Advanced Sophos Firewall IPS Configuration

Advanced Sophos Firewall IPS Configuration

• Sophos Firewall version 1.0v1, FW2510 configuration
• Document version 19.0v1, April 2022
• Copyright 2022 Sophos Limited
• All rights reserved. No part of the document can be used or reproduced without prior written consent of Sophos.
• Sophos and the Sophos logo are registered trademarks of Sophos Limited.
• Other names, logos, and marks mentioned may be trademarks or registered trademarks.
• Sophos makes no warranties, conditions, or representations, express or implied.
• The document is subject to change at any time without notice.
• Sophos Limited registered in England, company number 2096520.
• Registered office: The Pentagon, Abingdon Science Park, Abingdon, Oxfordshire, OX14 3YP.

Intrusion Prevention System (IPS)

• IPS is a module that examines traffic passing through a Sophos Firewall for malicious content.
• It blocks malicious content and logs events.
• IPS can examine WAN to LAN, LAN to DMZ, DMZ to LAN, LAN to LAN and VPN traffic.
• Default policies are included for common network attacks.
• Custom policies can be created for specific scenarios or to meet compliance requirements.

FastPath Offloading

• IPS is a fundamental component of the DPI (Deep Packet Inspection) engine.
• Offloads trustworthy traffic from further examination.
• Offloading happens when the application is identified, no files to scan by AV, and the flow deemed trustworthy.
• The FastPath engine reduces the number of modules in use, saving resources.

Configuring IPS

• IPS can inspect any traffic through the Sophos Firewall.
• For optimal performance, select the inspected traffic.
• Default policies include a broad ruleset.
• Custom policies based on inspected traffic improve performance.
• Consider whether you need to inspect traffic, and create specific firewall rules for that traffic.
• Default policies are very general. Create a ruleset appropriate for the inspected traffic.

Fine Tuning IPS Policies

• The IPS Policy editor allows easy selection of desired patterns to create efficient policies effectively.
• Keep policies current to save CPU and memory.
• Three types of IPS policy rules can be created:
  • Predefined criteria filtering.
  • Text-based smart filters.
  • Selecting specific signatures.
• The IPS policy editor dynamically updates to reflect new signatures.

Strict Policy

• A set of protection policies enabled by default.
• It checks for common attacks, drops specific traffic and attacks (like WinNuke, Land, or Zero IP Protocol).
• If false positives are detected, the strict policy can be disabled.
• Individual components of the strict policy cannot be enabled or disabled.

Chapter Review

• Default IPS policies are designed for a broad range of scenarios but might not be optimized.
• Each firewall rule should have a custom IPS policy specific to that rule's traffic.
• When creating a new policy, existing policies can be cloned for efficiency.

This quiz delves into the advanced configurations of the Sophos Firewall, focusing particularly on the Intrusion Prevention System (IPS). Understand how IPS examines and blocks malicious content across various network zones. Test your knowledge and mastery of Sophos Firewall version 1.0v1 configurations.