XG Firewall

Suggest, discuss, and vote on new ideas for Sophos XG Firewall. The next thing in next-gen.

XG Firewall

Suggest, discuss, and vote on new ideas for Sophos XG Firewall. The next thing in next-gen.

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback
  1. Customise WebServer Protection Block Page Messages

    Currently, the ability to customise the Webserver Protection block page messages is not present.

    When the WAF (Web application Firewall) blocks a page, it returns 'page cannot be display'. This should be customisable.

    The AntiVirus engine on the WAF should also be customisable on the block page returned.

    5 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  2. ModSecurity version 2.X.X to version 3.X.X

    The latest version sof ModSecurity WAF rules are in version 3.X.X. Is there a plan to get these added to webserver protection, since they produce less false positives and perform better than the 2.x.x rules.

    5 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  3. Changing WAF configuration without forcing a service restart

    Hi,
    Currently when we make a change to any web server or any one waf firewall rule, the impact is that the whole service reboots and causes a drop in connection for all the WAF services running.
    This should not be the case. only the rule that is being edited should be affected and not all the services.
    This is also how its done in MS TMD

    5 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  4. Disable trace http in GUI.

    Currently disabling trace http is only possible using the Advance Shell using some commands. Please make this option possible in the GUI.

    5 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    3 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  5. RSA SecurID authentication support for published Web Servers

    Alot of customers use RSA SecuID tokens to authenticate published web apps. This feature is important wrt Web Server Protection as other products like Barracuda WAF takes the advantage.

    4 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  6. "rewrite html"

    As suggested by the support I add the suggestion associated with ticket #7420116 here as well.

    Please consider supplementing manuals for your products that include HTTP/Web proxies. The "Rewrite HTML" option causes not only HTML rewriting but also HTTP headers rewriting based on the head section <meta/> tags with the http-equiv attribute. The headers rewriting functionality seems to be undocumented.

    Please note that such an unconditional rewriting causes problems for web pages that have a construct like the following:

    &lt;head&gt;&lt;noscript&gt;&lt;meta http-equiv=&quot;refresh&quot;…&gt;&lt;/noscript&gt;&lt;/head&gt;
    

    Adding a HTTP header based on such a construct causes a site to malfunction because it redirects the client…

    4 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  7. Microsoft sstp vpn pass through WAF rule

    At the moment, it is not possible to publish Microsoft SSTP server through WAF rule. Traffic is blocked at the Proxy module level. It would be good if this module were told about SSTP.

    3 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  8. FTP server Anti-Virus scanning like WAF

    DNAT/NAT/Load balancing rule or WAF should have FTP server option. So that any files uploaded or downloaded from FTP server in any secured ZONE like LAN or DMZ should be protected. Cyberoam has such facility but it is lacking on SOPHOS. If FTP client upload ransomware or virus than it will blow up the secure network. it is security loop hole.

    3 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  9. Send modsecurity rule hits over syslog

    For XG syslog, Web Server Protection Events only sends request information. If a request is matched against a Modsecurity rule from the common threats filter, this entry is not sent over via syslog, but it is logged locally in /log/reverseproxy.log. It's common industry practice to implement Modsecurity in monitor mode first in order to root out any false positives that could negatively effect the application. Not sending these rule hits makes it much more difficult to gather statistics. This is especially difficult if there are multiple deployments that need to be monitored. Having the entire reverseproxy.log streamed via syslog would…

    3 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  10. Dynamic (Automatic) Certificates on Web Server Protection

    Currently under WebServer Protection, you are required to setup an SSL Certificate for each Web Server that you are trying to protect. In a web hosting environment this is not plausible or even practical.

    Use Case Scenario:


    • CPanel Web Hosting server could potentially be hosting 100's or 1000's of Web Sites.

    • It is best practice to SSLize Websites. Using standard http is no longer desirable, and it's easier than ever now to automate SSL certificates on websites hosted with CPanel (See next point)

    • CPanel provides automatic SSL certificate deployment from Comodo Secure to any website you want using their AutoSSL…
    3 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  11. Ability to use non standard port for configuring web server under XG

    Hello Team,

    We have customer here requesting to use a non standard port (other than port 80 and 443) for configuring web server under XG. For your assistance please. Thank You.

    2 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  12. OTP MFA on inbound port forwarding rule

    The world is asking for more than passwords for OWA and RDS Gateway inbound. Please consider adding OTP so the Sophos Authenticator can support the second factor. So, the RDP Connection Client will https to the RDS Gateway that is behind the XG rule. Something will pop up and ask for a "User Portal"-like authentication before the RDP client hits the gateway. Similarly, the same will happen before the browser hits the OWA page.

    2 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  13. WAF possibility to edit SecRequestBodyNoFilesLimit value

    In the WAF configuration is impossible to edit the SecRequestBodyNoFilesLimit instruction.
    If an user upload a file greater than 1 Mb receives the error
    Request body no files data length is larger than the configured limit - 413 Request entity too large

    2 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  14. We are not able to see the actual public IPs which are accessing the Web Server behind WAF , we need this feature for many reasons

    We are not able to see the actual public IPs which are accessing the Web Server behind WAF , we need this feature for many reasons like forensics and statistics.

    2 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  15. Allow use of IP Lists and other network host objects in Allowed/Blocked list for Web Server protection

    Hello Team,

    We have customer here requesting to have IP List to be configure under Allowed /Blocked client networks under Access Permission on WAF Business Application Firewall Rule.

    For your assistance please. Thank You.

    2 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  16. Webserver Protection Password Validation for Forms template.

    Webserver Protection forms authentication do not have any kind of validation for wrong username or password. IF a user types in incorrect credentials there is not notification why, just reloads page. This product is not ready for production without it. Even the Hotspot login page have customization for errors. https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/LoginPageTemplate.html

    2 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  17. WAF - Increase Page Timeout

    We would like it to be possible to increase the timeout period in for underlying web servers. In some specific requirements, web pages will take longer than 60 seconds to load - thus exceeding the hard-coded timeout of the Sophos XG.

    Please allow us to increase this timeout manually.

    2 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  18. Redirect HTTP to HTTPS on the same non-standard port

    WAF redirect custom port http automatically to https.

    it can not forward automatically when uses custom port. Example: listening port : 8080 with url: www.example.com and redirect HTTP and HTTPS (tick). User from internet request type url: http://www.example.com:8080. It will not automatic redirect https://www.example.com:8080. It shown " Your browser sent a request that this server could not understand Reason: You're speaking plain HTTP to an SSL-enabled server port.
    Instead use the HTTPS scheme to access this URL, please." It is only work for port 80 redirect to https instead of custom port (based on Sophos Support Team). User…

    2 votes
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  19. Allow "IP Range" on “Access Permission”

    If you do “Add new item” on “Access Permission” then it does not show any IP host that are configured as “IP range” for example I wish to add host “IP-Group-1” which is there and shows correctly when you look in IP host section. But it allows you to create a new range at that point but not use existing. I think this is more of a bug than a request but support told me to log it here.

    1 vote
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    0 comments  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  20. XG Log Viewer for WAF needs major improvement

    We use XG for Web Server protection. The log viewer is really poor and I strongly believe does not provide a reasonable way to see clearly the traffic which is passing and traffic which is failing.
    I have raised #839149 in October 18. Despite responding that I need more information, all I get is :

    "this behavior is already logged with DEV under ID NC-43502. There are certain messages that will be colored red in the log viewer, typically ones that originate from WAF itself, like a block action by CTF or AV. To see the detailed WAF Logs, u…

    1 vote
    Sign in
    (thinking…)
    Sign in with: Facebook Google Sophos ID New Sophos ID Test Sophos ID
    Signed in as (Sign out)

    We’ll send you updates on this idea

    1 comment  ·  Webserver Protection  ·  Flag idea as inappropriate…  ·  Admin →
  • Don't see your idea?

Feedback and Knowledge Base

icon-data-protection icon-endpoint-protection icon-phish-threat icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-mobile icon-sophos-utm icon-sophos-utm icon-sophos-utm icon-web-appliance icon-xg-firewall icon-xg-firewall icon-avid-secure icon-lightbulbCreated with Sketch.