Sophos Firewall: Verify if the hotfixes for CVE-2025-6704 CVE-2025-7624, CVE-2025-7382, CVE-2024-13974, and CVE-2024-13973 have been applied

Sophos Firewall: Verify if the hotfixes for CVE-2025-6704 CVE-2025-7624, CVE-2025-7382, CVE-2024-13974, and CVE-2024-13973 have been applied

To allow automatic installation of hotfixes in Sophos Firewall 20.0 and later, see the hotfix section under Sophos Firewall: System

This is also under console.

 

Sophos Firewall: Verify if the hotfixes for CVE-2025-6704 CVE-2025-7624, CVE-2025-7382, CVE-2024-13974, and CVE-2024-13973 have been applied

Sophos Firewall failed to access web admin console after upgrade from SFOS 19.0.3 MR-3-Build517 to SFOS 19.5.3 MR-3-Build652

After the upgrade, you still able to see the login page:

And also, you able to access Internet via the firewall:

But you failed to login the firewall web console: (Return a blank page)

You able to access firewall via SSH:

Solution:

Use SSH to login, then select "7" , then "R" to reboot the firewall.

Reference:

https://community.sophos.com/sophos-xg-firewall/f/discussions/142061/help-firewall-is-reachable-from-internet-but-not-able-to-connect-to-vpn-or-internal-servers

https://support.sophos.com/support/s/article/KB-000038694?language=en_US#:~:text=Check%20the%20connectivity%20to%20Sophos%20Firewall&text=Otherwise%2C%20try%20to%20access%20the,WAN%20IP%20of%20Sophos%20Firewall.&text=Try%20to%20use%20another%20browser,on%20port%2022%20via%20putty.

Sophos Firewall failed to access web admin console after upgrade from SFOS 19.0.3 MR-3-Build517 to SFOS 19.5.3 MR-3-Build652

Sophos firewall model compare with Hillstone/H3C/Huawei/Sangfor

 

 

Brand	Model	Hillstone (E series)	Hillstone(A series)	H3C	Huawei	Sangfor
Sophos	XGS 3100	E5568	SG-6000-A3700	H3C SecPath F5030	USG6620E	NGAF M5800
Sophos	XGS 3100	E3965	SG-6000-A2800	H3C SecPath F1070	USG6610E	NGAF M5600
Sophos	XGS 2100	E3965	SG-6000-A2700	H3C SecPath F1070	USG6575E	NGAF M5400
Sophos	XGS 5500	E5960	SG-6000-A5200	H3C SecPath F5060	USG6610E	NGAF M6000
Sophos	XGS 136	E3662	SG-6000-A2000	H3C SecPath F1070	USG6585E	NGAF M5300

Sophos firewall model compare with Hillstone/H3C/Huawei/Sangfor

Sophos Firewall: Verify if the hotfix for CVE-2022-1040 is applied on your Sophos XG firewall

Given the "Allow automatic installation of hotfixes" feature enabled (it is enabled by default). First come first is check this setting is it enabled.

 

 

Then, you need to verify the hotfix is it install by access the advanced shell by using SSH client remotely login your firewall or via console access

 

1. Select "5" – Device Management

 

2. Select "3" – Advanced Shell

3. Enter the following command:

 

test -f /static/up_mode_json_stamp && echo "Hotfix is applied" || echo "Hotfix isn't applied"

 

 

If the hotfix is applied, the return is "Hotfix is applied"

 

Enter "Exit" to exit the shell mode.

 

Reference:

Accessing Command Line Console - Sophos Firewall

Sophos Firewall: Verify if the hotfix for CVE-2022-1040 is applied

 

Sophos Firewall: Verify if the hotfix for CVE-2022-1040 is applied on your Sophos XG firewall

How to enable IPv6 native mode on Sophos SG UTM

 

1. Enable IPv6

 

2. Enter IPv6 fixed IP address , Netmask and Default GW address on WAN Interface

 

3. Add IPv6 address to Internal

 

 

 

4. Add Prefix Advsetis….. to intermal

You should able to see the WAN IP of IPv6

 

 

Test:

Go to "Support" -> "Tools"

 

 

Internal IPv6 address: fda8:06c3:ce53:a890:0000:0000:0000:0004 (Unique Local )

 

1. enable IPv6
2. force the UTM to request a prefix (not sure why I needed to do it)
3. add <prefix>00::1 as the IP address on the LAN interface (64-bit mask)
4. advertise the prefix on the LAN interface using stateless integrated server
5. enable automatic renumbering

 

 

Reference:

 

https://www.sysorchestra.com/configuring-ipv6-with-sophos-utm-9-and-kabeldeutschland/

https://simpledns.plus/private-ipv6

http://www.steves-internet-guide.com/ipv6-guide/

https://community.sophos.com/utm-firewall/f/management-networking-logging-and-reporting/116941/utm-vs-ipv6

https://www.jannet.hk/zh-Hant/post/IP-Address-Version-6-IPv6/

 

How to enable IPv6 native mode on Sophos SG UTM

Allow Bitdefender updates via Sophos XG firewall

Under Web -> Exception

Create the following rules

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/109202/anyone-else-having-issues-with-bitdefender-updates

Allow Bitdefender updates via Sophos XG firewall

Allow Galaxy Apps Store Update via Sophos XG firewall

Reference:

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/94745/unable-to-update-samsung-phone-behind-xg#pi2151filter=answers&pi2151scroll=true

Allow Galaxy Apps Store Update via Sophos XG firewall

Sophos XG firewall–many website have “Security Risk Detected” while accessing HTTPS sites suddenly on 10 Aug 2019

Workaround solution: Change the antivirus engine from Sophos to Avira

Reference:

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/104624/security-risk-detected-while-accessing-https-sites

Sophos XG firewall–many website have “Security Risk Detected” while accessing HTTPS sites suddenly on 10 Aug 2019

Sophos SG UTM - SSL VPN configuration change need to request client to download an installation file to update the client configuration

Sophos SG UTM - SSL VPN configuration change need to request client to download an installation file to update the client configuration

Sophos SG UTM – SSL VPN

Sophos VPN change profile name

If you want to change the VPN profile name, go to “Program Files (x86)”\Sophos\Sophos SSL VPN Client\config, change those config file name

Sophos SG UTM – SSL VPN

Sophos XG Firewall rules - Proxy - Direct mode only

Create a new service “Proxy”

TCP

Source Port 1:65535

Destination Port 3128

UDP

Source Port 1:65535

Destination Port 3128

Reference:

https://community.sophos.com/kb/en-us/125585

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/94552/how-can-i-set-up-web-access-via-proxy-port-only

https://community.sophos.com/kb/en-us/122802

https://community.sophos.com/kb/en-us/123522

Sophos XG Firewall rules - Proxy - Direct mode only

Sophos XG firewall upload speed slow - workaround - set Intrusion Prevention (IPS) from LAN to WAN to None (On the LAN to WAN firewall rules)

Sophos XG firewall upload speed slow - workaround - set Intrusion Prevention (IPS) from LAN to WAN to None (On the LAN to WAN firewall rules)

Sophos XG firewall allow Google update

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/91948/google-play-store-blocked-by-ips

Sophos XG firewall allow Google update

Sophos XG Home firewall

Recommended hardware: 研凌n13 i3 7100 i5 7200u 3855U/3865u软路由主机lede小型工控机linux esxi迷你主机小电脑无线千兆网卡6口

https://m.intl.taobao.com/detail/detail.html?id=555831051793&spm=a21pv.7626635.1563.d0&main_itemid=556708160706&go_item_id=555831051793&scm=1007.11563.113736.&pvid=4e98c97a-493d-46b9-b4c5-e5eb78110eed

i3, 6GB RAM is good enough. (Remark: Home edition limited to 6GB RAM max)

Sophos UTM free edition is not good for home since it remove the web filtering features

If you use 2GB only, the memory usage will be very high (Tested on 17.1)

6GB memory usage will below 50%

It can block many attack at gateway level:

Performance also OK:

Sophos XG Home firewall

Sophos SG UTM and XG Firewall

Astaro Security Gateway has been renamed Sophos UTM (Sophos SG)
Cyberoam become Sophos XG

Microsoft Internet Security and Acceleration (ISA) server 2000, 2004, 2006 or a Microsoft Forefront Threat Management Gateway (TMG) server 2010 EOL, one of the option are using Sophos SG UTM as a replacement.

Sophos SG UTM – Traditional Firewall comes with full coverage security function.

Sophos XG – Next Generation Firewall (NGFW) comes with full coverage security function PLUS heart-beat function, heat beat means firewall can be communicates with Client PC to stop threat exposure.

UTM: Unified Threat Management

NGFW: Next Generation Firewall

Sophos SG UTM and XG Firewall

Allow Microsoft Windows Update (Windows 10) pass-thru Sophos XG Firewall proxy (SFOS 17.1)

Add the following exclusion URL under Microsoft Windows Updates exception list:

^([A-Za-z0-9.-]*\.)?tlu.dl.delivery.mp.microsoft\.com/

^([A-Za-z0-9.-]*\.)?au.windowsupdate\.com/

^([A-Za-z0-9.-]*\.)? download.windowsupdate\.com/

Reference:

https://docs.microsoft.com/en-us/windows/deployment/update/windows-update-troubleshooting

Allow Microsoft Windows Update (Windows 10) pass-thru Sophos XG Firewall proxy (SFOS 17.1)

Allow Kaspersky Update pass-thru Sophos XG Firewall proxy (SFOS 17.1)

Add the exceptions policy, ^([A-Za-z0-9.-]*\.)?geo.kaspersky\.com/

Reference:

https://support.kaspersky.com/6105

Allow Kaspersky Update pass-thru Sophos XG Firewall proxy (SFOS 17.1)

Create firewall service for proxy only on Sophos XG Firewall (SFOS 17.1)

You need to Add TCP and UDP from ALL Source Port to Destination Port which is your proxy server for connect

Create firewall service for proxy only on Sophos XG Firewall (SFOS 17.1)

Sophos XG - SFOS 17.1.4 MR4 Released

If you are running on 17.1.3 MR3, please upgrade asap.

It fix many connectivity issues via proxy such as Windows 10 update failed, Kaspersky update failed…..

Since it just released, you need to download it manually.

https://community.sophos.com/products/xg-firewall/b/xg-blog/posts/sfos-17-1-4-mr4-released

Reference:

https://community.sophos.com/kb/en-us/132229 

https://community.sophos.com/kb/en-us/123285

Sophos XG - SFOS 17.1.4 MR4 Released

Sophos SSL VPN client change profile name

1. Go to C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\config

2. Change the file name of the profile

Sophos SSL VPN client change profile name