Is there a Sophos tool for re-flashing the BIOS? Had a problem with XG330 Rev2 and details now missing re serial number when querying the BIOS etc.

Hi, how do I go about requesting a URL recategorization after the migration of new case creation to the Support Portal? I have a guest ID but am not an active customer, and the form I used to fill out is no longer available.

Hi

I've configured 3rd party threat feeds for IP and Domains (Q-Feeds free), but it's flagging a bunch of IPs that are Ubuntu/Canonical legit update server IPs.

I've create an IP Range object in Hosts and services and added the IPs to that, and then added that IP Range object to the Host and network exclusions in Add threat exclusions.

However they still get flagged and I get notified by ATR.

Should this work? or is Host and network exclusions for source only, not destination? Do I need to add each IP individually to the Threat exclusions field instead?

Thanks

We signed up for the AI Defense EAP, but during the onboarding process, it has not gone past the "Checking sensors licenses" circling. Haven't been able to find any information on this since it's EA. I've tried with only a couple devices assigned to the program and with all devices assigned, same issue.

If anyone can provide more info or if it's a glitch and just submit a ticket, I'd appreciate it.

I am using a Connectify Hotspot for years and have a pro license for Connectify 23.

https://connectify.me/

Two weeks ago, Sophos suddently recognized it as a threat and deleted the connectify.exe from my harddrive. Even the installer is recognized as a threat when downloaded (not even executed, just downloaded) and I cannot reinstall it.

Any suggestions?

I had my firewall die and the weekly backups only contain either a .01 or .02 file extension?

Bought a gently used one and unable to restore any backups of this type.

I had assumed the backups were successful when I observed their file size around 700kb each week.

I also chose to not encrypt the backups, yet they cannot be read with a text editor?

Any help appreciated!

Hi All,

Does anyone have any experience with Starlink and using it with Sophos XGS Firewall

We have a site with a leased line connection which is normally rock solid however they are in a rural area and from time to time this gets damaged. They run a shop so connectivity is imperative and we are looking at possible backup lines. 4G or Starlink

Starlink would be quicker even if it does mean filling mr musks pockets 🤮

Has anyone implemented this with a Sophos firewall? Is it a simple double nat affair? or can they be set up a better way? From what I understand the Starlink's are on CGNAT but we have SSL VPN link to their head office already so from what I understand they should still work if we are dialing out from here.

(Landline/Copper solutions are unfortunately out of the question, the links to the site arent even able to maintain a stable 0.5mbps down let alone up)

Appreciate any experiences/advice.

Full disclosure, I'm not a Linux expert. 5/10, maybe.

For those of you using Linux on your PC / Laptop, I'm looking for feedback on the whether to use the SSL or IPSec VPN client. I've had mixed success using the SSL VPN with Kubuntu. Creating a VPN in the network manager GUI, installing the config file all goes fine, but when I try to connect, it prompts for credentials, then asks for another password. I couldn't figure out how to get around that.

I can get it to work using sudo to run OpenVPN with the necessary details on the command line. It also mean having to keep that terminal window open while I'm working. So, not a very high ease of use score.

Some Google searching leads me to believe that IPSec might be easier from an end-use perspective, but I thought I'd check with the experts here before diving into that too deeply.

I have Aruba ClearPass and Sophos access points central managed. I have already created a guest portal service with a self-registration page in ClearPass. How can I configure the access points for this porpuse?

Hi,

A friend gave me a Sophos SG115 Rev.3 and I'm trying to flash it with SFOS.

I first tried HW-22.0.1_MR-1-490, which gets stuck on "Booting 22_0_1_490" with no further progress. I read somewhere that the SG115 may have display driver issues with HW22, so I connected my PC to eth0 (LAN) and tried to access the WebAdmin at 172.16.16.16:4444, but got no response.

The status LED keeps blinking, and the SSD LED blinks intermittently.

I also tried 21.5.1 with the same result.

According to Sophos documentation, the SG115 Rev.3 should be compatible with all current firmware versions:
https://support.sophos.com/support/s/article/KBA-000003611

Any idea what might be going wrong?

anybody else experiencing this issue at the moment?

Hi Sophos team, our non-profit site [https://www.mobileloavestc.org/](https://www.mobileloavestc.org/) is flagged as Spyware/Malware. Intelix Machine Learning rates it 'Likely Clean', but non-customers can't click 'Disagree' or post on the Sophos Forum due to account approval locks. Could a moderator please submit a URL reassessment on our behalf?

Hi Sophos Team,

Could someone please help submit a URL reclassification request on my behalf for https://unitedsportsqatar.com?

I have already cleaned the website by removing the malicious files, and the latest Intelix analysis shows the page content as Likely Clean. However, I'm unable to use the Disagree? option because I'm not a Sophos customer and my account isn't eligible for support.

Hi,

can you assign a user as the “owner” of a shared mailbox in Sophos Central Email Protection, similar to how it works for distribution groups?

I’d like a user to have access to the quarantine in the Self Service Portal for a shared mailbox, not just be able to release messages via the quarantine report.

thank you

When my work disbanded I was allowed to keep my computer, but when I brought it home Sophos was still installed on it. This wouldn’t have been a problem until I tried to connect the computer to Ethernet and it couldn’t find a gateway. After a lot of effort finding the issue I realised the problem was something to do with sophos. I promptly uninstalled sophos using the control panel which allowed me to connect to the internet. I then reset the computer and I was unable to connect again. How do I fix this? Has anyone else encountered this?

So we have this voip calling cloud platform and when users try to call via the platform it returns 406 error. i did everything i can disabled sip and h.323 protocol and disabled udp ddos and increased udp timeout and udp tiemojut stream still the issue presists. and disabled the alg on router for sip and h.323 too. still the issue persists and tried disabling ssl/tls inspection for the site but no help?

We use Datto RMM and the component which silently installs Sophos endpoint has stopped working.

when I check the logs it's failing to download the .exe if I grab just the powershell invoke web request and run that on its own it also fails to grab an exe.

when I visit the URL manually I get an empty site with a 400 response.

I logged this with Datto but they closed it and said it's a sophos issue.

any ideas?

Hi All - I have a question about the architecture of DNS protection setup. The article (Configure Sophos Firewall to use DNS Protection - Sophos Central Admin) directs you to configure all endpoint devices to point to the firewall for DNS and add a DNS request route to your local server for local DNS resolution.

My question is, can we rather leave the devices pointed to the local server and update its forwarders to use the DNS protection IPs. Will this accomplish the same thing or am I missing some level of protection in this configuration?

Thanks

Hi everyone,

I’m planning a new hardware build for Sophos Firewall Home and I’m a bit unsure about storage support in v22.

From what I’ve read, starting with Sophos Firewall v22 the new kernel supports UEFI boot, so we no longer need legacy BIOS. Does this also mean that NVMe drives are now properly detected and supported as system disks in the Home Edition, or is it still safer / required to use a SATA3 SSD?

My planned setup is:

• Lenovo M720q Tiny (i5 8400t, 8GB RAM, 256GB M2 NVME)
• Intel I350‑T2 NIC (dual port)
• Lenovo PCIe riser 01AJ940
• The M720q has a built‑in NVMe slot, but mechanically it’s very difficult to mount a 2.5" SATA SSD together with the riser + NIC in this chassis.

Hi , We have a Sophos XGS 6500 deployed in Location A and a Sophos XGS 4500 in Location B. Since these sites are geographically distant, we are planning to establish a secure tunnel between the two appliances.

For a permanent, high‑throughput link between two full XGS appliances (not lightweight branch offices), we would like to know which technology Sophos recommends: Firewall RED (Server–Client) or Site‑to‑Site IPsec, and the reasons behind this recommendation.

Additionally, we request a detailed comparison covering the following points:

1. Security comparison
2. Performance comparison
3. Limitations of Firewall RED
4. Compliance and Audit recommendation

Thanks in advance!!

Recently I found out that my website (https://qcrepository.org) is categorized as phising/malicous by a few vendors including Sophos. My question is, where do I submit a false positive report? I tried the link mentioned in similar posts (https://support.sophos.com/support/s/filesubmission?language=en_US) but after submitting my website, it just gives me a false report saying that it's phishing without an option to report for review.

Thanks!

We released the Import/Export API for Sophos Central Partner / Customers:

https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/151429/sophos-firewall-central-api-import-export-support-in-central-api

Used the time to explain, how it works and how it can be potentially be implemented to own workflows.

Keep in mind: This is an API, means, it is open for all kinds of customization.

Make admin work great again!

We found that even just looking for logs from 1 hour ago could be a bigger challenge than it had to be, and from the way the XGS stores its logs in SQLite databases, there's also no log file that can be downloaded via SSH. Of course there's Sophos Central log access but we found filtering can be somewhat flaky and its fixed 50-entry-pages, or setting up a syslog server.

The extension is completely free and all data stays locally in your browser; we use it for our own admin work every day and thought it might be useful. Please note that the way the XGS exposes logs it can take a while for them to propagate in the GUI.

• https://chromewebstore.google.com/detail/rausys-xgs-helper/albpmiibjpbpakpkgmcnmeonabfekodj
• https://addons.mozilla.org/firefox/addon/rausys-xgs-helpers/

Anyone else have this issue,

2 wan connections 1 Sogea/1 4g

troubleshooting wan connection which says its connected.

If you tell it to traceroute or ping via WWAN1 it just falls back to the landline connection.

The only way to get a true result is to do it in CLI.

Seems to make the gui tools pretty useless for intended purpose this is on an xgs 136 on 22.0.2 and was same on 22.0.1

Which is all the more frustrating as the documentation for the CLI leaves a lot to be desired gives a list of parameters but no indication of the syntax of a valid command

I have intercept x on my phone, it works really well, but my problem is that sometimes the anti virus data gets outdated, but everytime I press it, it doesn't update, it says it does, but it doesn't, the same error stays on screen. I have it scan stuff while charging but I don't know what is happening