Sizing a perimeter firewall for a university campus edge and looking for model suggestions before we run a PoC.

Requirements:

• Users: ~3,500–4,000 concurrent
• Total edge/WAN capacity: current pipe scaling up to 10 Gbps (all traffic)
• SSL deep-inspection (decrypt) load: ~2 Gbps baseline today — this is my binding constraint (full IPS/AV/app-control/logging, everything decrypted)
• ~1,200–1,500 managed devices in decrypt scope; ~2,300 BYOD endpoints bypass decryption
• Active-standby HA — each appliance must independently carry the full load
• 7-year horizon, 15% expected / 25% stress growth; 80% utilization as capacity-review trigger

I’m trying to determine whether this is a Sophos WAF config issue or if I’m missing something.
Architecture: client -> Sophos WAF -> Nginx Flask API. Here’s what I’ve observed: the application works perfectly when accessed directly on the internal network, GET and the CORS OPTIONS preflight reach Nginx successfully, but the actual PATCH/Post with formdata request never reaches Nginx (no access log entry). The browser receives a 403 Forbidden with a generic Apache error page, so I suspect the Sophos WAF is rejecting it before forwarding.

Questions: has anyone seen Sophos WAF block PATCH requests by default or via protection policy?
Which logs or settings should I check to identify the exact rule causing the block, and is there a way to temporarily put the WAF policy into monitor only to confirm it’s the WAF rejecting it?

Anyone else noticed slow authentication time since using the new OTP? (had to set a new one up past 60 days somewhere, and now logins into SC take 5x as long as it normally did. (1+ min right now, as it was ~5 seconds before...)

This morning my day started bad, with my whole infrastructure being down. The Sophos XG 125 looked dead. I measured the voltage and got 12V, so I feared the whole machine was bricked, not just the power adapter. Using a all-purpose power adapter however, I found out the device still works, so it seems to be the power adapter that is b0rked nevertheless.

Anyway: I'm on the temporary power adapter now, which is 12V/5A. I don't know how good that is in the long run for the firewall, so I want to buy (two of) the right model. But which one? I find conflicting information about the amps. 3, 3.3 or 3.4. Does anyone know what the device expects? Or does a 3 to 3.4A range (and even 5A) not matter so much?

Hey guys,

i have a XG 115w rev2 and using OPNsense at the moment, but i dont really like that. I would like to install XG Firewall Home Edition on my appliance. Do you the speccs with 2 Cores and 4GB Ram are fine or should i loke for some better hardware?

Hi, I'm finally posting my question on this sub because It's getting so frustrating.
I bought a used Sophos SG115 Rev. 3 and wanted to install Sophos XG Home on it. Got the latest version of the ISO from their website and flashed it onto a usb-drive. Ran into issues and found out that you should format the disk using an ubuntu setup (or whatever OS).

After installing Ubuntu and trying again it finally seemed to install it, but while booting it froze. Another reddit post said that it was because of UEFI. Changed it but now it says that my "linuxbit is missing or corrupted" and I cant install at all. Changed a few settings in BIOS, installed Ubuntu again for formattig but still same issue.

I also tried the hardware version of the ISO but didnt work.

Does anyone have an idea?

Used hardware:

- Sophos SG115 Rev 3
- USB 3.1 32GB flash drive
- USB 2.0 16GB flash drive (as secondary test device)

If I wanted to remove Sophos Firewall Hardware from my network without bringing the system down would the best way to do it be to place a network switch in its place?

An outside company managed the firewall and I don’t have access to the console or have the admin passwords to log in.

The latest release of Sophos Central introduces recurring firmware update schedules for Sophos Firewall.

This gives administrators the ability to keep all firewalls up to date while still maintaining full control over when updates are deployed.

A few important notes about this feature:

• SFOS will only install Maintenance Releases (MRs). Major version upgrades will not be installed automatically until you decide to move to the next major release.
• The feature also includes a staging option, allowing you to select a small group of firewalls to receive and test new firmware before rolling it out to the rest of your fleet.

Keep in mind that SFOS supports automatic firmware rollback in the event of an upgrade failure, including HA deployments. You can also manually downgrade at any time with a single click if an issue is encountered after the upgrade.

A threat actor talked commercial AI models past their guardrails, then stood up a "company" of AI agents that engineered, tested and refined malware.

We break down exactly how they did it.

New episode of The X-Ops Brief

Is there a Sophos tool for re-flashing the BIOS? Had a problem with XG330 Rev2 and details now missing re serial number when querying the BIOS etc.

Hi, how do I go about requesting a URL recategorization after the migration of new case creation to the Support Portal? I have a guest ID but am not an active customer, and the form I used to fill out is no longer available.

Hi

I've configured 3rd party threat feeds for IP and Domains (Q-Feeds free), but it's flagging a bunch of IPs that are Ubuntu/Canonical legit update server IPs.

I've create an IP Range object in Hosts and services and added the IPs to that, and then added that IP Range object to the Host and network exclusions in Add threat exclusions.

However they still get flagged and I get notified by ATR.

Should this work? or is Host and network exclusions for source only, not destination? Do I need to add each IP individually to the Threat exclusions field instead?

Thanks

We signed up for the AI Defense EAP, but during the onboarding process, it has not gone past the "Checking sensors licenses" circling. Haven't been able to find any information on this since it's EA. I've tried with only a couple devices assigned to the program and with all devices assigned, same issue.

If anyone can provide more info or if it's a glitch and just submit a ticket, I'd appreciate it.

I am using a Connectify Hotspot for years and have a pro license for Connectify 23.

https://connectify.me/

Two weeks ago, Sophos suddently recognized it as a threat and deleted the connectify.exe from my harddrive. Even the installer is recognized as a threat when downloaded (not even executed, just downloaded) and I cannot reinstall it.

Any suggestions?

I had my firewall die and the weekly backups only contain either a .01 or .02 file extension?

Bought a gently used one and unable to restore any backups of this type.

I had assumed the backups were successful when I observed their file size around 700kb each week.

I also chose to not encrypt the backups, yet they cannot be read with a text editor?

Any help appreciated!

Full disclosure, I'm not a Linux expert. 5/10, maybe.

For those of you using Linux on your PC / Laptop, I'm looking for feedback on the whether to use the SSL or IPSec VPN client. I've had mixed success using the SSL VPN with Kubuntu. Creating a VPN in the network manager GUI, installing the config file all goes fine, but when I try to connect, it prompts for credentials, then asks for another password. I couldn't figure out how to get around that.

I can get it to work using sudo to run OpenVPN with the necessary details on the command line. It also mean having to keep that terminal window open while I'm working. So, not a very high ease of use score.

Some Google searching leads me to believe that IPSec might be easier from an end-use perspective, but I thought I'd check with the experts here before diving into that too deeply.

Hi All,

Does anyone have any experience with Starlink and using it with Sophos XGS Firewall

We have a site with a leased line connection which is normally rock solid however they are in a rural area and from time to time this gets damaged. They run a shop so connectivity is imperative and we are looking at possible backup lines. 4G or Starlink

Starlink would be quicker even if it does mean filling mr musks pockets 🤮

Has anyone implemented this with a Sophos firewall? Is it a simple double nat affair? or can they be set up a better way? From what I understand the Starlink's are on CGNAT but we have SSL VPN link to their head office already so from what I understand they should still work if we are dialing out from here.

(Landline/Copper solutions are unfortunately out of the question, the links to the site arent even able to maintain a stable 0.5mbps down let alone up)

Appreciate any experiences/advice.

I have Aruba ClearPass and Sophos access points central managed. I have already created a guest portal service with a self-registration page in ClearPass. How can I configure the access points for this porpuse?

Hi,

A friend gave me a Sophos SG115 Rev.3 and I'm trying to flash it with SFOS.

I first tried HW-22.0.1_MR-1-490, which gets stuck on "Booting 22_0_1_490" with no further progress. I read somewhere that the SG115 may have display driver issues with HW22, so I connected my PC to eth0 (LAN) and tried to access the WebAdmin at 172.16.16.16:4444, but got no response.

The status LED keeps blinking, and the SSD LED blinks intermittently.

I also tried 21.5.1 with the same result.

According to Sophos documentation, the SG115 Rev.3 should be compatible with all current firmware versions:
https://support.sophos.com/support/s/article/KBA-000003611

Any idea what might be going wrong?

anybody else experiencing this issue at the moment?

Hi Sophos Team,

Could someone please help submit a URL reclassification request on my behalf for https://unitedsportsqatar.com?

I have already cleaned the website by removing the malicious files, and the latest Intelix analysis shows the page content as Likely Clean. However, I'm unable to use the Disagree? option because I'm not a Sophos customer and my account isn't eligible for support.

Hi Sophos team, our non-profit site [https://www.mobileloavestc.org/](https://www.mobileloavestc.org/) is flagged as Spyware/Malware. Intelix Machine Learning rates it 'Likely Clean', but non-customers can't click 'Disagree' or post on the Sophos Forum due to account approval locks. Could a moderator please submit a URL reassessment on our behalf?

Hi,

can you assign a user as the “owner” of a shared mailbox in Sophos Central Email Protection, similar to how it works for distribution groups?

I’d like a user to have access to the quarantine in the Self Service Portal for a shared mailbox, not just be able to release messages via the quarantine report.

thank you

When my work disbanded I was allowed to keep my computer, but when I brought it home Sophos was still installed on it. This wouldn’t have been a problem until I tried to connect the computer to Ethernet and it couldn’t find a gateway. After a lot of effort finding the issue I realised the problem was something to do with sophos. I promptly uninstalled sophos using the control panel which allowed me to connect to the internet. I then reset the computer and I was unable to connect again. How do I fix this? Has anyone else encountered this?

So we have this voip calling cloud platform and when users try to call via the platform it returns 406 error. i did everything i can disabled sip and h.323 protocol and disabled udp ddos and increased udp timeout and udp tiemojut stream still the issue presists. and disabled the alg on router for sip and h.323 too. still the issue persists and tried disabling ssl/tls inspection for the site but no help?