Sophos Firewall Overview 19.0v1

Sophos Firewall Version 19.0v1

• Sophos Firewall version is 19.0v1
• Copyright is held by Sophos Limited, 2022
• No part of the document can be used without prior written consent from Sophos

Additional Information

• Sophos Firewall FW2010
• Advanced Firewall Rule Management on Sophos Firewall
• Version: 19.0v1
• Released in April 2022

Firewall Framework

• Prerouting: Protocol anomaly checks and DOS & Spoof prevention performed on incoming packets to reassemble them
• Routing: Connection tracking to create/associate new connections or associate with existing ones (Related connections receive child entries for connection)
• Forwarding: Packet filtering based on firewall rules, if accepted then submitted to IPS
• Postrouting: Masquerading and SNAT policies are checked; connection tracking updated; if HA load balancing on, packet sent to load balancer; Quality of Service applied.

XStream Architecture

• High-performance, high connection-capacity support for modern cipher suites (TLS 1.3)
• Comprehensive threat protection using a single high-performance streaming DPI engine with proxy-less scanning
• Intelligent offloading of trusted traffic using the Network Flow FastPath for improved performance

Initial Connection

• Firewall Stack processes connection management, allowance, blocking, and QoS (Quality of Service).
• DPI Engine handles streaming DPI processing, intelligent offloading, web filtering, and SSL policy and inspection.
• FastPath handles packets' forwarding and offloading of L2 & L3 to DPI Engine.

Full FastPath Offload

• Firewall Stack handles connection management and QoS (Quality of Service).
• DPI Engine handles streaming DPI processing, intelligent offloading, and policy and inspection.
• FastPath handles forwarding packets, offloading L2 & L3 to DPI Engine.
• Once a connection is allowed, it can be offloaded to FastPath, accelerating wire speed.
• If the data looked at by packet filtering always remains identical for the connection, it can be marked and the process skipped.

Initial Packet Delivery to DPI Engine

• Firewall Stack does connection management, allowance, blocking, and QoS (Quality of Service).
• DPI Engine handles streaming DPI processing, intelligent offloading, web filtering, and SSL policy and inspection.
• FastPath handles forwarding packets and offloading L2 & L3 to DPI Engine
• Traffic needing DPI engine scanning goes through the firewall stack then to the DPI Engine and returns to stack for delivery.

Firewall Offload

• Firewall Stack does connection management, allowance, blocking, and QoS (Quality of Service).
• DPI Engine handles streaming DPI processing, intelligent offloading, web filtering, and SSL policy and inspection.
• FastPath handles forwarding packets using L2 & L3 offloading to DPI Engine.
• Initial connection enables FastPath to offload to DPI Engine, cutting out firewall stack for improved performance.

FastPath Offloading

• Firewall does connection management, allowance, and blocking.
• DPI Engine handles TLS/SSL, application, IPS, and web (AV) scanning and Data Acquisition (DAQ).
• SlowPath handles DOS, VPN and Firewall (FW) actions.
• Firewalls see both directions, classifies, and offloads decisions to FastPath ensuring it is safe and trustworthy.
• Offloaded decisions can be cached allowing for application to the traffic without using SlowPath.
• FastPath delivers subsequent traffic to DPI Engine through zero-copy which helps in the speed to ensure efficient traffic management.

Virtual FastPath vs. Network Flow FastPath

• Virtual FastPath (VFP) uses CPU to process connections.
• Network Flow FastPath (NFP) uses a separate Xstream Flow Processor to handle traffic that is offloaded to the FastPath.

XGS Series FastPath Flow

• Initial packets of a connection go through SlowPath and sometimes IPS
• SlowPath gathers info, programs FastPath with state information using API
• Packets then flow through FastPath, bypassing SlowPath but still going through IPS
• IPS updates connection verdict in SlowPath to update FastPath
• Packets now fully flow through the FastPath

Checking FastPath Offload

• The system firewall-acceleration show command can be used on an XGS device to check if FastPath acceleration is enabled.
• The usfp_table_print.sh worker_sys_cnt command shows the number of packets offloaded using FastPath.
• To verify a connection's usage of FastPath, use the conntrack command in the advanced shell; if it had a connection FastPath ID it used FastPath; otherwise, it says “NOT_OFFLOADED”.

Improving FastPath Usage with Policy

• Traffic matching firewall rules with no DPI processes or IPS/SophosLabs offload signatures can be offloaded straight into FastPath.
• Traffic with an IPS policy set to "bypass session" can also be offloaded to FastPath.

Scenario 1 - Introduction

• Small business setup
• The default firewall rules will be used; however updates are needed to the rules to improve functionality

Scenario 1 - Rules

• Rule for allowing web access for employees that will use a custom IPS and Web Policy.
• Rule to allow servers and hardware that cannot authenticate against the Firewall.
• Rule for guests to access the internet.

Scenario 2 - Introduction

• Multiple VLANs; security, compliance
• Focus on efficient traffic shaping
• Rules include: guest internet access, FTP with QoS, P2P traffic block, and employee web browsing.
• Adding rule for server access, server updates, WAN-DMZ access, and LAN-DMZ access.

Scenario 2 - Rules

• More rules in a larger network
• Additional rules will be needed for VLANs requiring access
• Rules will be further down the list

Explore the features and framework of Sophos Firewall version 19.0v1. This quiz covers advanced firewall rule management, prerouting, routing, forwarding, and postrouting functionalities. Test your knowledge on the XStream architecture and its high-performance capabilities.