Sophos Firewall

---
name: sophos-firewall
description: "Expert coverage of Sophos Firewall (XGS/XGV) across all versions: Xstream architecture, three-lane processing, Synchronized Security heartbeat, TLS inspection, Sophos Central management, ZTNA gateway, SD-WAN, CIS health checks, and v22 containerized services. Use for \"Sophos Firewall\", \"XGS\", \"Xstream\", \"Synchronized Security\", \"Security Heartbeat\", \"Sophos Central\", \"Sophos ZTNA\", \"Sophos WAF\", \"Sophos SD-WAN\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `firewall` skill."
license: MIT
---

# Sophos Firewall

This skill covers Sophos Firewall across all supported versions (v19 through v22). Areas of expertise include:

- Xstream architecture and three-lane processing (TLS Inspection, FastPath, DPI Engine)
- XGS hardware with dedicated Xstream Flow Processors
- Synchronized Security and Security Heartbeat integration with Sophos Endpoint
- Firewall rule design (network rules, WAF rules, linked NAT)
- SSL/TLS inspection (outbound forward proxy, inbound reverse proxy, TLS 1.3)
- Sophos Central cloud management and zero-touch deployment
- ZTNA gateway deployment and micro-segmentation
- SD-WAN with performance-based routing
- v22 containerized services architecture and CIS health checks
- API automation and Sophos Central REST API

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Use diagnostic commands and log analysis
   - **Policy design** -- Apply network firewall rules (top-down, implicit deny) and WAF rules
   - **Architecture** -- Load `references/architecture.md` for Xstream lanes, XGS hardware, Synchronized Security
   - **Integration** -- Synchronized Security, Central management, ZTNA, XDR
   - **Automation** -- Local API or Sophos Central REST API

2. **Identify version** -- Determine firmware version (v19, v20, v21, v22). Version matters: containerized services require v22, CIS health check requires v22, Xstream Flow Processor requires XGS hardware.

3. **Load context** -- Read the reference file for deep knowledge.

4. **Analyze** -- Apply Sophos-specific reasoning, not generic firewall advice. Consider the Xstream lane model for performance questions.

5. **Recommend** -- Provide actionable guidance with WebAdmin GUI paths or CLI commands.

6. **Verify** -- Suggest validation steps using diagnostic commands, log analysis, or Central dashboards.

## Core Architecture: Xstream

Xstream is the data plane architecture with three processing lanes:

### 1. TLS Inspection Lane
- Hardware-accelerated TLS 1.3 decrypt/re-encrypt using the dedicated Xstream Flow Processor (XGS hardware)
- Full DPI applied to HTTPS without CPU bottleneck
- Certificate pinning bypass lists, category exclusions, per-rule inspection policies
- On non-XGS hardware, TLS inspection runs on general-purpose CPU

### 2. FastPath Lane
- Trusted, already-inspected traffic offloaded to hardware FastPath
- No further processing; line-rate forwarding
- Dramatically reduces CPU load for established sessions
- Flows graduate to FastPath after passing full DPI on first packets

### 3. DPI Engine Lane
- Deep Packet Inspection for new/untrusted flows
- Runs IPS signatures (containerized in v22), application identification, malware scanning, web filtering
- CPU-bound processing for complex inspection
- In v22, DPI services run as isolated containers

### Adaptive Traffic Routing
Xstream routes each flow to the appropriate lane based on trust level, rule policy, and content type. Previously inspected flows graduate to FastPath automatically. Suspicious or unclassified traffic routed through full DPI.

## Firewall Rules

### Network Firewall Rules
- Standard zone-based 5-tuple matching (source zone, destination zone, source/destination IP, service/port)
- Application-aware matching independent of port
- **Security Profiles** attached per rule: IPS, web filter, application control, SSL inspection, QoS
- **User identity** matching via AD/LDAP SSO, RADIUS, Captive Portal
- Rules evaluated top-down; implicit deny at bottom
- **Linked NAT** -- NAT applied directly within a firewall rule or as separate rule

### WAF Rules (Web Application Firewall)
- L7 protection for published web applications (reverse proxy mode)
- OWASP Top 10 protection, form hardening, cookie signing
- URL/verb-based access control, geographic restrictions
- Client authentication (form-based, NTLM, client certificate)
- Load balancing with health checks

## SSL/TLS Inspection

- TLS 1.0 through TLS 1.3 decryption
- **Outbound (forward proxy)** -- Inspect user HTTPS; re-signs with Sophos CA
- **Inbound (reverse proxy / WAF)** -- Terminate TLS for published apps
- **Inspection profiles** -- Configure which categories, networks, users are inspected/excluded
- Certificate-pinned site bypass list
- Hardware acceleration via Xstream Flow Processor (XGS only)

## Synchronized Security

The integration layer between Sophos Firewall and Sophos Endpoint (Intercept X):

### Security Heartbeat
- Endpoint agent sends continuous encrypted heartbeat to the firewall
- Health status: **Green** (healthy), **Yellow** (PUA detected), **Red** (active threat)
- Firewall makes real-time policy decisions based on endpoint health:
  - Red: isolate endpoint (block all except Sophos Central remediation)
  - Yellow: restrict access (configurable)
  - Missing heartbeat: optionally restrict

### Lateral Movement Protection
- Compromised endpoints (Red heartbeat) automatically isolated from the network
- Other endpoints on the same VLAN cannot communicate with the isolated host
- Isolation occurs in seconds, faster than manual SOC response
- Prevents ransomware lateral movement without manual intervention

### Active Threat Response
- SOC analysts using Sophos MDR or XDR can manually trigger Synchronized Security responses
- Extends automated endpoint isolation to human-in-the-loop SOC actions

## Sophos Central Cloud Management

- **Single pane of glass** -- Manage Firewall, Endpoint, Email, Mobile, Wireless, ZTNA
- **Group policies** -- Deploy configuration templates across multiple firewalls
- **Cloud reporting** -- Log analysis, traffic dashboards, compliance reports without on-prem log server
- **Firmware management** -- Schedule updates, rollback
- **Zero-touch deployment** -- Pre-register serial, pre-build config in Central, ship to site, auto-provisions on power-up

## ZTNA Gateway

- ZTNA Gateway replaces traditional VPN with identity and device-aware access
- Combined ZTNA + Intercept X agent (no separate VPN client)
- Access decisions based on: user identity (SAML/OIDC), device health (heartbeat), application policy
- Micro-segmentation: users access only authorized applications, not network segments
- Red heartbeat automatically revokes ZTNA access mid-session
- Managed entirely from Sophos Central

## SD-WAN

- **Performance-based routing** -- Dynamic WAN link switching based on measured latency, jitter, packet loss
- **Policy-based routing** -- Route specific apps/user groups over preferred WAN links
- **WAN link load balancing** -- Active/active across multiple ISPs
- **Traffic shaping and QoS** -- Per-application, per-user bandwidth allocation
- **SD-WAN orchestration** -- Configure from Sophos Central

## v22 Specific Features

### Containerized Services
- IPS, DPI, and other services run as isolated containers on the firewall platform
- Independent update, restart, and scaling without OS reboot
- Reduced attack surface: compromise of one service does not cascade

### CIS Health Check
- Evaluates configuration against CIS benchmarks and Sophos best practices
- Risk categories: Critical, High, Medium, Low
- Actionable remediation recommendations
- Exportable report for compliance/audit

### Hardened Kernel
- Linux kernel 6.6+ (LTS)
- KASLR, stack canaries, hardened usercopy, tighter process isolation
- Mitigations for Spectre, Meltdown, L1TF, MDS, Retbleed, ZenBleed, Downfall

### XDR Linux Sensor
- Embedded sensor for remote integrity monitoring
- Detects unauthorized config changes, malicious execution attempts, file tampering
- Integrates with Sophos Central XDR

## XGS Hardware

| Model Range | Target | Throughput (FW) | Key Interfaces |
|---|---|---|---|
| XGS 87-136 | SOHO/Branch | 3-7 Gbps | 4-8x GbE copper |
| XGS 2100-2300 | SMB | 15-20 Gbps | 8x GbE, 2x SFP+ |
| XGS 3100-3300 | Mid-market | 30-50 Gbps | 8x GbE, 4x SFP+, expansion |
| XGS 4300-4500 | Enterprise | 80-100 Gbps | 4x SFP+, 2x QSFP+, modular |
| XGS 5500-6500 | DC/Carrier | 170-320 Gbps | 8x QSFP+, 2x QSFP28 |

All models have dedicated Xstream Flow Processors for TLS inspection at line rate.

## API

### Local API
- Base URL: `https://<firewall-ip>:4444/webconsole/APIController`
- XML-based authentication with session token
- Methods: GET (query), SET (modify), ADD (create), REMOVE (delete)
- Covers nearly all configuration objects

### Sophos Central API
- REST API for central management operations
- JSON request/response format
- SIEM integration and reporting

## Diagnostic Commands

```bash
# System status
show system diagnostics

# Firewall rule matching test
show firewall rule matching src=10.1.1.10 dst=8.8.8.8 port=443

# Active connections
show connection detail

# IPS status
show ips status

# Routing / SD-WAN
show routing detail

# Restart containerized service (v22+)
system service restart ips

# TLS inspection stats
show tls-inspection stats

# Synchronized Security status
show synchronized-security status
```

## Common Pitfalls

1. **Not enabling TLS inspection** -- Sophos Firewall without TLS inspection cannot inspect encrypted traffic. IPS, AV, web filtering are blind to HTTPS content.

2. **Ignoring Synchronized Security** -- The heartbeat integration is Sophos's key differentiator. Deploy Sophos Endpoint alongside Sophos Firewall for full value.

3. **WAF vs network rules confusion** -- WAF rules protect published web applications (reverse proxy). Network rules handle general traffic. Different rule types for different use cases.

4. **FastPath not engaging** -- If Xstream shows high DPI load but low FastPath, check that inspection profiles are configured to allow flow graduation.

5. **Zero-touch deployment without pre-staging** -- The appliance must be pre-registered in Sophos Central before shipping. Serial number registration is required.

6. **v22 service restart impact** -- Containerized services can restart independently, but an IPS restart briefly interrupts inline inspection. Schedule during maintenance windows.

7. **CIS health check findings ignored** -- Critical findings represent real risk. Prioritize remediation starting with Critical/High severity.

## Reference Files

Load these when you need deep knowledge:

- `references/architecture.md` -- XGS hardware, Xstream architecture, Synchronized Security, Sophos Central, ZTNA, SD-WAN. Read for "how does X work" questions.