XG Firewall

Suggest, discuss, and vote on new ideas for Sophos XG Firewall. The next thing in next-gen.

XG Firewall

Suggest, discuss, and vote on new ideas for Sophos XG Firewall. The next thing in next-gen.

Suggest an Idea...

(thinking…)

Enter your idea and we'll search to see if someone has already suggested it.

If a similar idea already exists, you can support and comment on it.

If it doesn't exist, you can post your idea so others can support it.

Enter your idea and we'll search to see if someone has already suggested it.

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. IPsec Load Balancing

    IPSEC Site to Site Load Balancing. This is for me must have option. UTM had it and I dont know why there is no Load Balancing on XG.

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  VPN and RED  ·  Flag idea as inappropriate…  ·  Admin →
  2. IPsec Load Balancing

    IPSEC Site to Site Load Balancing. This is for me must have option. UTM had it and I dont know why there is no Load Balancing on XG.

    0 votes
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  VPN and RED  ·  Flag idea as inappropriate…  ·  Admin →
  3. SFM: Add CCL Notifications

    In SFM, a notification for when a CCL entry is created would be ideal for Change Management. Upon receiving this notification from SFM, other administrators can look back over the CCL entry and bring up potential problems for reversion as necessary when they get an alert from SFM that a firewall's configuration was changed.

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Base System + General UI  ·  Flag idea as inappropriate…  ·  Admin →
  4. Adding AI to Sophos Firewall

    The Feature of machine learning/Artificial Intelligence ==> Detecting any blacklisted IP and automatically making a firewall rule for the IP with the action drop/reject

    this will take off the engineer load and protect the enviroment.

    It will an advantage for your appliacne and will become more recommeded.

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Web Protection  ·  Flag idea as inappropriate…  ·  Admin →
  5. Allow resizing UI

    Currently, no matter how big the browser window is, certain screens such as the "Firewall" screen which have tables with a lot of information on them don't resize themselves to fit the browser window beyond a certain size. This leads to information in many of the columns being cut off and a bunch of unused screen space. If screens such as "Firewall" did resize their table to take up as much of the empty screen space as possible in the browser window, it would make this information MUCH easier to look at.

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Base System + General UI  ·  Flag idea as inappropriate…  ·  Admin →
  6. STAS is broken by Windows remote desktop

    We stumbled across a bug in Sophos Transparent Authentication Suite (STAS) running on a Windows domain controller which is used to resolve user identification and permissions. When you open a remote desktop session to another Windows computer on the lan, your machines ip address becomes associated with the login credentials you used for the remote session instead of your own credentials. From that point on the firewall believes all traffic from your pc is coming from that user instead of you. Closing the remote session will not fix it. Only relogging in to your machine will get your ip back…

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Base System + General UI  ·  Flag idea as inappropriate…  ·  Admin →
  7. File extensions mime headers

    At the moment files who match File extensions, or MIME headers are be blocked, or broke the downloaded file. It would be nice if there is a option, that only blockes files if extension and MIME Headers match.

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Web Protection  ·  Flag idea as inappropriate…  ·  Admin →
  8. Wants to add 2 email id at System - Administration - Notification - Send Notifications to Email Address

    Wants to add 2 email id at System - Administration - Notification - Send Notifications to Email Address

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Base System + General UI  ·  Flag idea as inappropriate…  ·  Admin →
  9. Be able to open multiple tabs/windows

    Currently I can only have one browser/tab open to the admin portal which makes it difficult to move around different pages especially when trying to compare settings from one rule to another or an IPS that is applied to the firewall rule. It would be helpful to be able to right click and open in a new tab/window all links on the admin portal.

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Base System + General UI  ·  Flag idea as inappropriate…  ·  Admin →
  10. Alphabetize IPS/Application/Traffic shapping rules in the firewall rules

    When looking for a IPS/Application/Traffic in the firewall rules and other pages they are not alphabetized. If I want a rule to be showing at the top of the list I should be able to put a special character like a # and it will always be at the top.

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Base System + General UI  ·  Flag idea as inappropriate…  ·  Admin →
  11. IPSec with IP Range and List Type

    Establishing an IPSec between two XG devices and adding IP or Network is fine. But try adding an IP Range or a IP List. You are able to create it (and can see it later in Hosts and Services) but there is no way to choose it as a local or remote address type.

    This is quite confusing and shouldn't be there in the first place if it serves no purpose.

    Cheers.

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  VPN and RED  ·  Flag idea as inappropriate…  ·  Admin →
  12. Improve high availability logging

    At the moment it is not possible to see if the the initial syncing proces is finished and the auxiliary device is ready the become the master. Please give us a log where this is visible.

    Most needed when testing the HA function on-site. We restart node 1 und see if node 2 takes over. After that, node 1 comes back on and we need to see when we can restart node 2.

    20 votes
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Base System + General UI  ·  Flag idea as inappropriate…  ·  Admin →
  13. Reorder rules in SCFM Template

    In a template in Sophos Central Firewall Manager, it's currently impossible to reorder rules (neither create a new rule between two existing rules).
    It's supposed that this is a basic functionality of a firewall managing system.

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Base System + General UI  ·  Flag idea as inappropriate…  ·  Admin →
  14. SSL VPN portal user log on Windows: username and password remembering and Auto logon check box are not in the sophos. we need it.

    SSL VPN portal user log on Windows: username and password remembering and Auto logon check box are not in the sophos. we need it.

    2 votes
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  VPN and RED  ·  Flag idea as inappropriate…  ·  Admin →
  15. Hairpining

    Can automatic NAT hairpining be built into SFOS automatically like it is in UTM? Very frustrating to have to create hairpin rules in order to access published servers from behind the same XG firewall. The best solution I've found to date is to set the source zone as "any" on the business rule governing the DNAT for the published service, however, that masks the true source IP address for any device on the outside accessing that published service because the firewall translates the source to it's own IP address. That makes it impossible to filter and restrict access to some…

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Network Protection  ·  Flag idea as inappropriate…  ·  Admin →
  16. Advanced Threat protection reolve bad urls to Sophos IP Address

    Palo Alto has a wonderful feature called DNS Sinkholing( https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/threat-prevention/dns-sinkholing#) where infected machines on the inside network that send dns requests external for malicous urls can be easily identified. This is achieved by resolving bad urls to a Sophos Public IP address and then every internal machine trying to access this IP is known to be infected with malware. Currently with Advanced Threat protection we can only see these DNS requests from the internal DNS server and not the end device which makes tracking down infected machines a much greater task.

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Application Detection Requests  ·  Flag idea as inappropriate…  ·  Admin →
  17. You tube Safe search exclusion

    Create an exclusion list for the safe search you tube videos so that it does not have to be an all or nothing approach.

    2 votes
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Web Protection  ·  Flag idea as inappropriate…  ·  Admin →
  18. DHCP for IPSec, SSL-VPN static IP for user, capacity for adding more lease ranges or duplicate settigs for SSL VPN

    DHCP for IPSec,
    SSL-VPN static IP for user,
    capacity for adding more lease ranges or duplicate settigs for SSL VPN

    2 votes
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Network Protection  ·  Flag idea as inappropriate…  ·  Admin →
  19. FAILOVER - Time for the primary link be the main link again after getting down

    In case we have automatic failover set and the primary link gets down, Sophos XG would change routes to the secundary link. So far all good. However, sometimes this main link is still facing problems and will get down again very soon. This instability will cause problems to the users.

    It would be good to have an option to set the time the primary link would become the main link again after it gets down. For example, only after 5 minutes the main link being up it would replace the secundary link.

    1 vote
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Network Protection  ·  Flag idea as inappropriate…  ·  Admin →
  20. Hotspot Portal listen on RED Interface.

    Problem is that it is not possible to choose a RED Interface within a Hotspot Definition.
    So you cannot route a client from a branch office to a Hotspot Portal to authenticate. We have a guest Network in a branch office in an own vlan behind a RED50. I thought that the utm and xg Firewall have feature parity on RED and Wireless Feature... NO they dont have!

    9 votes
    Sign in
    (thinking…)
    Sign in with: sso facebook google
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Wireless Protection  ·  Flag idea as inappropriate…  ·  Admin →
← Previous 1 3 4 5 92 93
  • Don't see your idea?

Feedback and Knowledge Base

icon-data-protection icon-endpoint-protection icon-phish-threat icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-mobile icon-sophos-utm icon-sophos-utm icon-sophos-utm icon-web-appliance icon-xg-firewall icon-xg-firewall icon-avid-secure icon-lightbulbCreated with Sketch.