Sophos Firewall Features
Sophos Firewall
Highlights
Ì Xstream Architecture provides extreme levelsof visibility, protection, and performancethrough stream-based packet processing
Ì Xstream TLS inspection offers high performance,
support for TLS 1.3 with no downgrading,port agnostic, enterprise-grade policies withpre-packaged exceptions, unique dashboard
visibility, and compatibility troubleshooting
Ì Xstream DPI Engine provides stream scanning
protection for IPS, AV, Web, App Control, and TLS
Inspection in a single-high performance engine
Ì Xstream Network Flow FastPath delivers policy-driven
and intelligent acceleration of trusted traffic automaticallyÌ Xstream SD-WAN provides performance-based
link selection with zero-impact re-routing, SD-WAN
monitoring, multi-site SD-WAN orchestration tools,
and FastPath acceleration of IPsec VPN tunnel trafficÌ Purpose-built user interface with interactive control
center utilizes traffic-light indicators (red, yellow, green)
to instantly identify what needs attention at a glanceÌ Control Center offers instant insights into endpoint
health, unidentified Mac and Windows applications,cloud applications and Shadow IT, suspicious
payloads, risky users, advanced threats, network
attacks, objectionable websites, and much more
Ì Optimized two-clicks-to-anywhere
navigation with intelligent searchÌ Policy Control Center widget monitors policy activity
for business, user, and network policies and tracks
unused, disabled, changed, and new policies
Ì Unified policy model combines all firewall, NAT,
and TLS inspection rules onto a single screenwith grouping, filtering, and search options
Ì Streamlined firewall rule management for large rulesets with custom auto and manual grouping plus at-aglance mouse-over feature and enforcement indicators

Ì All firewall rules provide an at-a-glance summary of
the applied security and control for AV, sandboxing,
IPS, Web, App, Traffic Shapping (QoS), and Heartbeat
Ì Pre-defined IPS, Web, App, TLS, and Traffic Shaping(QoS) policies enable quick setup and easy
customization for common deployment scenarios(e.g. CIPA, typical workplace policies, and more)
Ì Sophos Security HeartbeatTM connects Sophos
endpoints with the firewall to share health status
and telemetry enabling instant identificationof unhealthy or compromised endpoints
Ì Active Threat Response integrates with Sophos
XDR and MDR to automatically isolate active
adversaries and threats on the network andprevent lateral movement or communication.
Ì Synchronized Application Control automatically
identifies, classifies, and controls all unknown
Mac/Windows applications on the network
Ì Cloud Application Visibility enables shadow IT discovery
instantly and offers one-click traffic shaping
Ì Policy test simulator tool enables firewall rule and web
policy simulation and testing by user, IP, and time of day
Ì User Threat Quotient identifies risky users basedon recent browsing behavior and ATP triggers
Ì Configuration API for all features for RMM/PSA integration
Ì Discover Mode (TAP mode) for seamless integration intrials and PoCs with support for Synchronized Security
Ì Integrated ZTNA Gateway in every firewall makes
secure access to applications easy from anywhere.
Ì Sophos Central cloud-based management and reportingfor multiple firewalls provides group policy management
and one console for all your Sophos IT security products
Ì Easy streamlined setup wizard enables fast outof-the box deployment in just a few minutes
Ì Zero-touch deployment and configuration
in Sophos Central for new firewalls
Ì Seamless integration with Sophos MDR and XDR.

Sophos Firewall Features

Base Firewall
General Management
Ì Purpose-built, streamlined user interface and firewall
rule management for large rule sets with grouping with
at-a-glance rule feature and enforcement indicators
Ì Two-factor authentication (One-time-password) support
for administrator access, user portal, IPsec and SSL VPN
Ì Advanced logging and troubleshooting
tools in GUI (e.g., Packet Capture)Ì High Availability (HA) support clustering two
devices in active-active or active-passive modewith plug-and-play Quick HA setup supporting
multiple redundant synchronization links
Ì Full command line interface (CLI) accessible from GUIÌ Role-based administration with Azure
AD integration for single sign-on
Ì Automated firmware update notification with easy
automated update process and roll-back features
Ì Reusable and searchable system object definitions
for networks, services, hosts, time periods,
users and groups, clients, and servers
Ì Self-service user portal

Ì Backup firmware management in Sophos Central
stores the last five configuration backup files
for each firewall with one that can be pinned
for permanent storage and easy accessÌ Firmware update scheduling from Sophos Central enables
easy automated updates to be applied at any time
Ì Zero-touch deployment enables the initialconfiguration to be performed in Sophos Central
and then exported for loading onto the device
from a flash drive at startup, automaticallyconnecting the device back to Sophos Central

Firewall, Networking, and Routing
Ì Stateful deep packet inspection firewall
Ì Xstream packet processing architecture provides
extreme levels of visibility, protection, and performancethrough stream-based packet processing
Ì Xstream TLS inspection with high performance,
support for TLS 1.3 with no downgrading, port
agnostic, enterprise-grade polices, unique dashboard
visibility, and compatibility troubleshooting
Ì Xstream DPI Engine provides stream scanning
protection for IPS, AV, Web, App Control, and TLS
Inspection in a single high-performance engine

Ì Flexible device access control for services by zones

Ì Xstream Network Flow FastPath delivers policy-driven
and intelligent acceleration of trusted application traffic,
IPSec VPN traffic, and TLS encrypted traffic automaticallyÌ Email or SNMP trap notification options

Ì User, group, time, or network-based policies

Ì SNMP v3 and Netflow support

Ì Access time polices per user/group

Ì Central management support via Sophos CentralÌ Enforce policy across zones, networks, or by service type

Ì Backup and restore configurations: locally, via FTP
or email; on-demand, daily, weekly, or monthly

Ì Zone isolation and zone-based policy support.

Ì Configuration change tracking

Ì API for third-party integration
Ì Interface renamingÌ Remote access option for Sophos Support
Ì Cloud-based license management via MySophos

Sophos Central Management
Ì Sophos Central cloud-based management
and reporting for multiple firewalls provides
group policy management and a single console
for all your Sophos IT security productsÌ Group policy management allows objects, settings,
and policies to be modified once and automaticallysynchronized to all firewalls in the group
Ì Task Manager provides a full historical audit trail
and status monitoring of group policy changes

Ì Default zones for LAN, WAN, DMZ, LOCAL, VPN, and Wi-FiÌ Custom zones on LAN or DMZ
Ì Customizable NAT policies with IP masquerading and fullobject support to redirect or forward multiple services ina single rule with a convenient NAT rule wizard to quickly
and easily create complex NAT rules in just a few clicksÌ Re-usable network object definitions for all ruleswith global intelligent free-text searchÌ Flood protection: DoS, DDoS, and portscan blocking
Ì Country blocking by geo-IP
Ì Routing: static, multicast (PIM-SM), anddynamic: RIP, BGP, OSPFv3 (IPv6) BGPv6
Ì Upstream proxy support
2

Sophos Firewall Features
Ì Protocol-independent multicast
routing with IGMP snoopingÌ Bridging with STP support and ARP broadcast forwardingÌ VLAN DHCP support and tagging

Base Traffic Shaping and Quotas
Ì Flexible network- or user-based traffic shaping (QoS)(enhanced web and app traffic shaping options
included with the Web Protection subscription)Ì VLAN bridge support

Ì Set user-based traffic quotas on upload/download
or total traffic and cyclical or non-cyclicalÌ Jumbo frame support

Ì Real-time VoIP optimization

Ì Enable/Disable physical interfaces

Ì DSCP marking

Ì Wireless WAN support (n/a in virtual deployments)

Secure WirelessÌ 802.3ad interface link aggregation
Ì Full configuration of DNS, DHCP, and NTPÌ Dynamic DNS (DDNS)Ì IPv6 Ready Logo Program Approval Certification

Ì Simple plug-and-play deployment of Sophos wirelessaccess points (APX Series only) – automaticallyappear on the firewall control centerÌ Central monitoring and management of APs andwireless clients through the built-in wireless controller

Ì IPv6 DHCP Prefix Delegation

Ì Bridge APs to LAN, VLAN, or a separate
zone with client isolation options

Ì IPv6 tunnelling support including 6in4, 6to4, 4in6,
and IPv6 rapid deployment (6rd) through IPsecÌ Multiple SSID support per radio including hidden SSIDs

Xstream SD-WAN

Ì Support for diverse security and encryption standards
including WPA2 Personal and EnterpriseÌ Xstream SD-WAN profiles support multiple
WAN link options including VDSL, DSL,
cable, LTE/cellular, and MPLS
Ì Performance-based SLAs automatically select thebest WAN link based on jitter, latency, or packet-loss
Ì SD-WAN load balancing across multiple
SD-WAN links with round-robin weighting
or session persistence strategies
Ì Zero-impact re-routing maintains application sessions
when link performance falls below thresholds and atransition is made to a better performing WAN linkÌ SD-WAN monitoring graphs provide real-time insights
into latency, jitter and packet loss for all WAN links
Ì Xstream FastPath acceleration of SDWAN IPsec tunnel traffic
Ì Synchronized SD-WAN, a Synchronized Security
feature, leverages the added clarity and reliability of
application identification that comes with the sharing ofSynchronized Application Control information between
Sophos-managed endpoints and Sophos FirewallÌ Application routing over preferred links via
firewall rules or policy-based routing
Ì Robust VPN support including IPsec and SSL VPN
Ì Unique RED Layer 2 tunnel with routing

Ì Channel width selection option
Ì Support for IEEE 802.1X (RADIUS authentication)with primary and secondary server support
Ì Support for 802.11r (fast transition)
Ì Hotspot support for (custom) vouchers,
password of the day, or T&C acceptanceÌ Wireless guest internet access with walled garden options
Ì Time-based wireless network accessÌ Wireless repeating and bridging meshednetwork mode with supported APs
Ì Automatic channel selection background optimization
Ì Support for HTTPS login

Authentication
Ì Synchronized User ID utilizes Synchronized Security
to share currently logged in Active Directory user
ID between Sophos endpoints and the firewall
without an agent on the AD server or clientÌ Authentication via: Active Directory,
eDirectory, RADIUS, LDAP and TACACS+
Ì Server authentication agents for Active
Directory SSO, STAS, SATCÌ Single sign-on: Active directory,
eDirectory, RADIUS Accounting
3

Sophos Firewall Features
Ì Azure AD single sign-on for administrator
access to the Webadmin consoleÌ Azure AD single sign-on for users to authenticate
for web access via the captive portal"Ì Azure AD Group Import and RBAC support
Ì Client authentication agents for
Windows, Mac OS X, Linux 32/64
Ì Browser SSO authentication: Transparent,
proxy authentication (NTLM) and Kerberos
Ì Browser Captive Portal
Ì Authentication certificates for iOS and Android
Ì Authentication services for IPsec, SSL, L2TP, PPTP
Ì Google Chromebook authentication support forenvironments with Active Directory and Google G SuiteÌ API-based authentication

User Self-Service & VPN Portals
Ì Download the Sophos Authentication ClientÌ Download SSL remote access client (Windows)
and configuration files (other OS)
Ì Hotspot access information
Ì Change user name and password
Ì View personal internet usage
Ì Access quarantined messages and manage user-based
block/allow sender lists (requires Email Protection)

Ì IPsec Connection Stateful HA Failover for RBVPN,PBVPN, and remote access VPN without losing
session event in HA failover scenarios.
Ì IPsec VPN tunnel status monitoring via SNMP
Ì Advanced IPsec support for unique PSK
and DH-Group 27-30 / RFC6954
Ì SSL client for Windows and configuration
download via user portal

Sophos Connect ClientÌ Authentication: Pre-Shared Key (PSK),PKI (X.509), Token and XAUTH
Ì Enables Synchronized Security and Security
Heartbeat for remote connected users
Ì Intelligent split-tunneling for optimum traffic routing
Ì NAT-traversal support
Ì Client-monitor for graphical overview of connection status
Ì Mac (IPsec) and Windows (SSL/IPsec) client support

Network Protection
Intrusion Prevention (IPS)Ì High-performance, next-gen IPS deep packet
inspection engine with selective IPS patterns
that can be applied on a firewall rule basis for
maximum performance and protection
Ì Thousands of signatures

Zero Trust Network AccessÌ Granular category selection

Ì Integrated Sophos ZTNA gateway for secure accessto applications hosted behind the firewall

Ì Support for custom IPS signatures

Ì Managed from Sophos Central

Ì IPS Policy Smart Filters enable dynamic policies that
automatically update as new patterns are added

Base VPN Options

ATP and Security Heartbeat

Ì Site-to-site VPN: SSL, IPsec, 256- bit AES/3DES,
PFS, RSA, X.509 certificates, pre-shared key

Ì Sophos-X Ops Threat Feeds for advanced threatprotection to detect and block network traffic
attempting to contact malicious destinations (C2servers) using multi-layered DNS, AFC, and firewall

Ì Sophos RED site-to-site VPN tunnel(robust and light-weight)
Ì Xstream FastPath accleration of IPsec tunnel
traffic (both site-to-site and remote-access)Ì AWS VPC import, monitoring and management tools
Ì L2TP and PPTP
Ì Route-based VPN with traffic selectors
Ì Remote access: SSL, IPsec, iPhone/iPad/
Cisco/Android VPN client support
Ì IKEv2 Support

Ì Sophos Security Heartbeat instantly identifies
compromised endpoints including the host, user,
process, incident count, and time of compromiseÌ Sophos Security Heartbeat policies can limit
access to network resources or completely isolate
compromised systems until they are cleanedÌ Lateral Movement Protection further isolates
compromised systems by having healthy
Sophos-managed endpoints reject all traffic fromunhealthy endpoints preventing the movement of
threats even on the same broadcast domain

4Sophos Firewall Features

SD-RED Device Management
Ì Central management of all SD-RED devices
Ì No configuration: Automatically connects
through a cloud-based provisioning service
Ì Secure encrypted tunnel using digital X.509
certificates and AES 256-bit encryption
Ì Virtual Ethernet for reliable transfer of
all traffic between locations

Ì High performance web content cachingÌ Forced caching for Sophos Endpoint updatesÌ File type filtering by mime-type, extension, and active
content types (e.g. Activex, applets, cookies, etc.)
Ì YouTube for Schools enforcement per policy (user/group)Ì SafeSearch enforcement (DNS-based) for major
search engines per policy (user/group)Ì IP address management with centrally defined
DHCP and DNS Server configuration

Ì Web keyword monitoring and enforcement to log,
report or block web content matching keyword
lists with the option to upload customs lists

Ì Remotely de-authorize SD-RED devices
after a select period of inactivity

Ì Block potentially unwanted applications (PUAs)Ì Compression of tunnel trafficÌ VLAN port configuration options

Clientless VPN
Ì Sophos unique encrypted HTML5 self-service portal
with support for RDP, SSH, Telnet, and VNC

Web Protection
Web Protection and Control
Ì Streaming DPI web protection or
explicit proxy mode inspection
Ì Explicit proxy mode supports per-connection
authentication for multiple users on the same source IP
Ì Enhanced Advanced Threat Protection
Ì URL Filter database with millions of sites across
92 categories, backed by SophosLabs
Ì Surfing quota time policies per user/groupÌ Access time polices per user/groupÌ Malware scanning: block all forms of viruses,
web malware, trojans, and spyware on
HTTP/S, FTP and web-based email
Ì Advanced web malware protection
with JavaScript emulation
Ì Live Protection real-time, in-the-cloud
lookups for the latest threat intelligenceÌ Second independent malware detectionengine (Avira) for dual-scanningÌ Real-time or batch mode scanningÌ Pharming protection
Ì Enforce tenant restrictions for O365
Ì SSL protocol tunnelling detection and enforcment
Ì Certificate validation

Ì Web policy override option for teachers or
staff to temporarily allow access to blockedsites or categories that are fully customizable
and manageable by select users
Ì User/group policy enforcement on Google Chromebooks

Cloud Application Visibility
Ì Control Center widget displays amount of data uploaded
and downloaded to cloud applications categorized
as new, sanctioned, unsanctioned or tolerated
Ì Discover Shadow IT at a glanceÌ Drill down to obtain details on users, traffic, and dataÌ One-click access to traffic shaping policies
Ì Filter cloud application usage by category or volume
Ì Detailed customizable cloud application
usage report for full historical reporting

Application Protection and Control
Ì Synchronized App Control to automatically, identify,classify, and control all unknown Windows and Mac
applications on the network by sharing information
between Sophos-managed endpoints and the firewallÌ Signature-based application control withpatterns for thousands of applications
Ì Cloud Application Visibility and Control
to discover shadow IT
Ì App Control Smart Filters that enable dynamic policies
which automatically update as new patterns are added
Ì Micro app discovery and control
Ì Application control based on category, characteristics(e.g., bandwidth and productivity consuming),
technology (e.g. P2P), and risk level
Ì Per-user or network rule application
control policy enforcement
5Sophos Firewall Features

Web and App Traffic Shaping
Ì Enhanced traffic shaping (QoS) options by web category
or application to limit or guarantee upload/download or
total traffic priority and bitrate individually or shared

DNS Protection
Cloud-Based DNS Service
Ì Domain Name Resolution Service
Ì High-performance cloud-based DNS service
Ì Powered by SophosLabs and AI
Ì Blocks malicious URLs at DNS lookup
Ì Granular compliance controls to block
unwanted websites by categoryÌ Files are checked against SophosLabs’ massive threat
intelligence database and subjected to multiple machinelearning models to identify new and unknown malware
Ì Extensive reporting includes a dashboard widget foranalyzed files, a detailed list of the files that have been
analyzed and the analysis results, and a detailed reportoutlining the outcome of each machine learning model

Central Orchestration
SD-WAN Orchestration
Ì SD-WAN and VPN orchestration with easy and automatedwizard-based creation of site-to-site VPN tunnels
between network locations using an optimal architecture(hub-and-spoke, full mesh, or some combination)

Zero-Day Protection

Ì Supports IPsec, SSL or RED VPN tunnels. Integrates
seamlessly with SD-WAN features for application
prioritization, routing optimization, and leveraging
multiple WAN links for resiliency and performance

Dynamic Sandbox Analysis

Central Firewall Reporting Advanced

Ì Full integration into your Sophos
security solution dashboard

Ì 30-days of cloud data storage for historicalfirewall reporting with advanced features tosave, schedule and export custom reports

Ì Managed from Sophos Central

Ì Inspects executables and documents containing
executable content (including .exe, .com, and .dll, .doc,.docx, docm, and .rtf and PDF) and archives containing
any of the file types listed above (including ZIP, BZIP,
GZIP, RAR, TAR, LHA/LZH, 7Z, Microsoft Cabinet)Ì Aggressive behavioral, network, and memory analysis
Ì Detects sandbox evasion behavior
Ì Machine learning technology with deep learningscans all dropped executable files
Ì Includes exploit prevention and CryptoGuard
Protection technology from Sophos Intercept X

XDR and MDR Integration
Ì Integration with Sophos XDR and MDR to feed telemetry
and threat intelligence for threat hunting and analysis.
Ì Sophos Active Threat Response utilizes threat feeds
from MDR and XDR analysts to automatically identify,
block, and isolate active threats on the network.
Ì Synchronized Security IoC telemetry gathers
important information about any threat, users,
process and device that has been compromised.

Email Protection

Ì In-depth malicious file reports with screen
shots and dashboard file release capability

Email Protection and Control

Ì Optional data center selection and flexible
user and group policy options on file type,exclusions, and actions on analysis

Ì Reputation service with spam outbreak monitoring basedon patented Recurrent-Pattern-Detection technology

Ì Supports one-time download links

Ì Email scanning with SMTP, POP3, and IMAP support

Ì Block spam and malware during the SMTP transaction

Static Threat Intelligence Analysis

Ì DKIM and BATV anti-spam protection

Ì All files containing active code downloaded via theweb or coming into the firewall as email attachments
such as executables and documents containing
executable content (including .exe, .com, and .dll, .doc,.docx, docm, and .rtf and PDF) and archives containing
any of the file types listed above (including ZIP, BZIP,
GZIP, RAR, TAR, LHA/LZH, 7Z, Microsoft Cabinet) areautomatically sent for Threat intelligence analysis

Ì Spam greylisting and Sender Policy
Framework (SPF) protection
Ì Recipient verification for mistyped email addressesÌ Second independent malware detectionengine (Avira) for dual scanning
6

Sophos Firewall Features
Ì Live Protection real-time, in-the-cloud
lookups for the latest threat intelligence

Web Server Protection
Web Application Firewall Protection

Ì Automatic signature and pattern updates

Ì Reverse proxyÌ Smart host support for outbound relays

Ì URL hardening engine with deep-linking
and directory traversal prevention

Ì File type detection/blocking/scanning of attachmentsÌ Accept, reject or drop over-sized messages
Ì Detects phishing URLs within e-mails
Ì Use pre-defined content scanning rules or create
your own custom rules based on a variety of criteriawith granular policy options and exceptions
Ì TLS encryption support for SMTP, POP, and IMAPÌ Append signature automatically to all outbound messages
Ì Email archiverÌ Individual user-based block and allow senderlists maintained through the user portal

Ì Form hardening engine
Ì SQL injection protection
Ì Cross-site scripting protection
Ì Dual-antivirus engines (Sophos and Avira)Ì HTTPS (TLS/SSL) encryption offloadingÌ Cookie signing with digital signatures
Ì Path-based routing
Ì Geo IP Policy Enforcement
Ì Custom cipher configuration and TLS version enforcement

Email Quarantine Management

Ì HSTS and X-Content-Type-Options enforcementÌ Spam quarantine digest and notifications options

Ì Outlook anywhere protocol support

Ì Malware and spam quarantines with search andfilter options by date, sender, recipient, subject, andreason with option to release and delete messages

Ì Reverse authentication (offloading) for form-based
and basic authentication for server accessÌ Self-serve user portal for viewing andreleasing quarantined messages

Email Encryption and DLPÌ Patent-pending SPX encryption for
one-way message encryption
Ì Recipient self-registration SPX password management
Ì Add attachments to SPX secure replies
Ì Completely transparent, no additional
software or client requiredÌ DLP engine with automatic scanning of emails
and attachments for sensitive dataÌ Pre-packaged sensitive data type content
control lists (CCLs) for PII, PCI, HIPAA, andmore, maintained by SophosLabs

Ì Virtual server and physical server abstraction
Ì Integrated load balancer spreads
visitors across multiple servers
Ì Skip individual checks in a granular fashion as requiredÌ Match requests from source networks
or specified target URLs
Ì Support for logical and/or operators
Ì Assists compatibility with various configurations
and non-standard deployments
Ì Options to change web application
firewall performance parameters
Ì Scan size limit option
Ì Allow/Block IP ranges
Ì Wildcard support for server paths and domains
Ì Automatically append a prefix/suffix for authentication

7

Sophos Firewall Features

Reporting and Logging
Central Firewall ReportingÌ Pre-defined reports with flexible customization options
Ì Reporting for Sophos Firewalls: hardware,
software, virtual, and cloudÌ Intuitive user interface provides
graphical representation of data
Ì Report dashboard provides an at-a-glanceview of events over the past 24 hours
Ì Easily identify network activities,
trends, and potential attacks
Ì Easy backup of logs with quick retrieval for audit needs
Ì Simplified deployment without theneed for technical expertiseApps, Search Engines, Web Servers, Web Keyword
Match, FTP), Network and Threats (IPS, ATP, Wireless,Security Heartbeat, Sandstorm), VPN, Email, Compliance(HIPAA, GLBA, SOX, FISMA, PCI, NERC CIP v3, CIPA)
Ì Current Activity Monitoring: system health, live users,
IPsec connections, remote users, live connections,
wireless clients, quarantine, and DoS attacks
Ì SD-WAN Link Performance Monitoringfor jitter, latency, and packet loss
Ì Report anonymization
Ì Report scheduling to multiple recipients byreport group with flexible frequency options
Ì Export reports as HTML, PDF, Excel (XLS)Ì Report bookmarks

Central Firewall Reporting Advanced

Ì Log retention customization by categoryÌ Multi-firewall aggregate reportingÌ Full-featured log viewer with column view anddetailed view with powerful filter and search options,
hyperlinked rule ID, and data view customization

Ì Save custom report templatesÌ Scheduled reportingÌ Export reports in PDF, CFV or HTML format
Ì Up to one year data storage per firewall
Ì MDR/XDR Connector

On-box Reporting
NOTE: Sophos Firewall reporting is included at no extra
charge but individual log, report, and widget availability
may be dependent on their respective protection module
licenses.
Ì Hundreds of on-box reports with custom report options:
Dashboards (Traffic, Security, and User Threat Quotient),
Applications (App Risk, Blocked Apps, Synchronized8

Sophos Firewall Features

Sophos Firewall Features by Subscription Summary
Xstream Protection Bundle

Available Separately

Standard Protection Bundle
Base
FirewallGeneral Management (incl. HA)●

Xstream Architecture●

Firewall, Networking and Routing●

Xstream SD-WAN●

Base Traffic Shaping and Quotas●

Secure Wireless●Authentication●

Self-Serve User Portal●

ZTNA Gateway●

VPN (IPsec, SSL, etc)●

RED Site-to-Site VPN●

Sophos Connect VPN Client●

Web
Network
Protection Protection

Intrusion Prevention (IPS)●

Sophos X-Ops Threat Feeds●

Synchronized Security Heartbeat●

ATP and Security Heartbeat™

●

SD-RED Device Management●

Clientless VPN●

Synchronized Application Control●

Web Protection and Control●

Application Protection and Control●

Cloud Application Visibility●

Web and App Traffic Shaping●

DNS Security and Compliance

Available Separately
DNS
Protection

Zero-Day
Protection

CentralFirewall
Reporting Adv.

Email
Protection

Web ServerProtection●

Dynamic Sandbox Analysis●

Threat Intelligence Analysis●

SD-WAN Orchestration
Central Firewall Reporting Data

CentralOrchestration●
7 Days30 Days

Up to 1 Year

CFR Advanced Features●●XDR and MDR Threat Feeds●

Active Threat Response .

●Email Protection and Control●

Email Quarantine Management●

Email Encryption and DLP●

Web Application Firewall Protection●

Logging and Reporting

●

●

●

●

●

●

●

●

Sophos Central Management

●

●

●

●

●

●

●

●

Please note:Ì Some features are not supported on XGS 87 and XG 86 models (on-box reporting, dual AV scanning,
WAF AV scanning and email message transfer agent (MTA) functionality)
Ì MSP licensing options differ slightly to the above

9

Sophos Firewall Features

Support Plans
ENHANCED SUPPORTENHANCED PLUS SUPPORT

24/7 multi-channel support (phone, web portal, chat) including
remote assistance and self-help access to KB and support forums.

●●

Firmware downloads, updates, and maintenance●●

Advanced Hardware replacement for active devices●●(included in the Xstream
Protection Bundle)(available as an upgrade from
Enhanced Support)

Advanced hardware replacement for a passive HA device*●

Advanced hardware replacement for SD-RED/APX devices●

VIP Access (calls routed to senior engineers)●

Remote consulting (2-8 hours per year)●* To enable advanced RMA coverage for a passive HA device, the active device must have an Enhanced Plus support license
Refer to the Sophos Support Service Guide for full details.

United Kingdom and Worldwide Sales
Tel: +44 (0)8447 671131
Email: sales@sophos.com

North American Sales
Toll Free: 1-866-866-2802
Email: nasales@sophos.com© Copyright 2024. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
24-05-14 FL-EN (NP)Australia and New Zealand Sales
Tel: +61 2 9409 9100
Email: sales@sophos.com.au

Asia Sales
Tel: +65 62244168
Email: salesasia@sophos.com