https://cybertoolchain.io/tools/sophos-firewall New releases and features in Sophos Firewall, tracked by The Cyber Toolchain. en Fri, 23 Oct 2026 11:17:40 GMT https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_220_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_220_rn.html Fri, 23 Oct 2026 11:17:40 GMT Sophos Firewall v22.0 adds a CLI command to disable strict IPsec SA policy checks for third-party VPN peers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a command to turn off strict policy checks for site-to-site IPsec VPN tunnels when third-party peers share Security Associations (SAs) across multiple subnet pairs, preventing incoming IPsec traffic from being dropped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_220_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_220_rn.html Fri, 16 Oct 2026 00:00:00 GMT Sophos Firewall 22.0 MR3 adds a CLI command to disable strict IPsec SA policy checks for third-party VPN peers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a command to turn off strict policy checks for site-to-site IPsec VPN tunnels when third-party peers share Security Associations (SAs) across multiple subnet pairs, preventing incoming IPsec traffic from being dropped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • Upgrading to 23.0 EAP1 from version 22.0 MR3 Build 576 is not supported. • SFOS 22.0 GA and later versions no longer support XG and SG Series hardware appliances. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_220_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_220_rn.html Mon, 20 Apr 2026 00:00:00 GMT Sophos Firewall 22.0 MR1 adds NDR Active Threat Intelligence, XDR Linux sensor integration, Config Studio V2, and macOS SSL VPN via Sophos Connect 2.0. • Integrates Taegis NDR (iSensor) with high-signal detection patterns curated by Sophos Labs to identify potentially malicious traffic and active adversaries, logging events to the Data Lake for XDR, MDR, and SOC analysis. • Expands NDR Essentials support to all Sophos Firewall platforms: XGS Series, virtual firewalls, software firewalls, and cloud deployments. • Integrates with the Sophos XDR Linux sensor for real-time security monitoring, detecting unauthorized configuration changes, rule exports, malicious program execution attempts, and file tampering across all Sophos Firewall devices including XGS desktop and virtual appliances. • Blocks TCP and UDP connections resulting from interactive and reverse shell access, enabling early detection of command-and-control activity and covert shell access. • Logs the Sophos Central user identity in audit logs for configuration changes made through Sophos Central, supporting NIS2 and similar compliance requirements — visible in the Sophos Firewall log viewer and Sophos Central logs and reports. • Enables remote access SSL VPN connections on macOS devices using Sophos Connect 2.0. • Supports updating the MTU and MSS values of Wi-Fi interfaces using existing CLI commands. • Introduces Sophos Firewall Config Studio V2, a browser-based tool for viewing, comparing, and editing firewall configurations — with a unified configuration report, side-by-side comparison showing added/removed/modified/unchanged items, and a configuration editor that exports in API or curl formats. Breaking changes: • The legacy remote access IPsec VPN has been retired; firewalls containing this legacy configuration cannot be upgraded to SFOS 22.0 MR1 and later. • SFOS 22.0 GA and later versions do not support XG and SG Series hardware appliances. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_215_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_215_rn.html Wed, 18 Feb 2026 00:00:00 GMT Sophos Firewall 21.5 MR2 strengthens Microsoft Entra ID SSO with session re-evaluation to block MFA bypass. • Enhances Microsoft Entra ID SSO session management to re-evaluate Conditional Access policies on session reuse, preventing MFA bypass. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_220_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_220_rn.html Tue, 20 Jan 2026 00:00:00 GMT Sophos Firewall 22.0 adds CIS-benchmarked health checks, a new hardened control plane, XDR/Taegis integration, and TLS 1.3 admin access. • Adds `device_name` field to syslog output identifying the hostname of the firewall that produced each log, enabling differentiation across multiple firewalls in XDR and Taegis environments. • Enables instant alerts for web categories and keywords when turned on in `Web > Categories`, delivering real-time email notifications with date, time, user, category, and domain details. • Adds data center region selection for NDR Essentials flow analysis to meet data residency requirements, defaulting to the lowest-latency region. • Adds threat score to Active Threat Response logs for NDR Essentials, enhancing visibility and analytics. • Adds a new Firewall Health Check feature that evaluates dozens of configurations against CIS benchmarks, accessible via a new panel on the Control Center page and the `Firewall health check` main menu item. • Integrates Sophos XDR Sensor for Linux for continuous real-time system integrity monitoring, detecting unauthorized configurations, rule exports, malicious program execution attempts, and file tampering. • Introduces an all-new Xstream control plane enabling modularization, isolation, and containerization of services (such as IPS) with complete privilege separation and self-healing capability. • Builds the next-generation Xstream architecture on a hardened Linux kernel v6.6+ with tighter process isolation, KASLR, stack canaries, hardened usercopy, and mitigations for Spectre, Meltdown, L1TF, MDS, Retbleed, ZenBleed, and Downfall. • Integrates Taegis XDR and MDR with Active Threat Response, allowing malicious IPs, domains, and URLs to be pushed from the Taegis portal to block threats across all firewall subsystems with no manual configuration. • Integrates the latest Sophos anti-malware engine with AI/ML model detections, zero-day protection, global reputation lookups, and SophosLabs cloud database updates every five minutes or less. • Adds TLS 1.3 support for the web admin console, VPN portal, and user portal. • Adds public key authentication for SSH admin access, limited to the default admin for adding and deleting keys. • Adds granular logging controls for inbound and outbound traffic to reduce noise from repetitive events such as brute-force attacks. • Adds inbound forwarded traffic matching (WAF and DNAT) against MDR threat feeds, NDR Essentials, and third-party threat feeds, plus outgoing source matching for NDR Essentials and third-party threat feeds. • Includes a major upgrade to Samba components for Active Directory SSO, adding improved support for Windows Server 2025 and removing older encryption protocols. • Adds pagination, search, and filter options for XFRM interfaces in the web admin console. • Creates individual incoming and outgoing firewall rules with zone-based traffic control for site-to-site IPsec VPN connections instead of a single combined rule. • Enables navigation to any menu item or tab in the web admin console without waiting for the current page to load. • Optimizes DPDK memory in the DAQ layer for XGS 87/87w, 107/107w, and 116/116w desktop firewalls, eliminating out-of-memory instances. Breaking changes: • SFOS 22.0 GA and later versions do not support XG and SG Series hardware appliances. • Active Directory SSO Samba upgrade removes support for older encryption protocols, which may break AD authentication for environments relying on them. • Existing allowed IP addresses for XML API access are automatically converted to IP host objects prefixed with `apiconfig` on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_215_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_215_rn.html Wed, 08 Oct 2025 00:00:00 GMT Sophos Firewall 21.5 MR1 adds OAuth 2.0 email auth, NDR data-center selection, Windows Server 2025 AD SSO, and HA passphrase/SSH-key hardening. • Adds OAuth 2.0 as an authentication method for firewall email notifications, with migration recommended for Gmail accounts. • Adds NDR Essentials data-center location selection to meet regional and data residency requirements, defaulting to lowest-latency location. • Adds threat score visibility in Active threat response logs for NDR Essentials, improving reporting and analytics. • Adds Windows Server 2025 support for Active Directory SSO (NTLM and Kerberos) authentication. • Adds `device_name` field to syslog output, capturing the hostname of the firewall that produced the logs to differentiate data sources across multiple firewalls. • Adds HA passphrase complexity requirements — passphrases are no longer auto-generated, requiring administrators to set strong passphrases. • Adds unique SSH host key verification for high availability configurations to prevent man-in-the-middle attacks. • Adds node name and current role information to the `ha.log` high availability log for improved troubleshooting. • Adds automatic XFRM MTU assignment on route-based VPN tunnels, subtracting maximum IPsec overhead from the physical interface MTU to prevent packet fragmentation. • Adds firewall hostname, firmware version, serial number, and model to backup email subject lines for easier multi-firewall management. • Adds 'Created date' column to the hotspot vouchers page in the user portal, with sortable voucher listing. • Adds RFC compliance for SNMP MIB files, supporting SNMPv1 (RFC 1157), SNMPv2 (RFCs 1901, 1905, 1906), and SNMPv3 (RFCs 3411–3418). • Adds resizable columns to network menu pages, SD-WAN routes and profiles, gateways, and local service ACL exception rules, persisted in browser memory. • Enables localization for scheduled PDF reports, automatically generated in the administrator's sign-in language. • Disables L2TP and PPTP by default when importing groups from Active Directory and Microsoft Entra ID authentication servers. • Optimizes DPDK memory in the DAQ layer for XGS 87, 87w, 107, 107w, 116, and 116w desktop firewalls, eliminating out-of-memory instances. Breaking changes: • RED system host objects are now assigned a `/32` subnet mask instead of the subnet mask configured at interface creation time; firewall rules or configurations that relied on the RED system host matching a non-`/32` subnet will no longer match traffic and must be updated to use the correct IP host or network host. • LINCE mode must be enabled on both HA devices before configuring HA, and a restored HA backup requires the receiving devices to match the backup's LINCE status. • L2TP and PPTP are no longer turned on by default when importing groups from Active Directory and Microsoft Entra ID; groups or VPN configurations that previously relied on this default must explicitly enable L2TP or PPTP. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_215_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_215_rn.html Mon, 02 Jun 2025 00:00:00 GMT Sophos Firewall 21.5 adds NDR Essentials ML threat detection, Entra ID SSO for VPN, NAT64, and doubles route-based IPsec tunnel capacity. • Integrates Sophos NDR Essentials under Active Threat Response, using cloud-hosted ML engines including Encrypted Payload Analysis (no TLS decryption required) and a Domain Generation Algorithm engine to detect active adversaries — available in the Xstream Protection bundle for XGS Series firewalls. • Extends Microsoft Entra ID (Azure AD) SSO via OAuth 2.0 and OpenID Connect to the Sophos Connect client (v2.4+, Windows) and VPN portal for remote access IPsec and SSL VPN tunnels. • Adds a Control Center widget for DNS Protection status, enhanced troubleshooting logs and notification emails, and Sophos Assistant guided configuration steps for Sophos DNS Protection. • Increases SD-RED scalability to 1,000 site-to-site RED tunnels and 650 SD-RED devices. • Adds NAT64 support for IPv6-to-IPv4 traffic in explicit proxy mode, enabling IPv6-only clients to reach IPv4 websites, with IPv4 upstream proxy support for IPv6-only clients. • Adds a configurable request (upload) file size limit in WAF (Web Application Firewall) with scanning support for files up to 1 GB. • Adds real-time telemetry gathering with secure hash validation to flag unexpected changes to core OS files (Secure by Design). • Adds Path MTU Discovery in DPI mode — the deep packet inspection engine now automatically detects and adjusts MTU per flow, resolving connection errors caused by ML-KEM (Kyber) key exchange. • Removes RAM restrictions from virtual, software, Cloud BYOL, and Firewall Home edition licenses; instances are now restricted only by CPU core count. • Extends DHCP prefix delegation to support /48 to /64 prefixes, with Router Advertisements (RA) and DHCPv6 server enabled by default. • Adds resizable table columns (with browser-memory persistence) to SD-WAN routes and profiles, NAT rules, SSL/TLS inspection rules, Hosts and services, and Site-to-site IPsec VPN views. • Extends SD-WAN route free-text search to include route name, ID, objects, and object values (IP addresses, domains); adds content-based object name and value search to Local ACL exception rules. Breaking changes: • XG and SG Series hardware appliances are no longer supported in SFOS 21.0 GA and later, including SFOS 21.5 GA. • Site-to-site IPsec VPN connection type 'Site-to-site' has been renamed to 'Policy-based' and 'Tunnel interface' has been renamed to 'Route-based (Tunnel interface)' — existing configurations referencing these labels must be updated. • Default firewall rules and the default rule group created during new firewall setup have been removed; only the default network rule and MTA rule remain in new deployments, and the default firewall rule group is now set to None. • Default gateway probing for custom gateways is now set to None (previously had a non-None default). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_200_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_200_rn.html Thu, 12 Dec 2024 00:00:00 GMT Sophos Firewall 20.0 MR3 adds FIPS 140-3 support and a new CLI command to clear missing heartbeat endpoint status. • Adds a new CLI command to remove the missing heartbeat status for endpoints based on the number of days their heartbeats have been missing, or by specifying individual endpoint names. • Enables FIPS 140-3 level 1 compliance mode using a certified cryptography library on XGS Series hardware appliances and cloud/virtual firewalls. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_200_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_200_rn.html Tue, 23 Jul 2024 00:00:00 GMT Sophos Firewall 20.0 MR2 adds a backup-restore assistant with flexible model, interface, and HA port mapping across appliance types. • Adds a backup-restore assistant that lets you view and change default port mapping when restoring backups from version 19.5 MR4 and later to 20.0 MR2 and later. • Enables restoring backups across higher- to lower-capacity appliance models (e.g., 1US XG Series to desktop XGS 126), and across hardware appliances, cloud, virtual, and software firewalls. • Supports restoring high availability backups to devices with fewer or more interfaces, with the dedicated HA link permitted on a different port in the target device. • Adds cipher compliance controls to set the security balance between cipher compatibility and audit compliance (PCI) by customizing allowed cipher suites. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_200_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_200_rn.html Wed, 15 May 2024 00:00:00 GMT Sophos Firewall 20.0 MR1 adds TPM-based Zero Touch deployment, OpenVPN 3.0 support, GCM Phase I IPsec ciphers, and a Generative AI assistant. • Adds `IPsec` and `RED` services to the Device Access grid so administrators can allow or block traffic per zone (e.g., block RED from WAN while permitting it from LAN). • Adds `AD SSO`, `RADIUS SSO`, `Captive portal`, `Client authentication`, `Chromebook`, `Wireless`, `SMTP`, `SNMP`, `RED`, and `IPsec` as selectable services inside Local Service ACL exception rules. • Adds `FQDN host`, `FQDN host group`, `MAC address`, and `MAC address list` as object types for source and destination hosts in Local Service ACL exception rules. • Adds CLI commands to prevent system-generated traffic from flowing through policy-based IPsec tunnels when remote subnets are set to `Any`. • Adds `AES256GCM16`, `AES192GCM16`, and `AES128GCM16` GCM Suite-B ciphers for Phase I IKEv2 IPsec tunnels. • Adds support for OpenVPN 3.0 clients; compatible configuration files are downloadable from the VPN portal. • Adds TPM-based True Zero Touch configuration to remotely deploy firewalls in branch offices via Sophos Central. • Adds customizable syslog delimiter for event messages. • Adds individual log file downloads from the web admin console under Diagnostics > Troubleshooting logs. • Adds DHCP boot server and boot file options in the DHCP header. • Adds Generative AI assistance via Sophos Assistant with dynamic help and configuration steps. • Adds description fields for IP, MAC, FQDN, and service objects. • Adds bridge configuration support for WAN interfaces with the RED tunnel on SD-RED. • Adds link-local address support for custom gateways. • Groups `IPsec`, `SSL VPN`, `VPN portal`, and `RED` together under a VPN services section in Device Access. • Delivers 4x improvement in gateway availability time during HA failover and device restart in SD-WAN. • Local Service ACL exception rule list view now displays source, destination, service, and action without opening individual rules. • Sets the default log line count for files in the Consolidated Troubleshooting Report (CTR) to 10,000. • Web admin console and user portal now automatically detect and store the browser's preferred language. • Limits Synchronized Application Control (SAC) data retention to the five most recent occurrences per application per endpoint. • Updates the country list. Breaking changes: • Site-to-site SSL VPN tunnels will no longer be established between SFOS 18.5 or earlier versions and SFOS 20.0 MR1 or later (OpenVPN upgraded to 2.6.0); use IPsec or RED tunnels as alternatives. • Remote access SSL VPN tunnels will no longer be established with the legacy SSL VPN client (already end-of-life); use Sophos Connect, a third-party OpenVPN client, or IPsec remote access. • Site-to-site SSL VPNs between UTM9 OS and SFOS 20.0 MR1 or later will no longer be established; use IPsec or RED tunnels as alternatives. • RED 15, RED 15w, and RED 50 devices are no longer supported in 20.0 MR1 and later. • XML API versions for end-of-life SFOS versions 17.5 and 18.0 are no longer supported; the `APIVersion` tag must be updated to a supported version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_200_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_200_rn.html Mon, 06 Nov 2023 00:00:00 GMT Sophos Firewall 20.0 adds MDR threat feeds, ZTNA gateway integration, a new VPN portal, and major SD-WAN/IPv6 scalability upgrades. • Adds Active Threat Response, integrating Sophos MDR threat feeds directly with the firewall to automatically block traffic — including DNS requests and HTTPS — to malicious IPs, domains, and URLs without requiring additional rules or policies. • Extends Synchronized Security to Active Threat Response, using RED Security Heartbeat to query Sophos-managed endpoints communicating with malicious servers for host, user, and process details (IoC), and preventing lateral movement or outbound communication. • Introduces an extensible API framework for dynamic threat feeds, enabling Sophos products (X-Ops, MDR) and, in a future release, third-party threat intelligence to be pushed to the firewall in real time. • Adds a new hardened, containerized self-service VPN portal (available by default on port 443) for remote access VPN users, providing downloads, auto-provisioning, and clientless VPN bookmarks; the user portal moves to port 4443 by default. • Adds FQDN host and group support for remote access and site-to-site SSL VPNs, selectable under permitted, local, and remote networks. • Adds stateful HA failover for route-based, policy-based, and remote access IPsec VPNs, enabling seamless tunnel continuity during high-availability failover. • Adds SNMP MIB entries to monitor IPsec VPN tunnel statuses (`activate`, `deactivate`, `connected`), downloadable from the web admin console. • Adds wildcard address (`*`) support for remote gateway in route-based VPNs, eliminating the need for explicit DDNS or FQDN configuration in dynamic gateway IP deployments. • Adds support for unique preshared keys (PSK) per VPN connection sharing the same local and remote gateway settings when using IKEv2 profiles with unique local and remote IDs. • Adds DH groups 27 to 30 for IKEv2 IPsec profiles based on RFC 6954. • Adds IPv6 DHCP prefix delegation support for seamless ISP integration, automating IPv6 prefix assignment to internal subnets. • Adds BGPv6 support to the dynamic routing engine for improved IPv6 interoperability. • Increases SD-WAN gateway scalability by 3x to 3072 gateways and SD-WAN profiles to 1024. • Integrates Sophos ZTNA Gateway directly into Sophos Firewall, eliminating the need for a separate gateway VM for remote access to internally hosted systems and applications. • Adds Akamai Secure Internet Access (SIA) integration, enabling SD-WAN on-ramp from Sophos Firewall to Akamai SIA SSE over redundant route-based IPsec VPN tunnels. • Adds Cloudflare Magic WAN integration, enabling SD-WAN on-ramp from Sophos Firewall over redundant route-based IPsec VPN or GRE tunnels. • Adds Azure Virtual WAN integration, enabling Sophos Firewall protection for application traffic with scalable SD-WAN connectivity using the Microsoft Global Network as a secure enterprise WAN backbone. • Adds full support for Sophos DNS Protection, a new cloud-delivered web security service providing domain name resolution security. Breaking changes: • The user portal moves from port 443 to port 4443 by default; remote access VPN downloads, auto-provisioning, and clientless VPN bookmarks are removed from the user portal and are now served only through the new VPN portal. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_190_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_190_rn.html Mon, 23 Jan 2023 00:00:00 GMT Sophos Firewall 19.0 MR2 adds bulk mail MTA controls, 4× SD-WAN profile capacity, RED unlock-code emails, and larger Intelix sample submissions. • Adds bulk mail settings in MTA mode to enhance spam catch rate with SASI. • Increases SD-WAN profile capacity to 4× the previous limit, supporting scaled deployments. • Adds gateway filtering by status, IP address, interface, and health check in SD-WAN gateway management. • Adds SD-WAN profile search by name on `Diagnostics > SD-WAN performance`. • Adds automatic RED unlock-code delivery via email to the address specified on `System services > RED` when a RED device is added or removed. • Raises the Intelix zero-day sample submission limit above the previous 10 MB cap. • Adds support for turning off anti-replay protection in IPsec VPN for specific cases. • Improves security heartbeat selection in remote access IPsec VPN. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_190_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_190_rn.html Tue, 16 Aug 2022 00:00:00 GMT Sophos Firewall 19.0 MR1 adds static IP leases for SSL VPN, IKEv2 default profiles, multi-DHCP for RED, and a 10,000-cert Synchronized Security limit. • Adds `vpn conn-remove-tunnel-up` and `vpn conn-remove-on-failover` default settings to prevent non-TCP connections (VoIP, RDP, Skype, Zoom, UDP) from flapping when an IPsec tunnel comes up or fails over. • Adds static IP address lease for remote access SSL VPN users, assignable from the firewall or an external RADIUS server, improving user monitoring and traceability. • Adds default IKEv2 profiles (Head office (IKEv2) and Branch office (IKEv2)) for site-to-site IPsec connections, pre-tuned for rekey interval, DPD selection, and key negotiation retries. • Adds `rule-ID` and `index` columns to the SD-WAN profile list for easier troubleshooting. • Supports multiple DHCP servers for RED interfaces. • Caps endpoint certificate downloads for Synchronized Security Heartbeat at 10,000 certificates at a time, including during registration. • Adds the option to opt out of Sophos Assistant from the web admin console. • Adds capability to report spam emails as false positives from the quarantine release page. • Upgrades malware scan engines (including Avira to its 64-bit AVD engine) to full 64-bit operation for optimum performance and future support. • Introduces a licensing model offering three free firmware upgrades before a valid support subscription is required for further upgrades. Breaking changes: • The `vpn conn-remove-tunnel-up` default is now Disabled and `vpn conn-remove-on-failover` default is now Enabled for new configurations only; existing configurations are not changed on firmware upgrade or migration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_190_rn.html https://docs.sophos.com/releasenotes/output/en-us/nsg/sf_190_rn.html Thu, 21 Apr 2022 00:00:00 GMT Sophos Firewall 19.0 adds Xstream SD-WAN profiles, IPsec FastPath acceleration, AWS VPC import, and MFA for the admin console. • Adds `Site-to-site > AWS VPC` to import an AWS VPC configuration XML file and automate IPsec tunnel setup, including routing and IPsec policies. • Adds a global on/off switch under `Intrusion Prevention > IPS policies` to enable or disable IPS across all policies at once. • Adds MFA with a one-time password for the default admin account sign-in to the web admin console. • Adds Xstream SD-WAN profiles on the firewall with support for routing strategies (first available link or performance-based SLA) across VDSL, DSL, cable, LTE/cellular, and MPLS WAN links, including zero-impact rerouting when SLA thresholds are breached. • Adds real-time SD-WAN monitoring graphs for latency, jitter, and packet loss on `Diagnostics > SD-WAN performance`. • Adds a dedicated SD-WAN log module that surfaces log entries with SD-WAN rule ID and name for route request and reply directions. • Adds Xstream FastPath acceleration for IPsec traffic (site-to-site and remote access VPN), offloading ESP encapsulation/encryption and decapsulation/decryption to the Xstream Flow Processor's hardware crypto engine (excludes DES, 3DES, BlowFish, and MD5 ciphers). • Adds per-connection web authentication in explicit proxy mode, enabling multiple different users from the same source IP to authenticate independently (useful for terminal services, Windows Remote Desktop, and Direct Access). • Adds Tenant Restrictions support (Microsoft O365 header injection) in web policies to let Azure AD restrict which domains users can sign in to from Sophos Firewall protected networks. • Adds `X-Forwarded-For` header configuration in web policies to pass source IP addresses upstream to load balancers or proxies. • Adds an assistant for remote access SSL VPN configuration to streamline setup. • Adds Amazon VPC support on site-to-site VPN with an option to import the VPC configuration file or AWS security credentials. • Adds AES-GCM and Suite-B cipher suite support for IPsec, including configurable rekey time and an increased idle time-out option (up to 6 hours) for remote access IPsec VPN. • Adds static multicast route support and traffic selector specification for Route-Based VPN (RBVPN), with automatic XFRM interface and route management. • Adds SSL VPN multi-instance support yielding approximately 5x capacity improvement, with TLS 1.3 as the default, AES-NI acceleration, and GCM encryption. • Adds VPN log viewer filtering to monitor and troubleshoot remote access and site-to-site IPsec and SSL VPN tunnels. • Adds DHCP IPv4 options and boot server configuration in the web admin console. • Adds a Sydney, Australia data center location for cloud-based zero-day machine learning file analysis, supplementing existing locations in Japan, Germany, the UK, and the USA. • Replaces the anti-spam engine with the Sophos Anti-Spam Interface (SASI) for Email Protection anti-spam scanning. • Adds log suppression that consolidates repetitive firewall log entries within a module into a single event with a repeat count. • Adds device hostname display in the browser tab and active user ID in the upper-right corner of the web admin console. Breaking changes: • SSL VPN multi-instance support enforces only the default SSL VPN lease ranges; custom hosts (IP ranges, lists, or networks) added to firewall rules for remote access SSL VPN connections will break traffic after upgrading to 19.0 — replace them with the system host `##ALL_SSLVPN_RW` (and `##ALL_SSLVPN_RW6` if IPv6 is required) in the affected firewall rules. • IPsec policies have been renamed to IPsec profiles and moved to `System > Profiles`; existing references or documentation pointing to the old location or name will need updating. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sophos-firewall