Switch Management API.

Diagnostics updates

Sophos Switch diagnostics in Sophos Central have been enhanced with the following new features:

• Take a switch snapshot: Lets you analyze switch details like memory and CPU usage by running a series of system commands that you can view in the task queue.
• Restart Sophos Central agent: Helps quickly resolve temporary runtime issues by restarting the Sophos Central agent processes on the switch.
• Clear core files: Recovers disk space by clearing core files generated from process crash events.

Log tabs

You can now view the RAM and flash logs from the Sophos Switch on the RAM logs and Flash logs tabs on the Diagnostics page.

ARP table

You can now view the ARP table and create entries from Sophos Central. See ARP.

MAC table

You can now view the MAC table and create entries from Sophos Central. See MAC.

Neighbour table

You can now view the Neighbour table from Sophos Central. See Neighbor discovery.

TACACS+ server

You can now configure a TACACS+ server for authentication. See TACACS+ server.

TACACS+ authentication for 802.1X

You can now use a configured TACACS+ server for 802.1X authentication. See 802.1x.

STP Root and BDU Guard

You can now use Root and BDU guards with STP. See STP.

Realtime meters port statistics

You can now view per-port statistics using the realtime meters. See Realtime meters.

SNMP

You can now configure SNMP settings from Sophos Central. See SNMP.

Discovery

You can now configure Cisco Discovery Protocol (CDP) and Link Layer Discovery Protocol (LLDP) from Sophos Central. See Discovery.

Advanced port settings

You can now configure advanced port settings from Sophos Central. See Port settings.

Voice VLAN

You can now configure your voice VLAN from Sophos Central. See VLANs.

Backup and restore from Sophos Central

You can now take and restore configuration backups from Sophos Central. See Backup.

Quality of service (QoS) management from Sophos Central

You can now fully manage QoS settings per switch or per site from Sophos Central. See Quality of service (QoS).

MAC Address Bypass (MAB)

The key addition in this release is MAC Address Bypass (MAB). This feature extends the existing 802.1x functionality by allowing 802.1x MAC-based authentication bypass (MAB). With this Sophos Switch can authenticate one or more connected hosts using the host MAC address as the account information for authentication. Each host connected to a Sophos switch port with MAB enabled is authenticated individually based on the host's MAC address. Any traffic from hosts that aren't authorized is dropped.

Switch Support and Services Subscription

For customers who purchased Support and Services subscription for Sophos Switch, the support activation was not yet integrated into Sophos Central. We are now beginning the process to fully integrate and enforce Support and Services, allowing you to seamlessly manage your switch support subscriptions alongside your other Sophos products.

IP Networks (Released in 2022.39)

With IP networks, you can assign IP addresses to up to 3 VLANs, configure the management VLAN IP address from Sophos Central, and use the switch as a gateway for selected VLANs.

DHCP Relay (Released in 2022.39)

If you're using your Sophos Switch as a gateway for any VLANs that don't have a DHCP server present, the switch can act as a DHCP relay, sending requests to the DHCP server of your choice.

Static Routes

If you're using your switch as a gateway device, you may prefer to route some traffic to gateways other than the default gateway. Static routes allow you to create more direct routing paths when you need it.

DHCP Snooping

Protect against rogue DHCP servers on your networks by enabling and configuring DHCP snooping.

IGMP and MLD snooping

Optimize multicast traffic flows and protect against packet flooding with IGMP and MLD snooping, to direct multicast flows to only interested listeners.

Global UI search

Global search in the switch local UI allows an admin to enter keywords in the search field and will then list all matching entries containing that keyword. Clicking on one of the search results will take you directly to the configuration page, making navigation faster and simpler.

MAC address filter

MAC-Address Filtering (MAF) allows you to block traffic from a specific VLAN-MAC combination. Only the unicast MAC address can be configured in a MAF entry. Multicast and broadcast addresses are not supported in this function.

IP source guard filter

The host IP address can restrict access permission via source validation for security issues. IP source guard is a per-interface traffic filter that permits all IP packets, except for DHCP, only when the IP address and MAC address of each packet match one of two sources of IP and MAC address bindings (DHCP snooping table and static IP source entries that you configure).

Cisco-compatible discovery protocol

Cisco Discovery Protocol is a layer 2 protocol developed by Cisco Systems to show device information between Cisco machines. After enabling CDP, devices can view information of connected Cisco/CDP-supported devices, send CDP packets for neighbors to recognize the Sophos switch, and further improve the convenience of management on devices manufactured by different companies.

Priority-Tag Packet Ingress filter

The VLAN 0 priority tagging feature enables 802.1Q Ethernet frames to be transmitted with the VLAN ID set to zero. These frames are called priority-tagged frames. Setting the VLAN ID tag to zero allows the VLAN ID tag to be ignored and the Ethernet frame to be processed according to the priority configured in the 802.1P bits of the 802.1Q Ethernet frame header. The priority-tag ingress filtering function would ignore packets with the priority-tag to defend against attack packets using VLAN 0.

PoE Port Reset

PoE Port Reset is used to manually reset the PoE power supply of a specific port. After PoE power is turned off (CLI CMD: power reset), power will resume after the specified 'power reset interval' has passed. This feature can be used from the CLI mode by setting custom power reset intervals for each port and connected PoE devices will be powered on after specific intervals.

Link Aggregation Group (LAG) from Sophos Central

This feature allows you to combine multiple Ethernet/SFP links into a single logical link between two network devices for greater throughput and high availability. Admins will be able to configure LAG groups from Sophos Central at the site level and switch level, along with other port settings in Sophos Central.