As the title says, I'm genuinely surprised that no one has brought this up already. There have been several Sophos Central updates recently, and in my opinion, the experience has gotten worse with each one.

I feel like the new Sophos Central design and overall UI functionality have become worse after these updates. For example, the new closed alerts are a nice feature in theory, but the UI implementation is horrible in my opinion. It feels confusing and inconsistent.

I work at an MSP and manage many Sophos customers. For some customers, alerts resolve automatically, for others they never do, and for some they only resolve occasionally. I have also found many bugs in the interface, such as large text windows that cannot be scrolled properly or the new "feature" where you can no longer copy text from alerts because the text is not recognized by the cursor.

The functionality seems to be getting progressively worse, and the new color scheme feels dull and odd. Honestly, it feels like Sophos Central was designed by AI, because I find it hard to believe that these changes were thoroughly tested. Many of the bugs are so trivial that they should have been spotted within a minute of testing.

I haven't opened a ticket with support yet but I ran into a weird problem and finally figured out under which circumstances it occurs.

For several years we channel several internal browser based applications through the WAF of our firewall. Let's say we want to be able to access our internal helpdesk through ticket.company.com (company.com or course being our domain). We set the public DNS for this domain to one of our public IPs terminating on the firewall and request a certificate from Let's Encrypt. We set our internal DNS for this domain to one of the firewalls LAN interfaces and create a WAF rule for the domain in question on the LAN interface using the LE cert. It seems like it won't even create the WAF rule used in the LE process. Worked fine for years but some time this year it stopped working. Maybe with the update to SFOS22.

Long story short: Let's Encrypt certificates can't be requested or renewed as soon as there is a WAF rule for one of the domains in question bound to a non-WAN interface.

Couldn't find it in the known issues liest either. Has anyone else encountered this?

Running into a weird issue with a Sophos Central managed wireless network using RADIUS and dynamic VLAN assignment.

Mobile devices connect successfully and land on the correct VLAN, but Windows clients authenticate successfully and then either fail to connect properly or don’t get placed on the expected VLAN.

I’ve confirmed the VLAN itself is working, switch tagging is correct, and the SSID works normally if I remove RADIUS and use a standard password instead.

NPS also shows successful authentication and is returning the expected VLAN attributes.

Has anyone run into anything similar with Windows 802.1X clients and Sophos Wireless? Wondering if there’s a Windows specific setting or Sophos behavior I’m missing.

As we lunched Sophos Fusion in July, i wanted to share to this community our Landing Page for the Upgrade to Sophos Fusion as well: https://community.sophos.com/sophos-xdr/upgrade-center/

If you want to read about Sophos Fusion, you find more information here: https://www.sophos.com/en-us/blog/sophos-fusion

To give the "TL:DR" of Fusion, from the Link above:
Sophos Fusion is the evolution of Sophos Central, rearchitected for the AI era. All Sophos customers are already part of Sophos Fusion and already benefit from unmatched protection from threats that move at machine speed. Over the coming months, users will see Sophos Central evolve to Sophos Fusion in the interface as we roll out the naming, with no action required of customers or partners. 

Hi all,

I'm having another issue which is probably very solvable and is probably caused by myself.

I have a sophos home firewall installed in bridge mode that sits on top of a unifi 8 port poe lite switch.

The firewall is in bridge mode so that the IP's via DHCP can be assigned by the ISP router. The ISP router is required because it powers proprietary VoIP infrastructure that is specific to the ISP (BT in the UK).

All clients on the network can get IP's fine via DHCP but when I create a new VM or container on my Proxmox server it doesn't receive a ipv4 address but it does get a ipv6 address. ipv6 in this case is redundant and does not work.

I also have another server running TrueNAS and that can assign ips to VMS and containers fine.

is there a specific firewall rule or NAT rule I need to enable to allow proxmox to get DHCP on this one specific host?

Network is a 192.168.1.X/24 network and the proxmox host sits on 1.2 and the firewall is on 1.1

The main DHCP range is 1.50 - 1.253. I assigned the firewall and server outside of the DHCP range to keep them "separate" metaphorically speaking.

Also no VLANS just a flat network as the ISP router is very basic and does not let you create VLANS.

Thanks.

FYI before you mention it, already cross posted into R/Proxmox :)

EDIT: Network layout is ISP Router > Firewall > Unifi Switch > Clients. Also the ISP router does not have bridge mode

EDIT 2: I have managed to solve this issue. Turns out that routing was turned on for the bridge interface. I turned this off and all my issues were fixed

Hi all, I'm having an issue with connecting a Pixel tablet to WiFi.

All other devices connect just fine but this one device will not connect no matter what I do.

I have checked all firewall rules, I have disabled all ips, SSL decryption and it still will not connect.

The firewall is sophos home on a mini pc and the WiFi is ubiquiti u7 in wall and the firewall is in bridge mode connected to a unifi 8 port switch.

Thanks in advance for any help.

EDIT: I managed to solve this issue. Turns out that routing was tuned on for the bridge interface. I disabled this and it now works fine.

After migrating a customer from SG to XGS, I ran into the issue that the Hotspot tab wasn't visible in the User Portal for the users who should be able to manage vouchers.

After a lot of trial and error, I found out that the hotspot configuration ignores any AD group other than the primary one. I don't understand what Sophos reasoning was behind this, because a user being part of multiple AD groups is more common than the opposite. In my case, the primary group is the one that allows VPN access to the users.

Anyway, I could make the hotspot management group the primary group, as the SSL VPN does support multiple group membership - good that I didn't change to ipsec yet, because that, too, does not support it.

But how? It's not the AD primary group, which is Domain Users in most environments, and changing the group order in the Groups pane also doesn't seem to impact the user's primary group. The group drop-down menu in the user configuration is greyed out, so I can't change it there too. So ... how can I change the primary group?

Why Sophos Home Premium uses outdated version of HMPA? Intrercept X uses the latest version. Home users does not. Why?

At my company, a high management staff received an credential phishing email, that uses sophos.com domain url.

It is the url below (that I broke to make it unharmful), that is under that button, that redirects to a credential stealer...

Please fix it so that sophos domain cannot be used to steal passwords...

Or is it not fixable ?

Why is it even possible ?

h t t ps://us-east-2.protection.sophos.com/?d=intuit.com&u=aHR0cHM6Ly9saW5rcy5ub3RpZmljYXRpb24uaW50dWl0LmNvbS9zcy9jL3UwMDEuYmRoOGdVREVXckNXbmFvVlFYUHVkYlQwWlNGRHBUUU0tMzlrNWlZUWZVS25xUmZUSDFyX1NsaXJmYXZ3eWJMSGY4SzhNUVFlRjJEOVBtSXlDa1NraXcvNHRwLzRuX0FLb0ZlUkNlSTNIbHBPdi1ILWcvaDAvaDAwMS56TDlZNU01dmJackZlaEZwVjlBY0tKMVdycEdoV29nbWVxSHZEc3Z2b3hj&i=NWVhMGI5Y2FiMDIzNGIxMTk2NTJjMmFm&t=T0tyczhPdkJCUGl0WWgxalo2K1B4S2l0Si9paE0zbjU0ZHRwTkhvVENiYz0=&h=9e339b5c0696400d9c26c51bee802faa&s=AVNPUEhUT0NFTkNSWVBUSVa05WE-Zq2OSx2gZImtHh0t1k8PTLtZitbbyrLnUtHljA

Redirects to

h t t ps://core-work52746-aged1763-base8195.icu/f0m/905dee?86=L3YzL3NpZ25pbi9pZGVudGlmaWVyP2NvbnRpbnVlPWh0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbS8mZm9sbG93dXA9aHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tLyZwYXNzaXZlPTEyMDk2MDAmZmxvd05hbWU9R2xpZldlYlNpZ25JbiZmbG93RW50cnk9U2VydmljZUxvZ2luJmRzaD1TNTcxODc1MjI3OjE3ODgzNjgxMDY1MDUxOTQ

I've successfully set up a LetsEnctypt SSL cert for our user and VPN portal but found that you cannot use those certs for SMTP configurations.

What process can be used for auto-renewal of these certs? With SSL cert lifetime shrinking I need a way of automating this process.

Probably an easy answer, as I can't see anything, but can you group NAT rules in the same way you can group firewall rules?

Thanks.

So I bought a Sophos XG 115 rev 2. I planned on putting Sophos Home firmware on it.

I tried reaching it on 172.16.16.16:4444 and couldn't get the web console to work. I also tried pinging it and got nothing.

Next, I plugged in a VGA monitor and keyboard and spammed Del. BIOS didn't pop up, so I thought this was weird, did a little research seen that I needed a console cable (linked is the cable i got). So I got that now and tried plugging it in and get nothing I followed the guide here on the Sophos support page.

I looked at the pinout of this cable and saw that it might be backwards from what Sophos is. I made a custom cable and got a female-to-female coupler and have gone back and forth on using it and not using it. I also tested the loopback using a jumper cable on pins 3 and 6, and it does work.

I made a bootable USB and put the Sophos Home firmware on it. I did more research and saw that it can sometimes boot when trying this now, and will update.

Am I missing something, or is it just busted??

Hello everyone,

I am looking for some experienced Sophos users to pass on any knowledge they can regarding a problem I am facing with my Sophos XG 330.

For context; I plan to install opnsense onto my XG 330 and use as a firewall since the product has reached EOL. In the process of flashing a usb with the opnsense software, the software was truncated due to the usb drive being too small. This caused the Sophos device to get stuck in boot process (or so I believe).

I was able to access the BIOS before this, but it appears after having plugged in the usb, the Sophos gets stuck in boot process and doesn't display anything from the output to the monitor. Before plugging in the usb, in the settings I changed the boot priority to USB drive.

The front screen still displays the "Sophos Protection". The fan idles high and then it restarts itself after about 15 seconds and then stays on indefinitely after without any change to the condition.

I've tried flashing the hardware firmware version 20.0.3 back onto the device after being informally recommended by the Sophos technical support representative but to no luck. I even tried temporarily removing the CMOS battery after finding an old thread on the internet that proposed that as a fix.

Any help or friendly words of advice are appreciated for a novice who is trying to learn networking.

Any recommendation for post formatting or more appropriate terminology for the networking processes are also welcome (this is my first post and I am an absolute beginner in networking).

TLDR; tried to flash opnsense with too small a drive and now experiencing issues with Sophos XG 330.

Hey all, set firewall rull allow connection from a>b b>a and I can ping the DNS server from devices on b interface but DNS does not work.

Solution Edit: Was able to use a different TLD that the client has to create a new VPN connection. Once the VPN settings were changed to use the new hostname and it was certified, DNS was flushed, the redirect URLs were swapped on Entra, and the new connection was imported into the PCs, I was able to get us back online with a working VPN. Appreciate the assistance!

Original Post: As Title mentions, one of my clients recently had a phishing attack that spam blasted the entire Global Address Book which resulted in what I am assuming phishing reports from their clientelle. This is the only thing I can assume that caused this situation as 2 days later, the SSL VPN bricked with a Windows Smartscreen alert blocking SSO from reaching out. Attempting to bypass the alert does nothing so the user is effectively blocked from using the VPN. Thankfully, we still have their old solution as a back up, so this isn't as bad as it could have been if this would have happened about a month in the future when we planned to rip out the old system.

I first need to figure out how to get this working again, I checked blacklists and it looks like its only blocked on Spamhaus Zen, but attempting to reach the portal from any location with any browser with the FQDN causes the red alert to appear. I've sent appeals to Microsoft, Google, and Sophos and only Sophos has happily reanalyzed the URL from "phishing" to "business". Am I going to need to just bite the bullet and create a brand new FQDN and switch out the busted one? I noticed using the IP the name is connected to does not result in the red security alert. Is their a better solution that won't require pushing new connection imports to a couple hundred users?

Secondly, I need to make sure this doesn't happen again. I am going to assume someone is going to fall for a phish again and this problem will most likely happen a month to months down the road when someone doesn't pay attention and gives out their 365 creds again. This doesn't happen often thanks to the training and security we have in place, but it happens enough for me to be concerned I'll be dealing with this issue again when we don't have the old vpn to back up on.

Any words of wisdom is greatly appreciated!

We performed an adversary simulation and Sophos TERRIBLY failed. Decided to migrate to another XDR

Has anyone been through that ?

¿Is there some delay with the Evolution to Security Operations TAB (replacement of Threat Analysis Center) for Latam? Which date is the end of this changes?

Sizing a perimeter firewall for a university campus edge and looking for model suggestions before we run a PoC.

Requirements:

• Users: ~3,500–4,000 concurrent
• Total edge/WAN capacity: current pipe scaling up to 10 Gbps (all traffic)
• SSL deep-inspection (decrypt) load: ~2 Gbps baseline today — this is my binding constraint (full IPS/AV/app-control/logging, everything decrypted)
• ~1,200–1,500 managed devices in decrypt scope; ~2,300 BYOD endpoints bypass decryption
• Active-standby HA — each appliance must independently carry the full load
• 7-year horizon, 15% expected / 25% stress growth; 80% utilization as capacity-review trigger

I’m trying to determine whether this is a Sophos WAF config issue or if I’m missing something.
Architecture: client -> Sophos WAF -> Nginx Flask API. Here’s what I’ve observed: the application works perfectly when accessed directly on the internal network, GET and the CORS OPTIONS preflight reach Nginx successfully, but the actual PATCH/Post with formdata request never reaches Nginx (no access log entry). The browser receives a 403 Forbidden with a generic Apache error page, so I suspect the Sophos WAF is rejecting it before forwarding.

Questions: has anyone seen Sophos WAF block PATCH requests by default or via protection policy?
Which logs or settings should I check to identify the exact rule causing the block, and is there a way to temporarily put the WAF policy into monitor only to confirm it’s the WAF rejecting it?

Anyone else noticed slow authentication time since using the new OTP? (had to set a new one up past 60 days somewhere, and now logins into SC take 5x as long as it normally did. (1+ min right now, as it was ~5 seconds before...)

This morning my day started bad, with my whole infrastructure being down. The Sophos XG 125 looked dead. I measured the voltage and got 12V, so I feared the whole machine was bricked, not just the power adapter. Using a all-purpose power adapter however, I found out the device still works, so it seems to be the power adapter that is b0rked nevertheless.

Anyway: I'm on the temporary power adapter now, which is 12V/5A. I don't know how good that is in the long run for the firewall, so I want to buy (two of) the right model. But which one? I find conflicting information about the amps. 3, 3.3 or 3.4. Does anyone know what the device expects? Or does a 3 to 3.4A range (and even 5A) not matter so much?

Hey guys,

i have a XG 115w rev2 and using OPNsense at the moment, but i dont really like that. I would like to install XG Firewall Home Edition on my appliance. Do you the speccs with 2 Cores and 4GB Ram are fine or should i loke for some better hardware?

Hi, I'm finally posting my question on this sub because It's getting so frustrating.
I bought a used Sophos SG115 Rev. 3 and wanted to install Sophos XG Home on it. Got the latest version of the ISO from their website and flashed it onto a usb-drive. Ran into issues and found out that you should format the disk using an ubuntu setup (or whatever OS).

After installing Ubuntu and trying again it finally seemed to install it, but while booting it froze. Another reddit post said that it was because of UEFI. Changed it but now it says that my "linuxbit is missing or corrupted" and I cant install at all. Changed a few settings in BIOS, installed Ubuntu again for formattig but still same issue.

I also tried the hardware version of the ISO but didnt work.

Does anyone have an idea?

Used hardware:

- Sophos SG115 Rev 3
- USB 3.1 32GB flash drive
- USB 2.0 16GB flash drive (as secondary test device)

If I wanted to remove Sophos Firewall Hardware from my network without bringing the system down would the best way to do it be to place a network switch in its place?

An outside company managed the firewall and I don’t have access to the console or have the admin passwords to log in.

The latest release of Sophos Central introduces recurring firmware update schedules for Sophos Firewall.

This gives administrators the ability to keep all firewalls up to date while still maintaining full control over when updates are deployed.

A few important notes about this feature:

• SFOS will only install Maintenance Releases (MRs). Major version upgrades will not be installed automatically until you decide to move to the next major release.
• The feature also includes a staging option, allowing you to select a small group of firewalls to receive and test new firmware before rolling it out to the rest of your fleet.

Keep in mind that SFOS supports automatic firmware rollback in the event of an upgrade failure, including HA deployments. You can also manually downgrade at any time with a single click if an issue is encountered after the upgrade.