Sophos Firewall Security Configuration Guide

This comprehensive guide will help you securely configure your Sophos firewall following industry best practices and Sophos recommendations.

1. Initial Setup and Access Control

Change Default Admin Credentials

Change default administrative credentials immediately:

  1. Navigate to Administration → Admin Settings
  2. Change the default admin password
  3. Create additional admin accounts with unique usernames
  4. Disable the default admin account after creating alternatives
Warning: Default credentials are publicly known and represent a critical security vulnerability.

Enable HTTPS Administration

Ensure web administration uses HTTPS only:

  1. Go to Administration → Admin Settings → Admin Console
  2. Disable HTTP access
  3. Enable HTTPS only
  4. Upload or generate a valid SSL certificate
  5. Configure strong TLS settings

Restrict Admin Access

Limit administrative access to trusted networks:

  1. Navigate to Administration → Admin Settings → Admin and User Settings
  2. Configure allowed networks for admin access
  3. Disable admin access from WAN
  4. Consider using a dedicated management VLAN
  5. Enable two-factor authentication for admin accounts

2. Firewall Rule Configuration

Default Deny Policy

Implement a default deny policy:

Firewall Rule Best Practices

Configure rules following these guidelines:

Tip: Navigate to Rules and Policies → Firewall Rules to manage your firewall rules.

Application Control

Leverage Sophos Application Control:

  1. Go to Rules and Policies → Application Control
  2. Create application filter policies
  3. Block high-risk applications
  4. Control bandwidth for specific applications
  5. Monitor application usage via reports

3. Intrusion Prevention System (IPS)

Enable IPS

Configure IPS for threat protection:

  1. Navigate to Protect → Intrusion Prevention
  2. Enable IPS
  3. Select appropriate IPS policy (Server Protection, Desktop/Laptop)
  4. Enable automatic signature updates
  5. Configure firewall rules to use IPS policies

IPS Policy Configuration

Customize IPS policies for your environment:

4. Web and Email Protection

Web Protection

Configure web filtering and protection:

  1. Navigate to Protect → Web → Policies
  2. Create web filter policies
  3. Block malicious and high-risk categories
  4. Enable HTTPS scanning (with proper certificates)
  5. Configure content control policies
  6. Enable Google, YouTube, and Bing SafeSearch

Advanced Threat Protection (ATP)

Enable ATP/Sandstorm for zero-day protection:

  1. Go to Protect → Sandstorm
  2. Enable Sandstorm analysis
  3. Configure file types for scanning
  4. Set up notification policies
  5. Review sandstorm reports regularly

Email Protection

If using Sophos email protection:

5. VPN Configuration

SSL VPN Security

Secure SSL VPN configuration:

  1. Navigate to Configure → VPN → SSL VPN
  2. Use strong encryption (AES-256)
  3. Enable two-factor authentication
  4. Configure client traffic restrictions
  5. Limit concurrent connections
  6. Enable session timeout
  7. Regular review of VPN access logs

IPsec VPN Security

For site-to-site IPsec VPN:

6. Network Protection

VLAN Configuration

Implement network segmentation:

DNS Security

Configure secure DNS settings:

  1. Go to Configure → Network → DNS
  2. Use trusted DNS servers
  3. Enable DNS security features
  4. Configure DNS over TLS if available
  5. Enable DNS request logging for analysis

DHCP Security

Secure DHCP configuration:

7. Authentication and User Management

Configure Directory Services

Integrate with Active Directory or LDAP:

  1. Navigate to Authentication → Services
  2. Configure AD or LDAP server connection
  3. Use secure LDAP (LDAPS) when possible
  4. Configure user group mappings
  5. Test authentication thoroughly

Multi-Factor Authentication

Enable MFA for enhanced security:

8. Logging and Monitoring

Configure Log Settings

Enable comprehensive logging:

  1. Navigate to Configure → System Services → Log Settings
  2. Enable logging for all critical components
  3. Configure log severity levels
  4. Set up remote syslog server
  5. Enable log forwarding to SIEM if available

Generate and Review Reports

Regular reporting is essential:

Configure Notifications

Set up alerting for critical events:

  1. Navigate to Configure → System Services → Notification List
  2. Add notification recipients
  3. Configure email notifications
  4. Set alert thresholds appropriately
  5. Test notification delivery

9. System Maintenance

Regular Updates

Keep firmware and signatures updated:

Backup Configuration

Regular backups are critical:

  1. Navigate to Backup & Firmware → Backup & Restore
  2. Create manual backups regularly
  3. Configure automatic backup schedule
  4. Store backups securely offline
  5. Encrypt backup files
  6. Test restore procedures periodically

High Availability

For critical environments, configure HA:

10. Security Checklist

Essential Security Checklist:

11. Additional Resources

Remember: Security is an ongoing process. Regularly review and update your configuration based on new threats and best practices.

← Back to Home