Sophos XGS 87w Next-Gen Firewall

1. Introduction

This manual provides essential information for the installation, operation, and maintenance of your Sophos XGS 87w Next-Gen Firewall. The Sophos XGS 87w is designed to provide robust network security with advanced threat protection capabilities, powered by Sophos Firewall OS and Xstream Protection.

2. Product Overview

The Sophos XGS 87w is a compact desktop firewall appliance, featuring integrated wireless capabilities (802.11ac). It is equipped with multiple ports for flexible network connectivity and status indicators for easy monitoring.

2.1 Front Panel

Image 2.1: Front view of the Sophos XGS 87w firewall. This image displays the front panel of the device, including the Sophos logo, status LEDs, a USB port, and a COM port.

The front panel includes status LEDs to indicate the operational status of the device, network activity, and wireless connectivity. A USB port is available for specific configurations or updates, and a COM port is provided for console access.

2.2 Rear Panel

Image 2.2: Rear view of the Sophos XGS 87w firewall. This image shows the back panel with power input, DC IN 12V, a reset button, and multiple Ethernet ports (LAN/WAN).

The rear panel features the DC IN 12V power input, a reset button, and multiple Ethernet ports. These ports are used for connecting to your local area network (LAN) and wide area network (WAN), facilitating internet access and internal network segmentation.

3. Setup

3.1 Unpacking and Placement

• Carefully unpack the Sophos XGS 87w and its accessories.
• Place the device on a stable, flat surface in a well-ventilated area. Ensure adequate space around the unit for airflow.
• Avoid placing the device near heat sources or in direct sunlight.

3.2 Connecting Power

1. Connect the provided power adapter to the DC IN 12V port on the rear of the Sophos XGS 87w.
2. Plug the power adapter into a suitable electrical outlet.
3. The device will power on automatically. Observe the status LEDs on the front panel.

3.3 Network Connections

1. Connect your internet service provider's modem or router to the WAN port (typically labeled '2/WAN') on the rear panel using an Ethernet cable.
2. Connect your internal network devices (e.g., switches, computers) to the LAN ports (typically labeled '1/LAN' or '3', '4') using Ethernet cables.
3. For wireless connectivity, ensure the antennas are securely attached and positioned for optimal signal.

3.4 Initial Configuration Access

Access the Sophos Firewall OS web interface from a computer connected to a LAN port. Refer to the Sophos documentation for the default IP address and login credentials. It is recommended to change default credentials immediately after initial login.

4. Operating the Sophos XGS 87w

The Sophos XGS 87w operates on Sophos Firewall OS, providing a comprehensive suite of security features. Once configured, the firewall actively inspects network traffic, applies security policies, and protects against various threats.

4.1 Xstream Protection

The XGS 87w is designed to leverage Sophos's Xstream Protection architecture, which includes deep packet inspection, TLS 1.3 inspection, and AI-powered threat intelligence to identify and block advanced threats. Ensure your Xstream Protection license is active for full functionality.

4.2 Monitoring Status

Regularly check the status LEDs on the front panel for a quick overview of the device's operational state. For detailed monitoring and reporting, access the Sophos Firewall OS web interface or Sophos Central.

5. Licensing

The Sophos XGS 87w requires appropriate licensing to enable its full suite of security features. Licensing options include Xstream Protection Bundles and Standard Protection Bundles, along with various add-on modules.

Image 5.1: Overview of Sophos Xstream and Standard Protection Bundles. This image details the components included in Xstream Protection Bundle, Standard Protection Bundle, Additional Protection Modules, Sophos Central Management and Reporting, and other protection services.

5.1 Xstream Protection Bundle

This bundle includes comprehensive features such as Networking, Wireless, Xstream Architecture, Unlimited Remote Access VPN, Site-to-Site VPN, reporting, Network Protection (IPS, ATP, Security Heartbeat, SD-RED VPN), Web Protection, Zero-Day Protection, Central Orchestration, and Enhanced Support.

5.2 Standard Protection Bundle

The Standard Protection Bundle offers core features including Networking, Wireless, Xstream Architecture, Unlimited Remote Access VPN, Site-to-Site VPN, reporting, Network Protection (IPS, ATP, Security Heartbeat, SD-RED VPN), Web Protection, and Enhanced Support.

5.3 Additional Protection Modules

Optional modules like Email Protection (anti-spam, AV, DLP encryption) and Web Server Protection (Web Application Firewall) can be added to enhance security.

5.4 Sophos Central Management and Reporting

Sophos Central provides centralized management, group firewall management, backup management, firmware updates, and customized reports for all Sophos firewalls.

6. Protection Modules

The Sophos XGS 87w offers various protection modules to secure your network. These modules can be enabled and configured based on your specific security requirements.

Image 6.1: Detailed list of Sophos XGS 87w protection modules. This image outlines various security features including Base Firewall, Network Protection, Advanced Threat Protection, Secure Wireless, VPN, Web Protection, Zero-Day Protection, Email Protection, and more.

6.1 Base Firewall

Includes the Xstream architecture, stateful firewall, NAT, VLAN support, and SD-WAN capabilities.

6.2 Network Protection

Provides intrusion prevention, advanced threat protection, and security heartbeat integration.

6.3 Web Protection

Offers URL filtering, application control, and web threat protection.

6.4 Zero-Day Protection

Utilizes static and dynamic file analysis techniques to detect and block unknown threats.

6.5 Email Protection

Includes anti-spam, antivirus, and data loss prevention for email traffic.

7. Maintenance

7.1 Firmware Updates

Regularly update the device firmware to ensure optimal performance and the latest security patches. Firmware updates can be managed through the Sophos Firewall OS web interface or Sophos Central.

7.2 Configuration Backup

Periodically back up your firewall configuration. This allows for quick restoration of settings in case of an issue or device replacement. Backups can be performed via the web interface or Sophos Central.

7.3 Physical Cleaning

Keep the device clean and free from dust. Use a soft, dry cloth to wipe the exterior. Ensure ventilation openings are not obstructed.

8. Troubleshooting

8.1 Status LED Indicators

• Power LED: Solid green indicates normal operation. If off, check power connection.
• Status LED: Varies based on device state. Refer to the Sophos Firewall OS documentation for specific patterns.
• LAN/WAN LEDs: Indicate network activity and link status for connected ports.

8.2 Common Issues

• No Internet Access: Verify WAN cable connection, check modem/router status, and ensure correct network configuration in Sophos Firewall OS.
• Slow Network Performance: Check for high CPU/memory usage in the device's dashboard, review firewall rules, and ensure adequate bandwidth from your ISP.
• Cannot Access Web Interface: Ensure your computer is on the correct network segment, verify the device's IP address, and check for IP address conflicts.

8.3 Resetting the Device

To perform a factory reset, locate the reset button on the rear panel. Use a paperclip to press and hold the button for approximately 10 seconds until the status LEDs change. Warning: A factory reset will erase all configurations and restore the device to its default settings.

9. Specifications

The following tables detail the technical specifications of the Sophos XGS 87w Next-Gen Firewall.

Image 9.1: Technical specifications for Sophos XGS 87w. This image provides detailed information on performance metrics, wireless specifications, physical interfaces, dimensions, weight, environmental conditions, and certifications.

9.1 Technical Specifications

9.2 Product Matrix

Image 9.2: Sophos XGS Series Appliances Product Matrix. This image compares various XGS models, including form factor, ports/slots, Wi-Fi capabilities, swappable components, and throughput metrics for firewall, IPSec VPN, Threat Protection, and Xstream SSL/TLS.

The product matrix provides a comparison of the XGS 87w with other models in the Sophos XGS series, highlighting differences in form factor, port configurations, Wi-Fi capabilities, and performance metrics.

9.3 Performance Test Methodology

General maximum throughput is measured under ideal test conditions using industry standard Keysight-Ixia BreakingPoint test tools. Actual performance may vary depending on network conditions and activated services.

• Firewall: Measured using HTTP traffic and 512 KB response size.
• Firewall IMIX: UDP throughput based on a combination of 66 byte, 570 byte and 1518 byte packet sizes.
• IPS: Measured with IPS with HTTP traffic using default IPS ruleset and 512 KB object size.
• IPSec VPN: HTTP throughput using multiple tunnels and 512 KB HTTP response size.
• TLS inspection: Performance measured with IPS with HTTPS sessions and different cipher suites.
• Threat Protection: Measured with Firewall, IPS, Application Control, and malware prevention enabled using HTTP 200 KB response size.

10. Warranty and Support

10.1 Product Warranty

The Sophos XGS 87w comes with a standard manufacturer's warranty. For detailed information regarding warranty terms, duration, and coverage, please refer to the warranty documentation included with your product or visit the official Sophos website.

10.2 Technical Support

For technical assistance, troubleshooting, or inquiries regarding your Sophos XGS 87w, please contact Sophos Support. Support options may include online knowledge bases, community forums, and direct contact with support personnel, depending on your service agreement.

• Visit the official Sophos website for support resources.
• Ensure you have your product serial number and license information ready when contacting support.