Sophos Firewall

No entries match these filters. Clear filters

1. changelog Oct 23, 2026 · issue 118

   Sophos Firewall v22.0 adds a CLI command to disable strict IPsec SAIPsec SAA one-way agreement between two endpoints that records the encryption algorithm, keys, and parameters used to protect a single IPsec traffic flow, giving cyber tools a concrete handle for inspecting or managing tunnel state. policy checks for third-party VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. peers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2. Version 22.0 MR3Build 576Released on October 16, 2026 Oct 16, 2026 · issue 111

   Sophos Firewall 22.0 MR3 adds a CLI command to disable strict IPsec SAIPsec SAA one-way agreement between two endpoints that records the encryption algorithm, keys, and parameters used to protect a single IPsec traffic flow, giving cyber tools a concrete handle for inspecting or managing tunnel state. policy checks for third-party VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. peers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ BREAKING ON UPGRADE

   • !Upgrading to 23.0 EAP1 from version 22.0 MR3 Build 576 is not supported.
   • !SFOS 22.0 GA and later versions no longer support XG and SG Series hardware appliances.
3. Version 22.0 MR2Build 546Released on July 14, 2026 Jul 14, 2026 · release notes

   Sophos Firewall 22.0 MR2 adds post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. detection/control, Manifest V3 Chromebook SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., and Config Studio 2.6 with dark mode and multi-file diff.

   └──▷ HOW TO FIND IT
   Block or log ML-KEMML-KEMNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake.-based post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. key exchanges on a segment where only classical cryptography is approved, by creating a custom IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. rule targeting the new PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. patterns.
   📍In the Sophos Firewall admin console, go to Protect › Intrusion Prevention › IPS Policies, locate the new PQC IPS patterns (default action: Disabled), create a custom IPS rule, and set the action to Drop or Reset for ML-KEM key exchange algorithms.
   • Adds IPS detection and blocking of pure and hybrid post-quantum cryptography (PQC) key exchange algorithms based on ML-KEM, with new IPS patterns defaulting to Disabled to prevent unintended disruptions; custom IPS rules can set actions to Allow, Drop, or Reset.
   • Adds Web Protection enforcement that prevents web sessions from negotiating unsupported PQC algorithms, enabling cryptographic policy control over post-quantum traffic.
   • Adds a new Chromebook User ID extension supporting Manifest V3, the latest Chrome extension platform; users must uninstall the previous extension and install the new one.
   • Adds support for new Let's Encrypt root and intermediate certificates YE Root, YE1, YE2, YR Root, YR1, and YR2 to ensure compatibility with the latest Let's Encrypt certificate chains.
   • Enhances Let's Encrypt email notifications to include the firewall hostname and serial number for easier firewall identification.

   +3 more show less

   • Improves Generative AI application categorization via Synchronized Application Control, with Sophos Endpoint sharing more accurate GenAI app identities for better visibility and policy control.
   • Changes the default STAS setting for Restrict client traffic during identity probe to No, allowing client traffic to continue during user-identity checks.
   • Config Studio 2.6 adds support for merging Sophos Firewall and industry-specific configuration templates, multi-file diff support, one-click Global search navigation, object reference details for firewall/NAT/TLS rules in configuration reports, and dark mode.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !SFOS 22.0 GA and later versions no longer support XG and SG Series hardware appliances.
   • !The default value of Restrict client traffic during identity probe in STAS authentication has changed to No, which may alter traffic behaviour for deployments that relied on the previous default of restricting traffic during identity probes.
4. Version 22.0 MR1Build 490Released on April 20, 2026 Apr 20, 2026 · release notes

   Sophos Firewall 22.0 MR1 adds NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Active Threat Intelligence, XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Linux sensor integration, Config Studio V2, and macOS SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. via Sophos Connect 2.0.

   └──▷ HOW TO FIND IT
   When you need to compare a pre-change and post-change firewall configuration to identify exactly what was added, removed, or modified during a maintenance window.
   📍Open Sophos Firewall Config Studio V2 in your browser, upload two configuration exports, and select Compare configurations to see added, removed, modified, and unchanged items side by side.
   • Integrates Taegis NDR (iSensor) with high-signal detection patterns curated by Sophos Labs to identify potentially malicious traffic and active adversaries, logging events to the Data Lake for XDR, MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools., and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysis.
   • Expands NDR Essentials support to all Sophos Firewall platforms: XGS Series, virtual firewalls, software firewalls, and cloud deployments.
   • Integrates with the Sophos XDR Linux sensor for real-time security monitoring, detecting unauthorized configuration changes, rule exports, malicious program execution attempts, and file tampering across all Sophos Firewall devices including XGS desktop and virtual appliances.
   • Blocks TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. connections resulting from interactive and reverse shell access, enabling early detection of command-and-control activity and covert shell access.
   • Logs the Sophos Central user identity in audit logs for configuration changes made through Sophos Central, supporting NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against. and similar compliance requirements — visible in the Sophos Firewall log viewer and Sophos Central logs and reports.

   +3 more show less

   • Enables remote access SSL VPN connections on macOS devices using Sophos Connect 2.0.
   • Supports updating the MTU and MSS values of Wi-Fi interfaces using existing CLI commands.
   • Introduces Sophos Firewall Config Studio V2, a browser-based tool for viewing, comparing, and editing firewall configurations — with a unified configuration report, side-by-side comparison showing added/removed/modified/unchanged items, and a configuration editor that exports in API or curl formats.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The legacy remote access IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. VPN has been retired; firewalls containing this legacy configuration cannot be upgraded to SFOS 22.0 MR1 and later.
   • !SFOS 22.0 GA and later versions do not support XG and SG Series hardware appliances.
5. Version 21.5 MR2Build 323Released on February 18, 2026 Feb 18, 2026 · release notes

   Sophos Firewall 21.5 MR2 strengthens Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with session re-evaluation to block MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. bypass.

   • Enhances Microsoft Entra ID SSO session management to re-evaluate Conditional AccessConditional AccessA policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. policies on session reuse, preventing MFA bypass.

   1 detail in Everything

6. Version 22.0 GABuild 411Released on January 20, 2026 Jan 20, 2026 · release notes

   Sophos Firewall 22.0 adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline.-benchmarked health checks, a new hardened control plane, XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss./Taegis integration, and TLS 1.3 admin access.

   └──▷ HOW TO FIND IT
   Review your firewall's CIS benchmark compliance and security posture immediately after upgrading to 22.0.
   📍In the web admin console, go to Control Center and review the Firewall health check panel, then select Firewall health check in the main menu to drill down into high-risk configurations and actionable recommendations.
   Enable proactive web browsing alerts for schools or regulated environments to catch policy violations in real time.
   📍In the web admin console, go to Web › Categories, locate the category or keyword rules you want to monitor, and turn on instant alerts to receive real-time email notifications including date, time, user, category, and domain.
   Select an NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Essentials data center region to satisfy data residency requirements instead of using the default lowest-latency region.
   📍In the web admin console, navigate to the NDR Essentials settings and select your required data center region for flow analysis under the data center selection option.
   • Adds device_name field to syslog output identifying the hostname of the firewall that produced each log, enabling differentiation across multiple firewalls in XDR and Taegis environments.
   • Enables instant alerts for web categories and keywords when turned on in Web > Categories, delivering real-time email notifications with date, time, user, category, and domain details.
   • Adds data center region selection for NDR Essentials flow analysis to meet data residency requirements, defaulting to the lowest-latency region.
   • Adds threat score to Active Threat Response logs for NDR Essentials, enhancing visibility and analytics.
   • Adds a new Firewall Health Check feature that evaluates dozens of configurations against CIS benchmarks, accessible via a new panel on the Control Center page and the Firewall health check main menu item.

   +14 more show less

   • Integrates Sophos XDR Sensor for Linux for continuous real-time system integrity monitoring, detecting unauthorized configurations, rule exports, malicious program execution attempts, and file tampering.
   • Introduces an all-new Xstream control plane enabling modularization, isolation, and containerization of services (such as IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection.) with complete privilege separation and self-healing capability.
   • Builds the next-generation Xstream architecture on a hardened Linux kernel v6.6+ with tighter process isolation, KASLR, stack canaries, hardened usercopy, and mitigations for Spectre, Meltdown, L1TF, MDS, Retbleed, ZenBleed, and Downfall.
   • Integrates Taegis XDR and MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. with Active Threat Response, allowing malicious IPs, domains, and URLs to be pushed from the Taegis portal to block threats across all firewall subsystems with no manual configuration.
   • Integrates the latest Sophos anti-malware engine with AI/ML model detections, zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. protection, global reputation lookups, and SophosLabs cloud database updates every five minutes or less.
   • Adds TLS 1.3 support for the web admin console, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. portal, and user portal.
   • Adds public key authentication for SSH admin access, limited to the default admin for adding and deleting keys.
   • Adds granular logging controls for inbound and outbound traffic to reduce noise from repetitive events such as brute-force attacks.
   • Adds inbound forwarded traffic matching (WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. and DNAT) against MDR threat feeds, NDR Essentials, and third-party threat feeds, plus outgoing source matching for NDR Essentials and third-party threat feeds.
   • Includes a major upgrade to Samba components for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., adding improved support for Windows Server 2025 and removing older encryption protocols.
   • Adds pagination, search, and filter options for XFRM interfaces in the web admin console.
   • Creates individual incoming and outgoing firewall rules with zone-based traffic control for site-to-site IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. VPN connections instead of a single combined rule.
   • Enables navigation to any menu item or tab in the web admin console without waiting for the current page to load.
   • Optimizes DPDK memory in the DAQ layer for XGS 87/87w, 107/107w, and 116/116w desktop firewalls, eliminating out-of-memoryout-of-memoryAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. instances.

   19 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !SFOS 22.0 GA and later versions do not support XG and SG Series hardware appliances.
   • !Active Directory SSO Samba upgrade removes support for older encryption protocols, which may break AD authentication for environments relying on them.
   • !Existing allowed IP addresses for XML API access are automatically converted to IP host objects prefixed with apiconfig on upgrade.
7. Version 21.5 MR1Build 261Released on October 08, 2025 Oct 8, 2025 · release notes

   Sophos Firewall 21.5 MR1 adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. email auth, NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. data-center selection, Windows Server 2025 AD SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., and HA passphrase/SSH-key hardening.

   └──▷ HOW TO FIND IT
   Migrate email notifications from password-based auth to OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 to stay ahead of Gmail dropping password authentication.
   📍In the Sophos Firewall admin console, go to Administration › Notification settings, locate the email server configuration, and set the authentication method to OAuth 2.0, then complete the OAuth authorization flow for your Gmail account.
   Select a specific NDR data-center region to satisfy data residency requirements rather than using the default lowest-latency selection.
   📍In the Sophos Firewall admin console, go to the NDR Essentials settings page and under Data center, choose the required regional location instead of the default automatic selection.
   • Adds OAuth 2.0 as an authentication method for firewall email notifications, with migration recommended for Gmail accounts.
   • Adds NDR Essentials data-center location selection to meet regional and data residency requirements, defaulting to lowest-latency location.
   • Adds threat score visibility in Active threat response logs for NDR Essentials, improving reporting and analytics.
   • Adds Windows Server 2025 support for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. SSO (NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application.) authentication.
   • Adds device_name field to syslog output, capturing the hostname of the firewall that produced the logs to differentiate data sources across multiple firewalls.

   +11 more show less

   • Adds HA passphrase complexity requirements — passphrases are no longer auto-generated, requiring administrators to set strong passphrases.
   • Adds unique SSH host key verification for high availability configurations to prevent man-in-the-middle attacks.
   • Adds node name and current role information to the ha.log high availability log for improved troubleshooting.
   • Adds automatic XFRM MTU assignment on route-based VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnels, subtracting maximum IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. overhead from the physical interface MTU to prevent packet fragmentation.
   • Adds firewall hostname, firmware version, serial number, and model to backup email subject lines for easier multi-firewall management.
   • Adds Created date column to the hotspot vouchers page in the user portal, with sortable voucher listing.
   • Adds RFC compliance for SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. MIB files, supporting SNMPv1 (RFC 1157), SNMPv2 (RFCs 1901, 1905, 1906), and SNMPv3 (RFCs 3411–3418).
   • Adds resizable columns to network menu pages, SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. routes and profiles, gateways, and local service ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. exception rules, persisted in browser memory.
   • Enables localization for scheduled PDF reports, automatically generated in the administrator's sign-in language.
   • Disables L2TP and PPTP by default when importing groups from Active Directory and Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. authentication servers.
   • Optimizes DPDK memory in the DAQ layer for XGS 87, 87w, 107, 107w, 116, and 116w desktop firewalls, eliminating out-of-memoryout-of-memoryAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. instances.

   16 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !RED system host objects are now assigned a /32 subnet mask instead of the subnet mask configured at interface creation time; firewall rules or configurations that relied on the RED system host matching a non-/32 subnet will no longer match traffic and must be updated to use the correct IP host or network host.
   • !LINCE mode must be enabled on both HA devices before configuring HA, and a restored HA backup requires the receiving devices to match the backup's LINCE status.
   • !L2TP and PPTP are no longer turned on by default when importing groups from Active Directory and Microsoft Entra ID; groups or VPN configurations that previously relied on this default must explicitly enable L2TP or PPTP.
8. Version 21.5 GABuild 171Released on June 02, 2025 Jun 2, 2025 · release notes

   Sophos Firewall 21.5 adds NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Essentials ML threat detection, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., NAT64, and doubles route-based IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. tunnel capacity.

   └──▷ HOW TO FIND IT
   Configure Microsoft Entra ID SSO for remote access VPN so users authenticate to IPsec or SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. VPN using their cloud AD credentials via Sophos Connect 2.4.
   📍In the Sophos Firewall web admin console, go to Authentication › Servers, add a Microsoft Entra ID (Azure AD) server, configure your OAuth 2.0 / OpenID Connect tenant details, then assign it to your SSL VPN or IPsec remote access VPN policy and instruct users to upgrade Sophos Connect to v2.4 or later.
   • Integrates Sophos NDR Essentials under Active Threat Response, using cloud-hosted ML engines including Encrypted Payload Analysis (no TLS decryption required) and a Domain Generation Algorithm engine to detect active adversaries — available in the Xstream Protection bundle for XGS Series firewalls.
   • Extends Microsoft Entra ID (Azure AD) SSO via OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. and OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. to the Sophos Connect client (v2.4+, Windows) and VPN portal for remote access IPsec and SSL VPN tunnels.
   • Adds a Control Center widget for DNS Protection status, enhanced troubleshooting logs and notification emails, and Sophos Assistant guided configuration steps for Sophos DNS Protection.
   • Increases SD-RED scalability to 1,000 site-to-site RED tunnels and 650 SD-RED devices.
   • Adds NAT64 support for IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.-to-IPv4 traffic in explicit proxy mode, enabling IPv6-only clients to reach IPv4 websites, with IPv4 upstream proxy support for IPv6-only clients.

   +7 more show less

   • Adds a configurable request (upload) file size limit in WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. (Web Application Firewall) with scanning support for files up to 1 GB.
   • Adds real-time telemetry gathering with secure hash validation to flag unexpected changes to core OS files (Secure by Design).
   • Adds Path MTU Discovery in DPI mode — the deep packet inspection engine now automatically detects and adjusts MTU per flow, resolving connection errors caused by ML-KEMML-KEMNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake. (KyberKyberNIST's post-quantum key-exchange standard (FIPS 203), formerly Kyber. Two parties use it to agree on a shared secret, usually alongside X25519 in a hybrid TLS handshake.) key exchange.
   • Removes RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. restrictions from virtual, software, Cloud BYOL, and Firewall Home edition licenses; instances are now restricted only by CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. core count.
   • Extends DHCP prefix delegation to support /48 to /64 prefixes, with Router Advertisements (RA) and DHCPv6 server enabled by default.
   • Adds resizable table columns (with browser-memory persistence) to SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. routes and profiles, NAT rules, SSL/TLS inspection rules, Hosts and services, and Site-to-site IPsec VPN views.
   • Extends SD-WAN route free-text search to include route name, ID, objects, and object values (IP addresses, domains); adds content-based object name and value search to Local ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. exception rules.

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !XG and SG Series hardware appliances are no longer supported in SFOS 21.0 GA and later, including SFOS 21.5 GA.
   • !Site-to-site IPsec VPN connection type Site-to-site has been renamed to Policy-based and Tunnel interface has been renamed to Route-based (Tunnel interface) — existing configurations referencing these labels must be updated.
   • !Default firewall rules and the default rule group created during new firewall setup have been removed; only the default network rule and MTA rule remain in new deployments, and the default firewall rule group is now set to None.
   • !Default gateway probing for custom gateways is now set to None (previously had a non-None default).
9. Version 20.0 MR3Build 427Released on December 12, 2024 Dec 12, 2024 · release notes

   Sophos Firewall 20.0 MR3 adds FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. support and a new CLI command to clear missing heartbeat endpoint status.

   • Adds a new CLI command to remove the missing heartbeat status for endpoints based on the number of days their heartbeats have been missing, or by specifying individual endpoint names.
   • Enables FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 level 1 compliance mode using a certified cryptography library on XGS Series hardware appliances and cloud/virtual firewalls.

   2 details in Everything

10. Version 20.0 MR2Build 378Released on July 23, 2024 Jul 23, 2024 · release notes

    Sophos Firewall 20.0 MR2 adds a backup-restore assistant with flexible model, interface, and HA port mapping across appliance types.

    └──▷ HOW TO FIND IT
    Walk through the backup-restore assistant UI to remap interfaces when migrating a backup from a 1US XG Series appliance down to a desktop XGS 126.
    📍In the Sophos Firewall admin console, go to Backup & Firmware › Restore, select the backup file (from 19.5 MR4 or later), and follow the backup-restore assistant to review and change the default port mapping before confirming the restore.
    • Adds a backup-restore assistant that lets you view and change default port mapping when restoring backups from version 19.5 MR4 and later to 20.0 MR2 and later.
    • Enables restoring backups across higher- to lower-capacity appliance models (e.g., 1US XG Series to desktop XGS 126), and across hardware appliances, cloud, virtual, and software firewalls.
    • Supports restoring high availability backups to devices with fewer or more interfaces, with the dedicated HA link permitted on a different port in the target device.
    • Adds cipher compliance controls to set the security balance between cipher compatibility and audit compliance (PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly.) by customizing allowed cipher suites.

    4 details in Everything

11. Version 20.0 MR1Build 342Released on May 15, 2024 May 15, 2024 · release notes

    Sophos Firewall 20.0 MR1 adds TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake.-based Zero Touch deployment, OpenVPN 3.0 support, GCM Phase I IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. ciphers, and a Generative AI assistant.

    └──▷ HOW TO FIND IT
    Block VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. access originating from a specific country (e.g., China) on the WAN interface using a Local Service ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. exception rule with an FQDN host as source — without hard-coding dynamic IPs.
    📍In the web admin console, go to Administration › Device Access › Local Service ACL Exception Rules, click Add Exception, set Service to IPsec or SSL VPN, set Source to an FQDN host group representing the country range, set Action to Drop, and save.
    Remotely provision a branch firewall with zero on-site configuration using TPM-based True Zero Touch via Sophos Central.
    📍In Sophos Central, go to My Products › Firewall Management, define the target firewall configuration, then have the branch administrator connect the firewall to the internet and power it on — the device retrieves and applies its configuration automatically.
    Download a specific log file from the firewall for rapid triage without generating a full Consolidated Troubleshooting Report.
    📍In the web admin console, go to Diagnostics › Troubleshooting logs, locate the relevant log file in the list, and click Download next to it.
    • Adds IPsec and RED services to the Device Access grid so administrators can allow or block traffic per zone (e.g., block RED from WAN while permitting it from LAN).
    • Adds AD SSO, RADIUS SSO, Captive portal, Client authentication, Chromebook, Wireless, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale., RED, and IPsec as selectable services inside Local Service ACL exception rules.
    • Adds FQDN host, FQDN host group, MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet., and MAC address list as object types for source and destination hosts in Local Service ACL exception rules.
    • Adds CLI commands to prevent system-generated traffic from flowing through policy-based IPsec tunnels when remote subnets are set to Any.
    • Adds AES256GCM16, AES192GCM16, and AES128GCM16 GCM Suite-B ciphers for Phase I IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. IPsec tunnels.

    +16 more show less

    • Adds support for OpenVPN 3.0 clients; compatible configuration files are downloadable from the VPN portal.
    • Adds TPM-based True Zero Touch configuration to remotely deploy firewalls in branch offices via Sophos Central.
    • Adds customizable syslog delimiter for event messages.
    • Adds individual log file downloads from the web admin console under Diagnostics > Troubleshooting logs.
    • Adds DHCP boot server and boot file options in the DHCP header.
    • Adds Generative AI assistance via Sophos Assistant with dynamic help and configuration steps.
    • Adds description fields for IP, MAC, FQDN, and service objects.
    • Adds bridge configuration support for WAN interfaces with the RED tunnel on SD-RED.
    • Adds link-local address support for custom gateways.
    • Groups IPsec, SSL VPN, VPN portal, and RED together under a VPN services section in Device Access.
    • Delivers 4x improvement in gateway availability time during HA failover and device restart in SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience..
    • Local Service ACL exception rule list view now displays source, destination, service, and action without opening individual rules.
    • Sets the default log line count for files in the Consolidated Troubleshooting Report (CTR) to 10,000.
    • Web admin console and user portal now automatically detect and store the browser's preferred language.
    • Limits Synchronized Application Control (SAC) data retention to the five most recent occurrences per application per endpoint.
    • Updates the country list.

    21 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Site-to-site SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. VPN tunnels will no longer be established between SFOS 18.5 or earlier versions and SFOS 20.0 MR1 or later (OpenVPN upgraded to 2.6.0); use IPsec or RED tunnels as alternatives.
    • !Remote access SSL VPN tunnels will no longer be established with the legacy SSL VPN client (already end-of-life); use Sophos Connect, a third-party OpenVPN client, or IPsec remote access.
    • !Site-to-site SSL VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. between UTM9 OS and SFOS 20.0 MR1 or later will no longer be established; use IPsec or RED tunnels as alternatives.
    • !RED 15, RED 15w, and RED 50 devices are no longer supported in 20.0 MR1 and later.
    • !XML API versions for end-of-life SFOS versions 17.5 and 18.0 are no longer supported; the APIVersion tag must be updated to a supported version.
12. Version 20.0 GABuild 222Released on November 06, 2023 Nov 6, 2023 · release notes

    Sophos Firewall 20.0 adds MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. threat feeds, ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. gateway integration, a new VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. portal, and major SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience./IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. scalability upgrades.

    └──▷ HOW TO FIND IT
    Configure a route-based IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. VPN with a wildcard remote gateway to support dynamic IP peers without DDNS or FQDN entries.
    📍In the web admin console, go to VPN › IPsec Connections, create a route-based VPN profile, and set the Remote Gateway field to *.
    • Adds Active Threat Response, integrating Sophos MDR threat feeds directly with the firewall to automatically block traffic — including DNS requests and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. — to malicious IPs, domains, and URLs without requiring additional rules or policies.
    • Extends Synchronized Security to Active Threat Response, using RED Security Heartbeat to query Sophos-managed endpoints communicating with malicious servers for host, user, and process details (IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself.), and preventing lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. or outbound communication.
    • Introduces an extensible API framework for dynamic threat feeds, enabling Sophos products (X-Ops, MDR) and, in a future release, third-party threat intelligence to be pushed to the firewall in real time.
    • Adds a new hardened, containerized self-service VPN portal (available by default on port 443) for remote access VPN users, providing downloads, auto-provisioning, and clientless VPN bookmarks; the user portal moves to port 4443 by default.
    • Adds FQDN host and group support for remote access and site-to-site SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., selectable under permitted, local, and remote networks.

    +13 more show less

    • Adds stateful HA failover for route-based, policy-based, and remote access IPsec VPNs, enabling seamless tunnel continuity during high-availability failover.
    • Adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. MIB entries to monitor IPsec VPN tunnel statuses (activate, deactivate, connected), downloadable from the web admin console.
    • Adds wildcard address (*) support for remote gateway in route-based VPNs, eliminating the need for explicit DDNS or FQDN configuration in dynamic gateway IP deployments.
    • Adds support for unique preshared keys (PSK) per VPN connection sharing the same local and remote gateway settings when using IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. profiles with unique local and remote IDs.
    • Adds DH groups 27 to 30 for IKEv2 IPsec profiles based on RFC 6954.
    • Adds IPv6 DHCP prefix delegation support for seamless ISP integration, automating IPv6 prefix assignment to internal subnets.
    • Adds BGPv6 support to the dynamic routing engine for improved IPv6 interoperability.
    • Increases SD-WAN gateway scalability by 3x to 3072 gateways and SD-WAN profiles to 1024.
    • Integrates Sophos ZTNA Gateway directly into Sophos Firewall, eliminating the need for a separate gateway VM for remote access to internally hosted systems and applications.
    • Adds Akamai Secure Internet Access (SIA) integration, enabling SD-WAN on-ramp from Sophos Firewall to Akamai SIA SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. over redundant route-based IPsec VPN tunnels.
    • Adds Cloudflare Magic WAN integration, enabling SD-WAN on-ramp from Sophos Firewall over redundant route-based IPsec VPN or GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnels.
    • Adds Azure Virtual WAN integration, enabling Sophos Firewall protection for application traffic with scalable SD-WAN connectivity using the Microsoft Global Network as a secure enterprise WAN backbone.
    • Adds full support for Sophos DNS Protection, a new cloud-delivered web security service providing domain name resolution security.

    18 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The user portal moves from port 443 to port 4443 by default; remote access VPN downloads, auto-provisioning, and clientless VPN bookmarks are removed from the user portal and are now served only through the new VPN portal.
13. Version 19.0 MR2Build 472Released on January 23, 2023 Jan 23, 2023 · release notes

    Sophos Firewall 19.0 MR2 adds bulk mail MTA controls, 4× SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. profile capacity, RED unlock-code emails, and larger Intelix sample submissions.

    └──▷ HOW TO FIND IT
    Configure the notification email for RED unlock codes so your team receives them automatically when devices are provisioned or removed.
    📍In the Sophos Firewall admin console, go to System services › RED and enter the email address in the unlock-code notification field before adding or deleting a RED device.
    Locate SD-WAN performance issues quickly by searching for a specific profile on the diagnostics page.
    📍In the Sophos Firewall admin console, go to Diagnostics › SD-WAN performance and use the profile name search field to filter results.
    Filter SD-WAN gateways by health or interface to isolate degraded paths during an incident.
    📍In the Sophos Firewall admin console, open SD-WAN gateway management and use the filter controls to narrow by status, IP address, interface, or health check.
    • Adds bulk mail settings in MTA mode to enhance spam catch rate with SASI.
    • Increases SD-WAN profile capacity to 4× the previous limit, supporting scaled deployments.
    • Adds gateway filtering by status, IP address, interface, and health check in SD-WAN gateway management.
    • Adds SD-WAN profile search by name on Diagnostics > SD-WAN performance.
    • Adds automatic RED unlock-code delivery via email to the address specified on System services > RED when a RED device is added or removed.

    +3 more show less

    • Raises the Intelix zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. sample submission limit above the previous 10 MB cap.
    • Adds support for turning off anti-replay protection in IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. for specific cases.
    • Improves security heartbeat selection in remote access IPsec VPN.

    8 details in Everything

14. Version 19.0 MR1Build 365Released on August 16, 2022 Aug 16, 2022 · release notes

    Sophos Firewall 19.0 MR1 adds static IP leases for SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. default profiles, multi-DHCP for RED, and a 10,000-cert Synchronized Security limit.

    └──▷ HOW TO FIND IT
    Opt out of Sophos Assistant from the web admin console to reduce UI distractions for experienced administrators.
    📍In the web admin console, navigate to the Sophos Assistant widget and select the option to opt out.
    Report a false-positive spam email to improve detection accuracy without leaving the quarantine workflow.
    📍In the web admin console, go to Email › Quarantine Release Page, locate the message, and select Report as False Positive.
    • Adds vpn conn-remove-tunnel-up and vpn conn-remove-on-failover default settings to prevent non-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections (VoIP, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., Skype, Zoom, UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.) from flapping when an IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. tunnel comes up or fails over.
    • Adds static IP address lease for remote access SSL VPN users, assignable from the firewall or an external RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. server, improving user monitoring and traceability.
    • Adds default IKEv2 profiles (Head office (IKEv2) and Branch office (IKEv2)) for site-to-site IPsec connections, pre-tuned for rekey interval, DPD selection, and key negotiation retries.
    • Adds rule-ID and index columns to the SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. profile list for easier troubleshooting.
    • Supports multiple DHCP servers for RED interfaces.

    +5 more show less

    • Caps endpoint certificate downloads for Synchronized Security Heartbeat at 10,000 certificates at a time, including during registration.
    • Adds the option to opt out of Sophos Assistant from the web admin console.
    • Adds capability to report spam emails as false positives from the quarantine release page.
    • Upgrades malware scan engines (including Avira to its 64-bit AVD engine) to full 64-bit operation for optimum performance and future support.
    • Introduces a licensing model offering three free firmware upgrades before a valid support subscription is required for further upgrades.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The vpn conn-remove-tunnel-up default is now Disabled and vpn conn-remove-on-failover default is now Enabled for new configurations only; existing configurations are not changed on firmware upgrade or migration.
15. Version 19.0 GABuild 317Released on April 21, 2022 Apr 21, 2022 · release notes

    Sophos Firewall 19.0 adds Xstream SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. profiles, IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. FastPath acceleration, AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. import, and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for the admin console.

    └──▷ HOW TO FIND IT
    Quickly disable IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. across all policies during an emergency maintenance window without touching individual rules.
    📍In the web admin console, go to Intrusion Prevention › IPS policies and toggle the global IPS switch to Off.
    Automate AWS VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnel setup by importing an existing VPC configuration instead of manually entering IKE and IPsec parameters.
    📍In the web admin console, go to Site-to-site › AWS VPC, click Import, and upload the VPC configuration XML file downloaded from AWS.
    Protect the admin console with MFA so no one can log in as admin with a password alone.
    📍In the web admin console, go to the default admin account settings and enable the option to require MFA with a one-time password for sign-in.
    • Adds Site-to-site > AWS VPC to import an AWS VPC configuration XML file and automate IPsec tunnel setup, including routing and IPsec policies.
    • Adds a global on/off switch under Intrusion Prevention > IPS policies to enable or disable IPS across all policies at once.
    • Adds MFA with a one-time password for the default admin account sign-in to the web admin console.
    • Adds Xstream SD-WAN profiles on the firewall with support for routing strategies (first available link or performance-based SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments.) across VDSL, DSL, cable, LTE/cellular, and MPLS WAN links, including zero-impact rerouting when SLA thresholds are breached.
    • Adds real-time SD-WAN monitoring graphs for latency, jitter, and packet loss on Diagnostics > SD-WAN performance.

    +16 more show less

    • Adds a dedicated SD-WAN log module that surfaces log entries with SD-WAN rule ID and name for route request and reply directions.
    • Adds Xstream FastPath acceleration for IPsec traffic (site-to-site and remote access VPN), offloading ESP encapsulation/encryption and decapsulation/decryption to the Xstream Flow Processor's hardware crypto engine (excludes DES, 3DES, BlowFish, and MD5 ciphers).
    • Adds per-connection web authentication in explicit proxy mode, enabling multiple different users from the same source IP to authenticate independently (useful for terminal services, Windows Remote Desktop, and Direct Access).
    • Adds Tenant Restrictions support (Microsoft O365 header injection) in web policies to let Azure AD restrict which domains users can sign in to from Sophos Firewall protected networks.
    • Adds X-Forwarded-For header configuration in web policies to pass source IP addresses upstream to load balancers or proxies.
    • Adds an assistant for remote access SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. VPN configuration to streamline setup.
    • Adds Amazon VPC support on site-to-site VPN with an option to import the VPC configuration file or AWS security credentials.
    • Adds AES-GCMAES-GCMAES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. and Suite-B cipher suite support for IPsec, including configurable rekey time and an increased idle time-out option (up to 6 hours) for remote access IPsec VPN.
    • Adds static multicast route support and traffic selector specification for Route-Based VPN (RBVPN), with automatic XFRM interface and route management.
    • Adds SSL VPN multi-instance support yielding approximately 5x capacity improvement, with TLS 1.3 as the default, AES-NI acceleration, and GCM encryption.
    • Adds VPN log viewer filtering to monitor and troubleshoot remote access and site-to-site IPsec and SSL VPN tunnels.
    • Adds DHCP IPv4 options and boot server configuration in the web admin console.
    • Adds a Sydney, Australia data center location for cloud-based zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. machine learning file analysis, supplementing existing locations in Japan, Germany, the UK, and the USA.
    • Replaces the anti-spam engine with the Sophos Anti-Spam Interface (SASI) for Email Protection anti-spam scanning.
    • Adds log suppression that consolidates repetitive firewall log entries within a module into a single event with a repeat count.
    • Adds device hostname display in the browser tab and active user ID in the upper-right corner of the web admin console.

    21 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !SSL VPN multi-instance support enforces only the default SSL VPN lease ranges; custom hosts (IP ranges, lists, or networks) added to firewall rules for remote access SSL VPN connections will break traffic after upgrading to 19.0 — replace them with the system host ##ALL_SSLVPN_RW (and ##ALL_SSLVPN_RW6 if IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. is required) in the affected firewall rules.
    • !IPsec policies have been renamed to IPsec profiles and moved to System > Profiles; existing references or documentation pointing to the old location or name will need updating.