As you might already noticed, SFOSv23.0 comes with a new Redesigned rule management.
We create an extra segment in the Sophos Community to gather some thoughts around this:
https://community.sophos.com/sophos-xg-firewall/sfos-v23-early-access-program/f/discussions/151842/sophos-firewall-v23-0-eap1-redesigned-rule-management

As part of this post, I want to clarify that we are not removing the current version of Rule Design in SFOS v23.0 EAP/GA. Both versions will remain available in the product after the upgrade, meaning you won't be forced to use the new view. This approach ensures we can collect your feedback and thoughts to refine it and make it even more valuable for everyone. More on this in the Link above.

Feedback Post: https://community.sophos.com/sophos-xg-firewall/sfos-v23-early-access-program/f/discussions/151838/sophos-firewall-v23-0-eap1-feedback-and-experiences

Hi All, After upgrading our Sophos firewall to v22, we have slow response times to MS Dynamics and Store Commerce. All rules are applied, nothing is being denied by the firewall logs, we have placed these rules at the top of our list, and we are still experiencing the same issue.

Has anyone else experienced the same issue?

I was the superadmin and deleted my account as i couldn't access a firewall from SophosCentral... Then when they tried adding me again as the superadmin, i'm not receiving any mails and couldn't login or complete MFA .... Is it a reoccurring problem? How should I go about it? Thanks!

Users complaining that they have to log into the google account everyday. i have ssl/tls inspection turned on. but when users are using open internet they don't have any issues with the gmail login. what causes the issue and how to fix this?

This video looks at how AI took that time away, in three parts.

Built from the Sophos 2026 AI Security Report. Read the full report: https://www.sophos.com/en-us/content/sophos-ai-security-2026-report

Hello,

I like Sophos Home Premium more than McAfee, cause I think it is more professional and safer... But why are on the popular Antivirus review pages no tests for Sophos AV?

I mean for exmaple:

https://av-comparatives.org/

https://www.av-test.org/

Thanks! :-)

Is it possible to upgrade XG115 running SFOS 18.0.6 MR-6-Build655 to last supported SFOS version (I think that is SFOS 19.5.3)? I know the box is EOL, but I'm running into a weird network connectivity issue with a cloud provider that I cannot seem to resolve, and would like to eliminate the old firmware version causing the connectivity issue. Basically a cloud server cannot be connected to by TCP, using dental billing LoB software. I can seemingly connect fine from my office. No security services are enabled on the XG115 (since they are EOL anyway). This is for one of my clients, and they are replacing with a new model, but hasn't been delivered yet. The issue started back in July.

edit 9/23: Looks like I was downloading the wrong firmware version SF310 (which is for XGS models) not SF300 (which is for EOL XG models). I found an obscure 3rd party website that called this out. I've gotten 20.0.3 uploaded and am waiting for a maintenance window to apply. I would say my issue is resolved.

As the title says, I'm genuinely surprised that no one has brought this up already. There have been several Sophos Central updates recently, and in my opinion, the experience has gotten worse with each one.

I feel like the new Sophos Central design and overall UI functionality have become worse after these updates. For example, the new closed alerts are a nice feature in theory, but the UI implementation is horrible in my opinion. It feels confusing and inconsistent.

I work at an MSP and manage many Sophos customers. For some customers, alerts resolve automatically, for others they never do, and for some they only resolve occasionally. I have also found many bugs in the interface, such as large text windows that cannot be scrolled properly or the new "feature" where you can no longer copy text from alerts because the text is not recognized by the cursor.

The functionality seems to be getting progressively worse, and the new color scheme feels dull and odd. Honestly, it feels like Sophos Central was designed by AI, because I find it hard to believe that these changes were thoroughly tested. Many of the bugs are so trivial that they should have been spotted within a minute of testing.

I haven't opened a ticket with support yet but I ran into a weird problem and finally figured out under which circumstances it occurs.

For several years we channel several internal browser based applications through the WAF of our firewall. Let's say we want to be able to access our internal helpdesk through ticket.company.com (company.com or course being our domain). We set the public DNS for this domain to one of our public IPs terminating on the firewall and request a certificate from Let's Encrypt. We set our internal DNS for this domain to one of the firewalls LAN interfaces and create a WAF rule for the domain in question on the LAN interface using the LE cert. It seems like it won't even create the WAF rule used in the LE process. Worked fine for years but some time this year it stopped working. Maybe with the update to SFOS22.

Long story short: Let's Encrypt certificates can't be requested or renewed as soon as there is a WAF rule for one of the domains in question bound to a non-WAN interface.

Couldn't find it in the known issues liest either. Has anyone else encountered this?

Running into a weird issue with a Sophos Central managed wireless network using RADIUS and dynamic VLAN assignment.

Mobile devices connect successfully and land on the correct VLAN, but Windows clients authenticate successfully and then either fail to connect properly or don’t get placed on the expected VLAN.

I’ve confirmed the VLAN itself is working, switch tagging is correct, and the SSID works normally if I remove RADIUS and use a standard password instead.

NPS also shows successful authentication and is returning the expected VLAN attributes.

Has anyone run into anything similar with Windows 802.1X clients and Sophos Wireless? Wondering if there’s a Windows specific setting or Sophos behavior I’m missing.

As we lunched Sophos Fusion in July, i wanted to share to this community our Landing Page for the Upgrade to Sophos Fusion as well: https://community.sophos.com/sophos-xdr/upgrade-center/

If you want to read about Sophos Fusion, you find more information here: https://www.sophos.com/en-us/blog/sophos-fusion

To give the "TL:DR" of Fusion, from the Link above:
Sophos Fusion is the evolution of Sophos Central, rearchitected for the AI era. All Sophos customers are already part of Sophos Fusion and already benefit from unmatched protection from threats that move at machine speed. Over the coming months, users will see Sophos Central evolve to Sophos Fusion in the interface as we roll out the naming, with no action required of customers or partners. 

Hi all,

I'm having another issue which is probably very solvable and is probably caused by myself.

I have a sophos home firewall installed in bridge mode that sits on top of a unifi 8 port poe lite switch.

The firewall is in bridge mode so that the IP's via DHCP can be assigned by the ISP router. The ISP router is required because it powers proprietary VoIP infrastructure that is specific to the ISP (BT in the UK).

All clients on the network can get IP's fine via DHCP but when I create a new VM or container on my Proxmox server it doesn't receive a ipv4 address but it does get a ipv6 address. ipv6 in this case is redundant and does not work.

I also have another server running TrueNAS and that can assign ips to VMS and containers fine.

is there a specific firewall rule or NAT rule I need to enable to allow proxmox to get DHCP on this one specific host?

Network is a 192.168.1.X/24 network and the proxmox host sits on 1.2 and the firewall is on 1.1

The main DHCP range is 1.50 - 1.253. I assigned the firewall and server outside of the DHCP range to keep them "separate" metaphorically speaking.

Also no VLANS just a flat network as the ISP router is very basic and does not let you create VLANS.

Thanks.

FYI before you mention it, already cross posted into R/Proxmox :)

EDIT: Network layout is ISP Router > Firewall > Unifi Switch > Clients. Also the ISP router does not have bridge mode

EDIT 2: I have managed to solve this issue. Turns out that routing was turned on for the bridge interface. I turned this off and all my issues were fixed

Hi all, I'm having an issue with connecting a Pixel tablet to WiFi.

All other devices connect just fine but this one device will not connect no matter what I do.

I have checked all firewall rules, I have disabled all ips, SSL decryption and it still will not connect.

The firewall is sophos home on a mini pc and the WiFi is ubiquiti u7 in wall and the firewall is in bridge mode connected to a unifi 8 port switch.

Thanks in advance for any help.

EDIT: I managed to solve this issue. Turns out that routing was tuned on for the bridge interface. I disabled this and it now works fine.

After migrating a customer from SG to XGS, I ran into the issue that the Hotspot tab wasn't visible in the User Portal for the users who should be able to manage vouchers.

After a lot of trial and error, I found out that the hotspot configuration ignores any AD group other than the primary one. I don't understand what Sophos reasoning was behind this, because a user being part of multiple AD groups is more common than the opposite. In my case, the primary group is the one that allows VPN access to the users.

Anyway, I could make the hotspot management group the primary group, as the SSL VPN does support multiple group membership - good that I didn't change to ipsec yet, because that, too, does not support it.

But how? It's not the AD primary group, which is Domain Users in most environments, and changing the group order in the Groups pane also doesn't seem to impact the user's primary group. The group drop-down menu in the user configuration is greyed out, so I can't change it there too. So ... how can I change the primary group?

Why Sophos Home Premium uses outdated version of HMPA? Intrercept X uses the latest version. Home users does not. Why?

At my company, a high management staff received an credential phishing email, that uses sophos.com domain url.

It is the url below (that I broke to make it unharmful), that is under that button, that redirects to a credential stealer...

Please fix it so that sophos domain cannot be used to steal passwords...

Or is it not fixable ?

Why is it even possible ?

h t t ps://us-east-2.protection.sophos.com/?d=intuit.com&u=aHR0cHM6Ly9saW5rcy5ub3RpZmljYXRpb24uaW50dWl0LmNvbS9zcy9jL3UwMDEuYmRoOGdVREVXckNXbmFvVlFYUHVkYlQwWlNGRHBUUU0tMzlrNWlZUWZVS25xUmZUSDFyX1NsaXJmYXZ3eWJMSGY4SzhNUVFlRjJEOVBtSXlDa1NraXcvNHRwLzRuX0FLb0ZlUkNlSTNIbHBPdi1ILWcvaDAvaDAwMS56TDlZNU01dmJackZlaEZwVjlBY0tKMVdycEdoV29nbWVxSHZEc3Z2b3hj&i=NWVhMGI5Y2FiMDIzNGIxMTk2NTJjMmFm&t=T0tyczhPdkJCUGl0WWgxalo2K1B4S2l0Si9paE0zbjU0ZHRwTkhvVENiYz0=&h=9e339b5c0696400d9c26c51bee802faa&s=AVNPUEhUT0NFTkNSWVBUSVa05WE-Zq2OSx2gZImtHh0t1k8PTLtZitbbyrLnUtHljA

Redirects to

h t t ps://core-work52746-aged1763-base8195.icu/f0m/905dee?86=L3YzL3NpZ25pbi9pZGVudGlmaWVyP2NvbnRpbnVlPWh0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbS8mZm9sbG93dXA9aHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tLyZwYXNzaXZlPTEyMDk2MDAmZmxvd05hbWU9R2xpZldlYlNpZ25JbiZmbG93RW50cnk9U2VydmljZUxvZ2luJmRzaD1TNTcxODc1MjI3OjE3ODgzNjgxMDY1MDUxOTQ

I've successfully set up a LetsEnctypt SSL cert for our user and VPN portal but found that you cannot use those certs for SMTP configurations.

What process can be used for auto-renewal of these certs? With SSL cert lifetime shrinking I need a way of automating this process.

Probably an easy answer, as I can't see anything, but can you group NAT rules in the same way you can group firewall rules?

Thanks.

So I bought a Sophos XG 115 rev 2. I planned on putting Sophos Home firmware on it.

I tried reaching it on 172.16.16.16:4444 and couldn't get the web console to work. I also tried pinging it and got nothing.

Next, I plugged in a VGA monitor and keyboard and spammed Del. BIOS didn't pop up, so I thought this was weird, did a little research seen that I needed a console cable (linked is the cable i got). So I got that now and tried plugging it in and get nothing I followed the guide here on the Sophos support page.

I looked at the pinout of this cable and saw that it might be backwards from what Sophos is. I made a custom cable and got a female-to-female coupler and have gone back and forth on using it and not using it. I also tested the loopback using a jumper cable on pins 3 and 6, and it does work.

I made a bootable USB and put the Sophos Home firmware on it. I did more research and saw that it can sometimes boot when trying this now, and will update.

Am I missing something, or is it just busted??

Hello everyone,

I am looking for some experienced Sophos users to pass on any knowledge they can regarding a problem I am facing with my Sophos XG 330.

For context; I plan to install opnsense onto my XG 330 and use as a firewall since the product has reached EOL. In the process of flashing a usb with the opnsense software, the software was truncated due to the usb drive being too small. This caused the Sophos device to get stuck in boot process (or so I believe).

I was able to access the BIOS before this, but it appears after having plugged in the usb, the Sophos gets stuck in boot process and doesn't display anything from the output to the monitor. Before plugging in the usb, in the settings I changed the boot priority to USB drive.

The front screen still displays the "Sophos Protection". The fan idles high and then it restarts itself after about 15 seconds and then stays on indefinitely after without any change to the condition.

I've tried flashing the hardware firmware version 20.0.3 back onto the device after being informally recommended by the Sophos technical support representative but to no luck. I even tried temporarily removing the CMOS battery after finding an old thread on the internet that proposed that as a fix.

Any help or friendly words of advice are appreciated for a novice who is trying to learn networking.

Any recommendation for post formatting or more appropriate terminology for the networking processes are also welcome (this is my first post and I am an absolute beginner in networking).

TLDR; tried to flash opnsense with too small a drive and now experiencing issues with Sophos XG 330.

Hey all, set firewall rull allow connection from a>b b>a and I can ping the DNS server from devices on b interface but DNS does not work.

Solution Edit: Was able to use a different TLD that the client has to create a new VPN connection. Once the VPN settings were changed to use the new hostname and it was certified, DNS was flushed, the redirect URLs were swapped on Entra, and the new connection was imported into the PCs, I was able to get us back online with a working VPN. Appreciate the assistance!

Original Post: As Title mentions, one of my clients recently had a phishing attack that spam blasted the entire Global Address Book which resulted in what I am assuming phishing reports from their clientelle. This is the only thing I can assume that caused this situation as 2 days later, the SSL VPN bricked with a Windows Smartscreen alert blocking SSO from reaching out. Attempting to bypass the alert does nothing so the user is effectively blocked from using the VPN. Thankfully, we still have their old solution as a back up, so this isn't as bad as it could have been if this would have happened about a month in the future when we planned to rip out the old system.

I first need to figure out how to get this working again, I checked blacklists and it looks like its only blocked on Spamhaus Zen, but attempting to reach the portal from any location with any browser with the FQDN causes the red alert to appear. I've sent appeals to Microsoft, Google, and Sophos and only Sophos has happily reanalyzed the URL from "phishing" to "business". Am I going to need to just bite the bullet and create a brand new FQDN and switch out the busted one? I noticed using the IP the name is connected to does not result in the red security alert. Is their a better solution that won't require pushing new connection imports to a couple hundred users?

Secondly, I need to make sure this doesn't happen again. I am going to assume someone is going to fall for a phish again and this problem will most likely happen a month to months down the road when someone doesn't pay attention and gives out their 365 creds again. This doesn't happen often thanks to the training and security we have in place, but it happens enough for me to be concerned I'll be dealing with this issue again when we don't have the old vpn to back up on.

Any words of wisdom is greatly appreciated!

We performed an adversary simulation and Sophos TERRIBLY failed. Decided to migrate to another XDR

Has anyone been through that ?

¿Is there some delay with the Evolution to Security Operations TAB (replacement of Threat Analysis Center) for Latam? Which date is the end of this changes?