Sophos Firewall v21.5 is now out there – Sophos Information

Following a really busy and profitable early entry program, the Sophos Firewall staff is happy to announce that v21.5 is now out there to all licensed Sophos companions and clients.

This launch brings an industry-first innovation: integrating Community Detection and Response (NDR), which boosts energetic menace detection in your community.

What’s new overview

Watch this temporary video for an summary of the discharge highlights:

Be taught extra

Watch these demo movies for deeper insights into the best way to benefit from the foremost new options or seek the advice of the earlier sequence of articles on this launch:

Moreover, overview the What’s New Information, seek the advice of the Launch Notes, or learn on for extra particulars.

Full particulars

An {industry} first innovation: NDR Necessities

Sophos is the primary to combine an NDR answer with a firewall, additional extending Sophos Firewall’s benefits with XDR and MDR use circumstances.

We’ve taken the novel strategy of implementing NDR within the Sophos Cloud to dump all evaluation processing from the firewall, eliminating any efficiency hit.

We’re calling this NDR Necessities, and the very best half is, we’re enabling this for all XGS Sequence firewall clients who’ve the Xstream Safety license bundle – at no additional cost.

How NDR Necessities works

Sophos Firewall’s XGS Sequence captures meta knowledge from TLS encrypted site visitors and DNS queries and sends that data to NDR Necessities within the Sophos Cloud the place the info is analyzed utilizing a number of AI engines.

It will possibly detect malicious encrypted payloads with out performing TLS decryption. This addresses an enormous blind spot in most organizations the place man-in-the-middle TLS inspection just isn’t getting used for efficiency, usability, or safety causes.

As well as, the NDR Necessities area era algorithm detects new and suspect domains generated by malware which can be typically a key indicator of compromise. The truth is, in lots of circumstances, NDR Necessities can detect new C2 domains earlier than they’re even registered.

The meta knowledge extraction is carried out by a brand new light-weight engine carried out on the Xstream FastPath, and consequently, one caveat with this new functionality is that it’s only out there on XGS Sequence {hardware} firewalls.  Digital, software program, and cloud firewalls could get this NDR Necessities integration functionality sooner or later, however not in v21.5.

Different enhancements and high requested options

Entra ID (Azure AD) single sign-on for distant entry VPN

Considered one of your high requested options makes distant entry VPN simpler for finish customers, enabling them to make use of their company community credentials with the Sophos Join consumer and the firewall VPN portal:

• Entra ID (Azure AD) single-sign on integration with Sophos Join and the VPN portal is now included in SFOS v21.5
• It supplies cloud-native integration over the {industry} commonplace OAuth 2.0 and OpenID Join protocols for a seamless expertise
• Supported with Sophos Join consumer 2.4 (and later) on Microsoft Home windows
• Different VPN and scalability enhancements

Person interface and value enhancements

Connection sorts have been renamed from “site-to-site” to “policy-based,” and tunnel interfaces have been renamed to “route-based” to make these extra intuitive.

• Improved IP lease pool validation: Throughout SSLVPN, IPsec, L2TP, and PPTP distant entry VPN to eradicate potential IP conflicts
• Strict profile enforcement: On IPsec profiles that exclude default values to make sure a profitable handshake, eliminating potential packet fragmentation and tunnels failing to determine correctly
• Route-based VPN scalability: Route-based VPN capability is doubled with assist for as much as 3,000 tunnels
• SD-RED scalability: Sophos Firewalls now assist as much as 1,000 site-to-site RED tunnels and as much as 650 SD-RED units.

Sophos DNS Safety

Final yr, we launched our DNS Safety service and made it free for all Xstream Safety-licensed firewall clients. With this launch, Sophos DNS Safety will get additional integration with Sophos Firewall.

• New Management Middle widget to point service standing
• New troubleshooting insights by way of logging and notifications
• New guided tutorial on the best way to arrange Sophos DNS Safety simply

Streamlined administration and quality-of-life enhancements

As with each Sophos Firewall launch, this model contains a number of quality-of-life enhancements that make day-to-day administration simpler.

• Resizable desk columns: An extended-requested function, many firewall standing and configuration screens now assist resizable column widths which can be retained in browser reminiscence for subsequent visits. Many screens comparable to SD-WAN, NAT, SSL, Hosts and providers, and site-to-site VPN all profit from this new function.
• Prolonged free textual content search: SD-WAN routes now allow looking out by route title, ID, objects, and object values like IP addresses, domains, or different standards. Native ACL guidelines additionally now assist looking out by object title and worth, together with content-based search.
• Default configuration: By common demand, the default firewall guidelines and rule group beforehand created when organising a brand new firewall have been eliminated, with solely the default community rule and MTA guidelines offered throughout preliminary setup. The default firewall rule group and the default gateway probing for customized gateways are each set to “None” by default.
• New font: The Sophos Firewall consumer interface now sports activities a brand new lighter, cleaner, sharper font for added readability and improved efficiency

Different enhancements

• Digital, software program, cloud licensing: In case you missed it, all Sophos Firewall digital, software program, and cloud licenses (BYOL) not have RAM limits. Licenses at the moment are strictly restricted by core rely and don’t have any RAM restrictions.
• Bigger file dimension restrict in WAF: Helps a configurable request (add) file dimension restrict for Internet Utility Firewall (WAF), which might now scan recordsdata as much as 1 GB
• Safe by design: We’re regularly bettering the safety of Sophos Firewall, and on this launch are including real-time telemetry gathering to flag any surprising modifications to core OS recordsdata utilizing safe hash validation. This may allow our monitoring groups to proactively establish potential safety incidents early earlier than they’ll develop into an actual drawback.
• DHCP prefix delegation leisure: Now helps /48 to /64 prefixes, bettering interoperability with ISPs. Router commercials (RA) and the DHCPv6 server are additionally now enabled by default.
• Path MTU discovery: This may resolve TLS decryption errors because of the newest ML-KEM (Kyber) key trade assist in browsers. The Sophos Firewall deep packet inspection engine will now mechanically detect and alter the MTU for every move, making certain optimum efficiency primarily based on particular community circumstances.
• NAT64 (IPv6 to IPv4 site visitors): NAT64 is supported for IPv6 to IPv4 site visitors in express proxy mode. On this mode, IPv6-only shoppers can entry IPv4 web sites. The firewall additionally helps IPv4 upstream proxy for IPv6-only shoppers.

How one can get v21.5

As with each firewall launch, Sophos Firewall v21.5 is a free improve for Sophos Firewall clients with Enhanced or Enhanced Plus Assist and must be utilized to all supported firewall units as quickly as attainable. This launch not solely comprises nice options and efficiency enhancements, but in addition necessary safety fixes.

Sophos Firewall v21.5 is a completely supported improve from any supported Sophos Firewall firmware model.

This firmware launch will observe our commonplace replace course of. The brand new v21.5 firmware might be step by step rolled out to all related units over the approaching weeks. A notification will seem in your native gadget or Sophos Central administration console when the replace is accessible, permitting you to schedule the replace at your comfort.

You may both wait till the firmware replace notification seems in Sophos Central or your native gadget console, or you possibly can manually obtain the newest Sophos Firewall firmware from Sophos Central at any time.

Right here’s a fast reminder about the best way to get the newest firmware from Sophos Central:

1. Log in to your Sophos Central account and choose “Licensing” from the drop-down menu below your account title within the high proper of the Sophos Central console.

2. Choose Firewall Licenses on the highest left of this display screen.

3. Increase the firewall gadget you’re involved in updating by clicking the “>” to point out the licenses and firmware updates out there for that gadget.

4. Click on the firmware launch you need to obtain (observe there may be at the moment a problem with downloads working in Safari, so please use a distinct browser comparable to Chrome).

5. You too can click on “Different downloads” in the identical field above to entry preliminary installers and software program platform firmware updates.

Once more, the brand new v21.5 firmware might be step by step rolled out to all related units over the approaching weeks. A notification will seem in your native gadget or Sophos Central administration console when the replace is accessible, permitting you to schedule the replace at your comfort.