About Networking
Attached here is the hardware brochures for the Sophos SG R1, R2, R3, XG, and XGS firewall appliances.
Copyrights apply to the original copyright holders, simply mirrored here for educational / historical / archival purposes.
This document assumes that you have purchased (either new or second hand) a Sophos SG (or XG) hardware appliance and are looking to use the Sophos SG UTM 9, with the LCD front panel remaining functional, all on the free Home license (for home use of course).
Requirements:
You will need:
We’re going to freshly reinstall the UTM OS so you obtain a free 30-day trial license which will allow you to get the appliance up & running…
Burn the ISO to the blank DVD
Connect the USB DVD drive to the Sophos USB port and insert the disk
Power on and boot from the DVD
If your appliance has or will have more than 3.5GB RAM, always install the 64bit kernel when prompted.
When prompted to install all capabilities or only Open Source software, always choose to install all capabilities.
Go through and follow the steps to complete the installation. Once done, it will reboot and you want to make sure it boots from the internal disk – not the DVD.
Get to the point where the Sophos has booted from the internal drive with the freshly installed SG UTM OS
Connect your computer to the LAN interface, set a static IP address in the same range as the IP address displayed on the Sophos console screen, but don’t choose the same IP address as the Sophos on your PC.
Open a browser and point it to the https port 4444 of the Sophos IP, so if the IP address of the Sophos is 192.168.2.100, then in the browser, point to: https://192.168.2.100:4444/
Hint, the IP address was also set during the OS installation as seen here:
Set a hostname, organisation name, city, country, admin password and admin email address.
The organisation name, city, country, etc., are used to generate a self-signed certificate and nothing really beyond this.
Hint, a DNS resolved fully qualified host name makes life easier.
Once you’ve done, this the Sophos will log out, generate a new self-signed SSL certificate, and reload the admin page.
Your browser will kick up a small fuss about the SSL not being valid, proceed anyway
Login using admin as the user name and the password you just specified
You have the choice to Continue as a new setup or restore from backup.
Choose to setup as a new appliance (select Continue), as there are a couple of caveats when restoring from backup
Next screen is important, its where you would normally upload to install your license – BUT DON’T – instead, just click next to use a 30 day trial license.
At the next screen, you can confirm or change the LAN IP of the appliance, and also enable & configure a DHCP server on this interface.
Next it will want you to configure the WAN interface
Then it will ask about the services to enable & configure – leave this as defaults and click Next
Once you get through the basic setup screens, click Finish and you’ll be at the management home screen
Either using the connected console (keyboard & display) or SSH from Putty or Terminal, login to the Sophos using the account: loginuser
If you changed the port number above, then use that when connecting in via SSH.
Once logged in, you’re about to do something often frowned upon:
sudo sh
Enter the root password
Now enter the following commands:
rename /etc/asg /etc/asx mv /etc/asg /etc/asx vi /etc/asx
Take note of the contents of this file – you’re looking to note down these three lines:
ASG_VERSION= LCD4LINUX_HW= ASG_SUBTYPE=
Exit VI.
Now create a new file: /etc/asg
vi /etc/asg
Add in the following (again setting the appliance model & revision appropriately noted down before), in my case:
ASG_VERSION="310" LCD4LINUX_HW="LCD-SERIAL380" ASG_SUBTYPE="r2"
Save, exit, and reboot the appliance.
Now that the above has all been completed, the LCD should still be reflecting current stats (confirm this by monitoring the CPU & RAM usage changes on LCD and comparing them to the management screen in the web UI), we can go ahead and change out the 30-day trial license for the free Home edition license.
Why Sophos locked down the hardware appliances from home license use is a little bizarre and annoying, but the fact that these R1 and R2 appliances are making their way onto the second hand market in giant waves, means that people will snap them up for home use, hit the license restriction, and decide to wipe them & install alternate firewall OSes on them, like pfSense / OPNsense, etc. Really, this is a set back in two ways: 1) Sophos are encouraging eWaste by not permitting home user licenses to re-use old enterprise hardware, and 2) they cause would be home users or enthusiasts to shy away from the Sophos SG/UTM firewall product as they can’t use it on the actual hardware appliance, so they opt for alternatives. /rant
Download your home license file from your myutm.sophos.com account, and upload this into the Sophos in Management > Licensing > Installation
The Home license will activate many useful features for basic and advanced home labs, and will need to be renewed every (I believe) 2-3 years
.
Something to note, Sophos SG UTM Home License edition has a user device limit of 50 issued IP addresses that are allowed to traverse the firewall. For many home environments with small families, this is probably substantial. There’s also a 10% tolerance on this 50 IP limit, so realistically, 55 devices.
However, larger families, where each family member has at lease 2-3 internet connected devices (say phone, tablet, and laptop), plus a few TVs, game consoles, WiFi access points, etc, you’ll soon run out of IP addresses very quickly. My home is in this larger category, there are currently seven of us living here, multiple “cloud-managed” switches, access points &and security cameras, two Xbox consoles, three Apple TVs, every person has at least three devices, and we are well over our limit. On top of this, I have a home IT lab with over 20 virtual machines, two physical servers, and additional workstations & laptops (all for lab / test use). I have NEVER had this pose an issue – every device is still able to connect to the internet, despite having well over 100 IPs assigned. I’m not sure why this is the case for me – maybe because there are VLANs in place???
At the end of the day, what Sophos offer out of the box for a free three-year home license is a very generous offering. It would be nice if there was a home-premium style license, where you retained all the same features, but the IP limit was lifted to either 500 or unlimited, and you paid something like US$100 every three years.
What some users out there with Sophos UTM have done to overcome this is to have a second basic router behind the main Sophos – all WiFi devices and family devices would sit behind this second router – leaving only essential systems behind the Sophos. I also initially had my network setup like this, but found it was unnecessary (in my case).
Final note: the free home license also provides high availability (HA) so if you have more than one hardware firewall running UTM9, you can set them up in HA which is really handy for installing firmware updates with zero downtime! Again, something I have working in my home environment.
This post briefly describes the process to enable & configure the Let’s Encrypt SSL Certificate certbot functionality built into the Sophos SG / UTM firewall.
If you have Country Blocking enabled & configured in the firewall, you will need to add some exclusions for Let’s Encrypt services to pass through
There will need to be three exclusions added for Let’s Encrypt services:
First exclusion will be setup with:
The next exclusion:
The final country blocking exception:
Finally, ensure all three new rules are switched on.
Now we need to configure & enable the Let’s Encrypt certbot built into Sophos UTM.
Head to Webserver Protection > Certificate Management
Click on the Advanced tab
Ensure the four fields in the Regerate Signing CA box are filled in and click Apply
Click to place a check in the Allow Let’s Encrypt certificates checkbox and click Apply
This process will take a minute or two as the account is setup with Let’s Encrypt…
Click the Advanced tab a couple of times until the status changes from:
to:
Now for each certificate you want to create with Let’s Encrypt, you will need to ensure that the FQDN is pointing to the public IP address of the Sophos WAN connection, as this is how the certificates are validated & authorised by LE’s servers and the Sophos certbot.
Once this is done, click on the Certificates tab
Click on the New Certificate button
Change the method from Generate to Let’s Encrypt
This process can take 2-5 mins. Click the Certificates tab to refresh to get the status of the certificate.
Once the certificate is green and has a valid expiry date, that certificate can now be used for services as required (such as WebAdmin, User Portal, or services in the Webserver Protection).
If you get an error regarding Let’s Encrypt failed to retrieve the current terms of service link, then there are a couple of possibilities:
Ensure you’re running the latest or very recent build of the UTM – update if not
Check the Certificate Authorities tab for anything expired, invalid, etc. and remove them.
Delete the ISRG X1-Root CA (so that only the current R3 certificate is present).
Temporarily turn off country blocking
Ensure DNS resolution on the Sophos is working
Ensure that port 80 isn’t blocked by something else – especially in a double NAT scenario
Enable the SSH access, and execute:
/var/mdw/scripts/httpproxy restart
It is intended for environments where the printer is connected to the network, has either a fixed LAN IP address or a DHCP reservation, and is accessible by the target Windows systems. It is assumed that the printer has been freshly setup on the network but not yet installed or configured on any target workstation or servers.
Identify and download the correct drivers for your make & model of printer. Ideally, you want to download the basic / standard drivers and not the full driver package installers. The ideal drivers may be identified as PCL, PS (PostScript), or WHQL drivers.
Typically, there will be multiple drivers – a listed set of drivers for multiple versions of Windows. Typically, most manufacturers will have the exact same driver files that cover many generations of Windows – eg: a driver written for Windows 7 will almost always work on Windows 10, or Server 2019, and Server 2008 R2.
Typically, the only differences in the drivers are:
You need to be aware of what communication protocol is supported by the printer. By default, FujiXerox DocuCentre machines don’t support PostScript (PS) out of the box, and require installation of additional optional hardware. If you’re looking to set one of these machines up on any Macs, get the PostScript card when ordering (cheaper at time of order than it is after the fact). Most printers will happily work using standard PCL drivers. Note: If you’re deploying Kyocera ECOSYS machines, aim for their KX drivers.
When downloading the drivers for deployment on a Windows server for sharing out to the networked Windows clients, opt to download both the 64bit and 32bit drivers of the same version number or release date, and if available, also the ARM64 drivers. When they are installed and made available to client systems using these different architectures, the user won’t have to go hunting to find drivers, as Windows will supply them to the connecting client during the printer installation.
Note here, we are downloading both the Windows 7 64 bit and Windows 7 (aka 32 bit) drivers for deployment:
Windows 7 (32 bit):
Once the drivers have been downloaded, extract them into their own sub folders. The may come as a ZIP file or as a self-extracting application. If the latter, when prompted to commence installation, cancel these operations – you just want the extracted driver files. Take note of where you have extracted them to. Pro-tip: place them in a ClientApps share so they can be accessed over the network at a later date it required.
Open the Control Panel (not Settings) and change the view mode from Category to Small Icons (or Large Icons if your eyes don’t work).
Click on Devices and Printers
Click on Add Printer in the toolbar
When Windows is scanning for printers, click on “The printer that I want isn’t listed”
When prompted, select the option to Add a local or network printer with manual settings:
When choosing a printer port, select Create a new port and change the drop down list to Standard TCP/IP Port, click Next
Enter in the fixed or reserved IP address of the printer, and un-tick the Query the printer for automatic installation
Windows will now check to see if it can communicate with the printer’s network stack and determine the available network protocols (SNMP, HP Discovery, etc).
Now we need to install the actual drivers, click Have Disk
Click Browse and locate the folder where the 64 bit drivers were extracted to
You may need to drill down into a fairly deep folder structure, like in this example to locate the valid driver information (INF) file. Click Open
You will return here, where you can see the file path. Click OK
Typically, manufacturers will bundle drivers & support for multiple models of their printer for ease of production, so you will need to select the correct model & revision from the list to ensure you get all the correct features & settings available to your printer. Once selected, click Next
Give the printer a valid & meaningful name. If prompted to Share the printer to the network, un-tick this option as we’re not yet ready for this
Windows will now install the drivers and add the new printer
From here, click to Print a test page if there’s not many options on the printer, otherwise, click Finish.
Returning to the Control Panel > Devices and Printers, you will now see the newly installed printer.
Now we want to install support for 32 bit Windows (and ARM64 if applicable / available). This is to ensure Windows 32 bit systems connecting to our server to access the printer will also receive automatic driver installation. Although 32 bit Windows is becoming far less common these days, doing this ensures in the long term, there’s little or no poor user experience or frustration when adding shared printers to their systems. It also helps when deploying printers via Group Policy that 32 bit Windows users don’t get prompted to install drivers on every logon until installed.
Right-click on the newly installed printer
Select Printer Properties from the contextual menu.
Many networked printers offer automatic device configuration in the form of two-way communication between the printer driver and the printer’s network stack. If this is an option, enable it and click the button appropriate to update the printer options.
In our FujiXerox example, this is called Bi-Directional setup – which is off by default, so turn this on, then click Get Information from Printer.
What this does: Tells the driver to communicate with the printer, requesting information such as: how many trays, what paper is in each tray, are their side car options or ‘finishers’, staplers, binders, folders, etc. The printer will respond to the driver and tell it what options are installed & available, and also consumable information such as paper & toner levels, etc. Once done, click Apply to save changes and update the configuration.
You can verify this worked by clicking Advanced, and Printing Defaults
You’ll see tray options, paper sizes, color options, output options, etc.
Now, head to the Sharing tab, click Additional Drivers.
Place a tick next to the additional drivers that you have downloaded (such as 32 bit) and click OK
This will prompt you to install them, like at the beginning, click browse to locate and install the appropriate drivers
Once located and selected, click OK
Finally, now you can Share out the printer. If the Windows PC or server sharing the printer is a member of Active Directory (or is the domain controller), tick the option to List in the directory – this will make is easier later in Group Policy to deploy.
Windows PC’s on the network (either AD authenticated, or pre-authenticated locally) can now browse the network share of this Windows Server and install the shared printer by simply double-clicking on it.
