Sophos Firewall OS provides an elegant and effective web-based management console that offers quick access to all the features you need without unnecessary complexity.

• Control center provides at-a-glance feeds of system performance, traffic patterns, alerts, and policies.

• Unified policy model enables convenient management of all your user, network, and business app policies in one place for apps, web, QoS, and IPS, reducing redundancy, and overall rule count.

• Policy templates for networks, users, and business applications dramatically streamlines configuration.

• Role-based admin provides flexible granular access control for different functional areas.

Sophos Firewall Manager provides centralized management, monitoring, and control of all your XG Firewalls from a single console using a common user-interface that makes it easy to learn and use.

• Full-featured control and management of all firewall features centrally.

• Reusable templates makes it easy to apply consistent policy and setup new devices or branch offices.

• Flexible device grouping by region or model makes it easy to work with just the firewalls you want.

• Real-time monitoring for at-a-glance status of device health, including unique NOC view with instant drill-down.

• Role-based admin with change control tracking and audit logging makes it easy to identify past changes and roll back if necessary.

• Firmware update management enables quick and easy updates to all your firewalls with just a few clicks.

The all-new, carefully crafted control center analyzes extensive back-end data sources to surface just the information you need to respond quickly to changes in your network.

• Instant insights at a glance for all your important system, security and network status indicators from the all-new control center

• Automated report analysis highlights reports in the control center featuring data of interest or that may need attention, with one-click access to the full report.

• Quick drill-down interaction with any control center widget to get more detailed information, access relevant tools, or quickly take action.

• Email notifications are automatically sent for important system status events.

• SNMP with a custom MIB and support for IPSec VPN tunnels to manage remote office firewall devices.

Take advantage of the XG Firewall’s extensive on-box reporting or utilize Sophos iView for comprehensive, centralized reporting across your all your firewall devices.

• On-box reporting comes standard with every XG Firewall for all your local firewall reporting needs.

• Centralized reporting aggregates log data across all your firewall devices (including XG Firewall, UTM 9, and Cyberoam devices) to provide comprehensive consolidated reporting from a single screen.

• User and app risk analysis reports such as our unique User Threat Quotient or App Risk Score identify top risk users and applications respectively.

• Live log viewer, accessible from any screen, provides a real-time view into activity in your firewall across multiple separate windows with color-coded log lines.

• Change control and audit logging are provided to ensure compliance.

• Syslog support enables safe backup, archival, and analysis of system logs.

Layer-8 identity-based policies and unique user risk analysis give you the knowledge and power to regain control of your users before they become a serious threat to your network.

• Layer-8 identity powers all firewall polices and reporting, enabling unprecedented next-gen control over applications, web surfing, bandwidth quotas, and other network resources.

• User-based policy control over applications, websites, categories, and traffic shaping (QoS).

• User Threat Quotient (UTQ) identifies the top risk users on your network based on their recent network behavior.

• Flexible authentication options including directory services (AD, eDirectory, LDAP), NTLM, RADIUS, TACACS+, RSA, client agents, or captive portal.

• Two-factor authentication (2FA) one-time password support for access to key system areas, including IPsec and SSL VPN, the user portal, and the web administration console.

Complete application visibility and control over all applications on your network with deep-packet scanning technology.

• Visibility and control over thousands of applications via customizable policy templates with granular controls based on category, risk, technology, or other undesirable characteristics.

• User-based application policies enables custom-tailored application control to be added to any user, group, or network policy with the option to also apply traffic shaping.

• Traffic shaping (QoS) prioritizes bandwidth allocation to critical applications and limits bandwidth for non-business applications.

• HTTPS scanning deep scans encrypted application traffic for browsers and related micro-apps to control chat, messaging, posts, file transfers, and other web and social media apps.

Full visibility and control over all your web traffic with flexible enforcement tools that work the way you need, with options for user and group enforcement of activity, quotas, schedules, and traffic shaping.

• Enterprise Secure Web Gateway (SWG) policy model with hierarchical inheritance enables sophisticated group and user-based web filtering policies to be defined quickly and easily, dramatically reducing firewall rule count.

• Template-driven activity control with predefined workplace and compliance policies utilize over 90 predefined website categories, covering billions of pages maintained by SophosLabs with the option to import custom URL lists.

• Traffic shaping (QoS) prioritizes bandwidth allocation to critical web applications and limits bandwidth for non-business websites.

• Comprehensive enforcement monitors HTTPS encrypted traffic, blocks anonymizing proxies, and can enforce Google Apps domains and SafeSearch to ensure your policies are always enforced.

Flexible, user-based policy control of downloadable content, including files types and dynamic content via FTP, HTTP, or HTTPS.

• Content filtering templates let you control hundreds of different files, executables, and dynamic content types simply as part of any user or network web control policy.

• Create custom content type definitions easily by adding them to existing content filtering categories or your own custom categories.

• Content scanning options let you customize when and how content is scanned with size options and real-time or batch-mode scanning.

• Outbound email DLP that's policy-based can automatically trigger encryption or block/notify based on the presence of sensitive data in emails leaving the organization.

• Web caching reduces bandwidth consumption by caching supported web content and downloads, including Sophos Endpoint updates.

Stateful and deep-packet inspection for network and application traffic with advanced networking and perimeter defenses.

• Zone-based security enables profile-based networking and security rules with multiple security zones built-in (LAN, WAN, DMZ, VPN, Wi-Fi), or create your own custom zones.

• Perimeter defenses stops attacks on your network, including reconnaissance detection, spoofing, flood protection (DoS, DDoS), and packet-based attacks (ICMP).

• Next-gen IPS goes beyond traditional servers and network resources to identify and protect users and applications on the network as well.

• Advanced IPS protection from all types of modern hacks and attacks using a uniform signature format backed by SophosLabs.

• FastPath packet optimization provides transparent (layer-2), single-scan performance with up to 200% better performance than conventional scanning technology, so IPS won’t slow you down.

• Country-based policy blocks Geo IP ranges for entire countries or regions.

Sophos Sandstorm uses next-gen cloud-sandbox technology, giving your organization an extra layer of security against ransomware and targeted attacks.

• Cloud delivery means Sandstorm is fully integrated with your XG Firewall and requires no additional hardware.

• Great value for the money affords you all the benefits of enterprise-grade protection without the enterprise price tag.

• Defeat ransomware and targeted threats by blocking evasive threats. Sophos Sandstorm achieves this by blocking threats like ransomware disguised as executables, PDFs, and Microsoft Office documents.

• Detailed threat reports for every incident so you know exactly what’s going on.

Sophos' award-winning, high-performance anti-malware engine is backed by SophosLabs and a 30-year history of protecting enterprises from the latest threats.

• Advanced malware protection that goes beyond signature-based detection to include advanced, proprietary techniques like code emulation and behavioral analysis to detect obfuscated or polymorphic threats.

• Live Protection is exclusive to Sophos and closes the gap between regular updates through real-time cloud lookups.

• Dual-engine scanning offers the option of scanning traffic with the Sophos engine for excellent performance and protection, or adding a second engine scan for even more protection.

• SophosLabs 24/7 global threat research operation is one of few in the world with the breadth and depth necessary to stay ahead of the latest threats.

Sophos' Web Protection engine is backed by SophosLabs and includes innovative technologies required to identify and block the latest web threats.

• Advanced Web Protection combines advanced analysis capabilities such as JavaScript emulation, behavioral analysis, and origin reputation to protect against modern, multi-stage web attacks.

• Pharming protection guards against phishing and pharming attacks by overriding corrupt host file or DNS lookups.

• HTTPS scanning deep scans encrypted traffic for threats and compliance.

• SophosLabs, the global, round-the-clock threat research operation, identifies thousands of newly infected websites and instances of web malware, ensuring you have the best malicious site database protecting your network and users.

Our revolutionary Security Heartbeat™ links your endpoints with your firewall to deliver unparalleled protection from advanced threats while significantly reducing the time and complexity of responding to security incidents.

• Security Heartbeat: XG Firewall monitors the Security Heartbeat status of all your Sophos Endpoints, enabling you to quickly identify compromised systems and automatically limit network access for these systems until they can be cleaned up.

• Destination Heartbeat Protection, new in XG Firewall v16. You can now control access to endpoints and servers based on the status of their Heartbeat – further bolstering protection from potentially compromised systems until they are completely safe.

• Real-time application visibility. An industry first, XG Firewall can utilize Synchronized Security to solicit information from an endpoint to determine the application responsible for generating unknown traffic on your network.

Sophos Firewall OS delivers advanced threat protection to defend your network from today’s sophisticated attacks.

• Security Heartbeat links your endpoints and your firewall, combining their intelligence to identify and isolate systems compromised by advanced and previously unknown threats.

• Multi-layered, call-home protection combines analysis from DNS, IPS, web, and traffic filters to identify and block botnet and command-and-control (C&C) call-home attempts.

• Intelligent firewall policies account for endpoint behavior to automatically isolate or limit access to infected systems that may be compromised by an advanced threat.

Combine next-gen firewall capabilities with our enterprise-class web application firewall to protect your critical business applications from hacks and attacks while still enabling authorized access.

• Next-generation IPS provides advanced protection from hacks and attacks while maintaining top performance.

• Web Application Firewall integrates seamlessly with your next-gen firewall, combining industrial-strength protection like URL and form hardening with the ease of template-driven policy configuration.

• Granular, user-based protection with a rich set of configuration options and multiple authentication options, ensuring easy access for those you want and powerful protection from those you don't.

Protect your email from spam, phishing, and data loss with our unique all-in-one protection that combines policy-based email encryption with DLP and anti-spam.

• Full MTA store and forward support enables business continuity, allowing the firewall to store mail when target servers are unavailable.

• Live anti-spam provides protection from the latest spam campaigns, phishing attacks, and malicious attachments.

• SPX encryption is unique to Sophos, making it easy to send encrypted email to anyone, even those without any kind of trust infrastructure.

• DLP that's policy-based can automatically trigger encryption or block/notify based on the presence of sensitive data in emails leaving the organization.

• Self-serve quarantine gives employees direct control over their spam quarantine, saving you time and effort.

Sophos XG Firewall offers the most advanced high-performance networking technology available.

• Flexible NAT and bridging options ensures compatibility with nearly any network topology or segmentation strategy.

• Access control criteria is based on user identity, source and destination zone, MAC or IP address, Service, etc.

• Advanced routing uses Static, OSPF, BGP, and RIP with full 802.1Q VLAN support and multicast with support for per-rule routing and policy-based routes based on source, service, or destination.

• WAN link balancing provides load balancing and high availability with weighting options and fail-over rules.

• Discover mode allows deployment without any network changes to monitor network traffic in either bridge mode or while connected to a switch mirror port.

• IPv6 support throughout for interfaces, routing, and tunneling, including 6-in-4, 6-to-4, 4-in-6, IPv6 rapid deployment (6rd), and IPv6 through IPSec tunneling.

Zones rise above the traditional interface-based configuration model to provide a more intuitive, powerful, and simple way to secure and segment your network and create policy.

• Default zones for LAN, WAN, DMZ, LOCAL, VPN, and Wi-Fi make it easy to get up and running quickly and easily.

• Custom zones are easily created on the LAN or DMZ with a variety of options for admin service access, as well as authentication and various network services.

• Zone isolation ensures zones are isolated until firewall rules are explicitly created to enable secure exchange of application, user, and network traffic to pass between them.

• Zone-based policies enable simple but powerful firewall rules that anyone can immediately interpret and understand.

Flexible and powerful but easy-to-use traffic shaping (also known as quality of service or QoS) controls enable configuration by application, category, user, group, or policy rule.

• Network or user-based traffic shaping prioritizes bandwidth allocation to critical applications and limits bandwidth for non-business applications on any network or user-based policy.

• Web category traffic shaping prioritizes bandwidth allocation and/or limits based on website category.

• Network traffic quotas allow unlimited customization for total or individual network traffic quotas.
• Real-time VoIP optimization ensures real-time traffic for Voice over IP and other communications are given prioritization.

Integrated wireless controllers in XG Firewalls enables easy secure wireless deployments managed from a single console.

• Plug-and-play deployment enables quick installation and configuration with just a few clicks since the firewall automatically recognizes the Sophos Wireless Access Point as soon as it’s connected.

• High performance with the latest 802.11ac and powerful radios, offering maximum coverage and throughput.

• Flexible configuration with options for isolation, bridging, zones, hotspots, and multiple SSIDs per radio.

• Secure encryption with support for all the latest standards including WPA2 personal and enterprise.

Sophos combines performance-optimized technologies at every point in the firewall processing chain that leverage Intel’s multi-core processing platform.

• FastPath packet optimization improves firewall scanning performance by 200% or more by automatically putting secure traffic on the fast path after the initial content is identified, scanned, and determined to be safe and compliant.

• High-performance proxy supporting thousands of simultaneous connections enforces web policy with millisecond latency.

• High-speed interfaces and switches come with plenty of GigE ports on every appliance and optional FlexiPort expansion modules for 10GbE copper or fiber connectivity.

• High availability with active-active load balancing or active-passive fail-over and WAN link balancing lets you easily double your performance when you need it.

Select from a full range of VPN technologies for secure site-to-site and remote access.

• Full standards-based VPN support includes IPSec, SSL, PPTP, L2TP, Cisco VPN (iOS), and OpenVPN (iOS and Android).

• Clientless portal using Sophos' unique encrypted HTML5 self-service portal provides support for RDP, HTTP, HTTPS, SSH, Telnet, and VNC for quick access to essential business applications.

• RED VPN, a Sophos exclusive, uses an affordable Remote Ethernet Device (RED) at the remote site to easily establish a secure VPN connection.

• Firewall-to-firewall RED tunnels offer a high-performance VPN alternative to connect your firewalls, exclusive to Sophos.

Unique Sophos Remote Ethernet Devices (RED) make extending your secure network to other locations as easy as plugging in a box.

• Plug-and-play VPN. Simply enter the RED ID into your firewall and ship it.

• No technical skills required. As soon as it’s plugged in, the device will automatically establish the VPN connection with the firewall.

• Traffic routing allows you to direct all network traffic from the remote location back to your firewall for complete protection, or to only route inter-office network traffic via RED.

• Secure encryption. All traffic between the RED and your firewall is encrypted to provide a secure private connection

Ensure encrypted traffic is not a blind spot in your network with fully transparent SSL scanning, enforcement, and protocol validation.

• SSL decryption securely intercepts and decrypts SSL traffic to allow deep scanning for security, compliance, and policy checks with policy-driven opt-outs, allowing privacy for sensitive traffic.

• SSL inspection ensures enforcement and compliance even without full man-in-the-middle decryption.

• Certificate validation protects your network from malformed or spoofed certificates.

• Protocol enforcement for encrypted traffic connections identifies and blocks unwanted traffic trying to bypass filtering or traffic shaping.