XG Firewall
Suggest, discuss, and vote on new ideas for Sophos XG Firewall. The next thing in next-gen.
-
Category based surfing quota
We have a request about surfing quota based on a specific category or categories. Right now, this is fuction is available for the general internet but not for a specific category. For instance, we need to restrict the users for accessing to social network websites about an hour a day. After they fill one hour allowance to social networking sites, they will not be able to reach to social networking but they will be able to use their usual internet usage.
This function is available for other firewall brands and it is really necessary for some customers. I hope you…29 votesUnder Review ·
AdminRich Baldry
(Product Owner, Web Protection, Sophos Features & Ideas Laboratory)
responded
We are considering this for an upcoming release. More info to follow.
-
Let's Encrypt Integration
It would be very nice if Let's Encrypt certificates (letsencrypt.org) can be generated directly from the XG Gui. So that the "Let's Encrypt Client" is integrated in the XG. Would it be possible?
Best Regards548 votesWe’re considering this
-
HA like UTM
Clustering UTM is very easy. Now you have to assing an IP to the ***** XG and create the cluster. UTM clustering technology is the simplest one I never seen. The other thing is the DMZ zone to be used when you need to create the cluster. A dedicated zone should be available (maybe HA?). Also a second interface is missing as an alternate interface.
144 votesAgree UTM9 HA setup is the easiest in the industry, and we are planning to bring that same simplicity to XG in a future version.
-
Username of Admin should be chagable
Currently, the WebAdmin Master-User is fix named as admin. It would be great, if we would have the possibility to change the username. This would be an improvement for brute-force attacks, when the WebGUI is somehow published to the Internet.
303 votesThis is being considered. The current intention is to add a superadmin role, making the default admin account just a member of that role.
This will allow you to create new superadmin accounts, capable of logging into the shell, adding ssh keys, and any other features limited currently to the named admin account.
Second, you will be able to disable or demote the named admin account.
-
Change SSL VPN Port
Right now it is not possible to change the SSL VPN Port by GUI. Port 8443 is used by default. Please add the possibility to change, because Port 8443 is not allowed in many networks.
410 votesThis feature is a high priority to include after v17 is released, though that release is not yet committed.
-
Multiple upstream web proxies
When will the ability to define multiple upstream web proxies currently in UTM 9 be available in the XG Firewall?
31 votesUnder Review ·AdminRich Baldry
(Product Owner, Web Protection, Sophos Features & Ideas Laboratory)
responded
We are considering this feature for an upcoming release. Watch this space.
-
Bring back Web Filter override for specific AD groups
In Sophos UTM there was an option to allow specific user groups to override a URL block under Web Filtering. This was really useful for educational environments so our teachers could bypass unintentional blocks for kids. Please bring it back! :)
63 votesUnder Review ·AdminRich Baldry
(Product Owner, Web Protection, Sophos Features & Ideas Laboratory)
responded
Look out for a feature in an upcoming release that will allow nominated users to selectively allow users to bypass policy for specific sites. This will let teachers to set up lists of sites to allow for their students and give students an access code to be able to bypass block pages.
-
Can we have live Bandwidth speeds for Interfaces?
It would be great to be able to see live Bandwidth speed stats for each Interface like we had on UTM.
449 votesThis feature is under consideration for a future release in 2018, though a target version is not yet set.
-
XG as NTP Server
NTP Server is a small package and UTM9 has it. In some small organization, having a central NTP server is a nice feature.
Can you add it into future release?You can put it inside device access, denying WAN from using NTP server for security reason.
612 votesThis feature is under consideration for a future release, though a target version or timeframe is not yet set.
-
Allow Configuration of DHCP Options
UTM 9 had great DHCP options that you could assing globally or to an individual pool. For people with VoIP deployments this is Huge.
333 votesAdding DHCP options to the GUI is under consideration for a future release.
-
Firmware notification
XG looks like Sophos Standard. On Email Virtual Appliance, when I have a new pending firmware to install, I recieve an email saying that a new firmware is available to install and it will be installed at .... (I have automatic upgrade during the night). Inside the email, I have the link to release notes.
Please implement this feature to XG too.213 votesThis will be implemented in a future update.
-
default source port when adding new services to "1:65535"
Would be nice if the source port was already pre-populated like it was in UTM9
224 votesWe will implement this, but I don’t have a target version for it just yet.
-
Rename objects
Add support to rename Policy rules name, IPSEC and SSL VPN tunnels name, Webfilter Policy and Category objects, Application Policy and Category objects, QOS rules and all other items.
This will Improve the management, it must be default to all objects. Currently to fix a simple typo error, we must to create a new policy or category and populate all items again. A simple task can turn into a hard task.Best regards,
Carlos
253 votesThis will be implemented in a future release. It is being included as part of a larger project, to generally improve configuration capabilities across the product. Version for release is not yet confirmed.
-
Add support to USB NIC
At home USB NICs are ideal. Exactly the same problem we had in UTM9. Link below.
287 votesThis feature is under consideration for a future release, though a target version or timeframe is not yet set.
-
Enable/Disable Interface
At the moment, there is no way to disable/enable an interface inside SFOS.
Strange!Even using CLI menu.415 votesThis is a high priority feature, and will likely be targeted as soon as possible after v17 ships, though it is not yet committed to a release.
-
Sophos VPN app for mobile platforms
Sophos should develop an own VPN app for mobile operating systems (iOS / Android / Windows Phone) which can connect via the UTM using the configuration pushed from the UTM to the SMC server.
It should also support the Per-App-VPN feature which was introduced in iOS 7.275 votesThis feature is considered a high priority, and is under consideration for a future release, though a target version or timeframe is not yet set.
-
Native Microsoft Azure Site-to-Site VPN
Sophos UTM already natively supports automatic site-to-site VPN tunnels with BGP routing to AWS. I look forward to Sophos UTM supporting the same sort of site-to-site VPN tunnels with BGP to Microsoft Azure in public and private cloud deployments.
I think the easiest way for this to work would be for Sophos UTM to look at the requirements of getting the VPN itself setup (which has been documented in the forums and works), then to make BGP work on top of that, then ensure that BGP and the VPN can work between multiple private cloud and public cloud sites, then…
181 votesUnder Review ·
AdminJan Weber
(Product Manager, Network Security Group, Sophos Features & Ideas Laboratory)
responded
We will address this within XG Firewall in one of the upcoming releases.
-
Web Protection: Enforce policy on Sophos Endpoints
It would be amazing to configure the Sophos Endpoint (not the UTM-provided one) to inherit the Web Filtering policy defined in the UTM.
32 votesUnder Review ·AdminJan Weber
(Product Manager, Network Security Group, Sophos Features & Ideas Laboratory)
responded
Moved to XG forum for future tracking, will be reviewed as part of Synchronized Security.
- Don't see your idea?
