FW1020 20 0v1 Deploying Sophos Firewall Using the Initial Setup Wizard

Prévia do material em texto

<p>Copyright © 2024 Sophos Ltd</p><p>Sophos Firewall</p><p>Deploying Sophos</p><p>Firewall Using the</p><p>Initial Setup Wizard</p><p>Version: 20.0v1</p><p>[Additional Information]</p><p>Sophos Firewall</p><p>FW1020: Deploying Sophos Firewall Using the Initial Setup Wizard</p><p>January 2024</p><p>Version: 20.0v1</p><p>© 2024 Sophos Limited. All rights reserved. No part of this document may be used or reproduced in any form or by any means without the prior written</p><p>consent of Sophos.</p><p>Sophos and the Sophos logo are registered trademarks of Sophos Limited. Other names, logos and marks mentioned in this document may be the</p><p>trademarks or registered trademarks of Sophos Limited or their respective owners.</p><p>While reasonable care has been taken in the preparation of this document, Sophos makes no warranties, conditions or representations (whether express</p><p>or implied) as to its completeness or accuracy. This document is subject to change at any time without notice.</p><p>Sophos Limited is a company registered in England number 2096520, whose registered office is at The Pentagon, Abingdon Science Park, Abingdon,</p><p>Oxfordshire, OX14 3YP.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 1</p><p>Copyright © 2024 Sophos Ltd</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard</p><p>In this chapter you will learn how</p><p>to use the initial setup wizard to</p><p>configure Sophos Firewall.</p><p>DURATION 10 minutes</p><p>RECOMMENDED KNOWLEDGE AND EXPERIENCE</p><p>✓ How Sophos Firewall acts as a zone-based firewall</p><p>✓ The multiple layers of protection provided to</p><p>detect and block attacks</p><p>Copyright © 2023 Sophos Ltd</p><p>In this chapter you will learn how to use the initial setup wizard to configure Sophos Firewall.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 2</p><p>Copyright © 2024 Sophos Ltd</p><p>Connecting Sophos Firewall to the Network</p><p>SOPHOS</p><p>Protection</p><p>1/LAN</p><p>The default LAN port to connect to for initial</p><p>configuration</p><p>2/WAN</p><p>The default WAN port</p><p>A different port can be selected in the initial</p><p>setup wizard</p><p>To setup a Sophos Firewall you need to start by connecting to power and then connecting the LAN</p><p>port and WAN ports.</p><p>On hardware XGS Series firewalls the default LAN and WAN ports will be marked. On software and</p><p>virtual Sophos Firewalls these will be the first and second network cards.</p><p>You will have the option to modify these ports either during the initial setup or once the setup is</p><p>complete.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 3</p><p>Copyright © 2024 Sophos Ltd</p><p>Command Line Interface (CLI)</p><p>Additional information in</p><p>the notes</p><p>SSH Console</p><p>Default credentials:</p><p>• Username: admin</p><p>• Password: admin</p><p>These credentials are changed as part of the initial setup wizard</p><p>Although Sophos Firewall is managed through a web interface, it also has a command line interface</p><p>(CLI) that is accessible through SSH, a console connection, or you could use a monitor and keyboard to</p><p>physically connect to the terminal.</p><p>You may want to use the CLI to change the IP address of the management port to be in your LAN IP</p><p>range, so that you can connect to the web admin console to complete the initial setup wizard. To login</p><p>to the CLI, use the password of the built-in ‘admin’ user. The default admin password is ‘admin’; you</p><p>change this as part of the initial setup wizard.</p><p>In the slide notes you can find the parameters for a console connection.</p><p>[Additional Information]</p><p>Console connection parameters:</p><p>• baud rate or speed: 38,400</p><p>• Data bits: 8</p><p>• Stop Bits: 1</p><p>• Parity and Flow Control: None or 0</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 4</p><p>Copyright © 2024 Sophos Ltd</p><p>Simulation: Network Configuration Using the CLI</p><p>In this simulation you will use the CLI to change the IP</p><p>address of the management port to be in your LAN IP</p><p>range.</p><p>https://training.sophos.com/fw/simulation/CliConf/1/start.html</p><p>LAUNCH SIMULATION CONTINUE</p><p>Please complete this simulation.</p><p>Click Launch Simulation to start. Once you have finished, click Continue.</p><p>[Additional Information]</p><p>https://training.sophos.com/fw/simulation/CliConf/1/start.html</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 5</p><p>https://training.sophos.com/fw/simulation/CliConf/1/start.html</p><p>Copyright © 2024 Sophos Ltd</p><p>Web Admin Console</p><p>Default IP address: 172.16.16.16 (/24)</p><p>Port: 4444</p><p>Web admin console URL: https://DeviceIP:4444</p><p>https://172.16.16.16:4444/webpages/initialsetup/Index.html?wizard_run=yes&?v1c2faa6567a06971c412133edf637e9&csrf=6t06j7v4aut3vu48jgu6qr808f</p><p>Sophos Firewall is configured and managed through a web interface. By default, the device’s IP</p><p>address will be 172.16.16.16 and the web admin console on a Sophos Firewall runs on port 4444. So,</p><p>to connect to the web admin console you would need to connect to HTTPS://172.16.16.16:4444 on a</p><p>brand-new device.</p><p>You will receive a certificate error when connecting to the Sophos Firewall because it is using an</p><p>untrusted self-signed certificate.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 6</p><p>Copyright © 2024 Sophos Ltd</p><p>Initial Setup Wizard</p><p>✓ Set a new admin password</p><p>✓ Update the firmware</p><p>✓ Agree to the licence</p><p>Optionally:</p><p>▪ Restore a backup configuration</p><p>▪ Connect as high-availability</p><p>spare</p><p>We will now walk through the initial setup of a Sophos Firewall.</p><p>On the first page you set a new admin password and accept the terms and conditions. If you are</p><p>configuring the firewall on behalf of someone else, they must accept the terms and conditions.</p><p>By default, the Sophos Firewall will download and install the latest firmware as part of the initial setup,</p><p>however you can deselect this to postpone it until later.</p><p>You also have the option to restore a configuration backup, or connect the Sophos Firewall as an</p><p>auxiliary device to a high-availability pair. Both of these options will provide a different initial setup to</p><p>the full one we are going to show here.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 7</p><p>Copyright © 2024 Sophos Ltd</p><p>Initial Setup Wizard</p><p>✓ Set a secure storage master</p><p>key</p><p>✓ Confirm that you have stored</p><p>it in a password manager or</p><p>other safe place</p><p>You need to create a secure storage master key. The secure storage master key is used to provide</p><p>additional protection for account and password details stored in the device and in configuration</p><p>backups.</p><p>Once you have set the master key you cannot recover it, which is why the configuration asks you to</p><p>confirm that you have stored it in a password manager, or another safe place.</p><p>If you do lose the secure storage master key, you will not be able to restore backups or configurations</p><p>created with that key.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 8</p><p>Copyright © 2024 Sophos Ltd</p><p>Initial Setup Wizard</p><p>✓ Configure the Internet</p><p>connection</p><p>This step is skipped if the WAN</p><p>port is configured by DHCP.</p><p>The Sophos Firewall requires an Internet connection for registration and, if selected, to download the</p><p>latest firmware.</p><p>You can choose which port to configure the WAN connection on, then you need to specify the IP</p><p>address, subnet, DNS server and gateway. When you save these settings the Sophos Firewall will test</p><p>the connectivity then allow you to continue with the initial setup.</p><p>If the WAN port is connected to a network that provides DHCP, this step will be skipped.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 9</p><p>Copyright © 2024 Sophos Ltd</p><p>Initial Setup Wizard</p><p>✓ Enter a hostname</p><p>✓ Set the time zone</p><p>You can enter a fully qualified hostname for your Sophos Firewall, this can be either the internal or</p><p>external hostname for the firewall; however, in most scenarios we would recommend using the</p><p>internal hostname.</p><p>Optionally, you can modify the automatically selected time zone.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 10</p><p>Copyright © 2024 Sophos Ltd</p><p>Initial Setup Wizard</p><p>✓ Claim the Sophos Firewall in a</p><p>Sophos Central account</p><p>✓ Enter the serial number, this is</p><p>pre-filled on hardware devices</p><p>Optionally:</p><p>▪ Start a trial</p><p>▪ Migrate a UTM license</p><p>▪ Defer registration</p><p>The</p><p>next step is to claim the Sophos Firewall in a Sophos Central account.</p><p>If you have a serial number, you can enter it to claim your firewall. On hardware XGS Series devices</p><p>this will be prefilled.</p><p>You also have the option to migrate an existing UTM license, start a trial, or defer the registration for</p><p>30 days. Deferring the registration can be useful if you are preparing a Sophos Firewall prior to taking it</p><p>onsite. It is worth noting that when registration is deferred there are several features that you are</p><p>unable to use.</p><p>To complete the registration, you need to login with your Sophos ID, the Sophos Firewall will then</p><p>synchronize the license.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 11</p><p>Copyright © 2024 Sophos Ltd</p><p>Initial Setup Wizard – Hardware Devices</p><p>✓ Configure the LAN network</p><p>✓ Select which ports to bridge</p><p>together to create the LAN</p><p>✓ Select the gateway</p><p>✓ Configure the IP address</p><p>✓ Optionally enable DHCP</p><p>You have the option to configure the local network configuration, which is different depending on</p><p>whether you are deploying a hardware, virtual, or software Sophos Firewall. We will start by looking at</p><p>hardware devices.</p><p>Here you can select which ports to use for the LAN. All ports selected will be used to create a single</p><p>bridged LAN interface.</p><p>You can select the gateway for the LAN network to be either the Sophos Firewall, or an existing</p><p>gateway, in which case the LAN will be bridged to the WAN.</p><p>You can configure the IP address for the Sophos Firewall, and optionally enable DHCP.</p><p>Please note that DHCP cannot be enabled if the Sophos Firewall is bridging the LAN and WAN.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 12</p><p>Copyright © 2024 Sophos Ltd</p><p>Initial Setup Wizard – Virtual and Software Devices</p><p>✓ Configure the LAN network</p><p>✓ Select the LAN port</p><p>✓ Select the gateway mode</p><p>✓ Configure the IP address</p><p>✓ Optionally enable DHCP</p><p>For virtual and software devices the configuration is very similar, except instead of selecting ports to</p><p>create a LAN bridge interface you select a single LAN port.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 13</p><p>Copyright © 2024 Sophos Ltd</p><p>Initial Setup Wizard</p><p>✓ Enable protection in the</p><p>default outbound firewall rule</p><p>Options:</p><p>▪ Protect users from network</p><p>threats</p><p>▪ Protect users from the suspicious</p><p>and malicious websites</p><p>▪ Scan files that were downloaded</p><p>from the web for malware</p><p>▪ Send suspicious files to Sophos</p><p>Sandstorm</p><p>As part of the initial setup wizard the Sophos Firewall will create a default firewall rule for outbound</p><p>traffic. Here you have the option of enabling various security options for that firewall rule.</p><p>The options are:</p><p>• Protect users from network threats, which will enable an IPS policy.</p><p>• Protect users from the suspicious and malicious websites, which will enable a web policy.</p><p>• Scan files that were downloaded from the web for malware, which will enable malware scanning.</p><p>• And Send suspicious files to Sophos Sandstorm, which will enable Sandstorm scanning. This</p><p>requires ‘Protect users from the suspicious and malicious websites’ to be enabled.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 14</p><p>Copyright © 2024 Sophos Ltd</p><p>✓ Enter an email address and</p><p>sender for notifications</p><p>Optionally:</p><p>▪ Specific an internal mail server</p><p>for notifications</p><p>▪ Enable automatic backups and</p><p>enter an encryption password</p><p>Initial Setup Wizard</p><p>The last piece of configuration is for notifications and backups.</p><p>Here you configure recipient and sender email addresses for notifications. You can optionally choose</p><p>to configure an internal email server to use to send these.</p><p>You can also enable automatic backups, and to use this you need to set an encryption password for</p><p>the backup files.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 15</p><p>Copyright © 2024 Sophos Ltd</p><p>Simulation: Sophos Firewall Initial Setup Wizard</p><p>In this simulation you will configure Sophos Firewall using</p><p>the initial setup wizard.</p><p>https://training.sophos.com/fw/simulation/InitialSetup/2/start.html</p><p>LAUNCH SIMULATION CONTINUE</p><p>Please complete this simulation.</p><p>Click Launch Simulation to start. Once you have finished, click Continue.</p><p>[Additional Information]</p><p>https://training.sophos.com/fw/simulation/InitialSetup/2/start.html</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 16</p><p>https://training.sophos.com/fw/simulation/InitialSetup/2/start.html</p><p>Copyright © 2024 Sophos Ltd</p><p>Resetting the Secure Storage Master Key</p><p>Additional information in</p><p>the notes</p><p>During the initial setup you will have set a secure storage master key, which cannot be recovered if</p><p>lost. While the secure storage master key cannot be recovered, it can be reset. This is done via the</p><p>command line using the default super administrator account.</p><p>Login to the console of the Sophos Firewall as ‘admin’ and select option 2 for System Configuration,</p><p>then option 5 to Reset the secure storage master key.</p><p>[Additional Information]</p><p>https://doc.sophos.com/nsg/sophos-firewall/20.0/help/en-</p><p>us/webhelp/onlinehelp/CommandLineHelp/SystemSettings/ResetSSMK/index.html</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 17</p><p>Copyright © 2024 Sophos Ltd</p><p>Chapter Review</p><p>The CLI can be used to change the IP address of the management port so that you can connect to the web</p><p>admin console to complete the initial setup wizard.</p><p>The Initial Setup Wizard provides a web interface to configure and claim the firewall.</p><p>The secure storage master key is used to provide additional protection for account and password details</p><p>stored in the device and in configuration backups.</p><p>Here are the three main things you learned in this chapter.</p><p>The CLI can be used to change the IP address of the management port so that you can connect to the</p><p>web admin console to complete the initial setup wizard.</p><p>The Initial Setup Wizard provides a web interface to configure and register the firewall.</p><p>The secure storage master key is used to provide additional protection for account and password</p><p>details stored in the device and in configuration backups.</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 23</p><p>Copyright © 2024 Sophos Ltd</p><p>Deploying Sophos Firewall Using the Initial Setup Wizard - 24</p>