Sophos Copernicus is now out of Beta and Has a New Name, Sophos XG Firewall

[Jason 84]

How often has Sophos been pushing updates for XG via their Up2Date system so far? By sounds of it, there should be packages deployed in a daily interval. Is this happening?

 

 

Sent from my iPhone using Tapatalk

[itGeeks 187]

How often has Sophos been pushing updates for XG via their Up2Date system so far? By sounds of it, there should be packages deployed in a daily interval. Is this happening?

 

 

Sent from my iPhone using Tapatalk

I just checked and I got 4 updates Dec 14-2015 prior to that the last update was Nov 23-2015 so by no means has there been daily updates to my Sophos XG box. By the way your post is good awareness to the product. Just for the record though I was not getting daily updates on UTM9.x either.

 

Thanks

Edited December 14, 2015 by itGeeks

[nrf 135]

right now xg is like windows vista. when it becomes windows 7 I will be there. no benefit in the meantime.

[itGeeks 187]

I stuck with Sophos XG and now that I have my Wifi AP installed decided to start to check out some of the more useful features of Sophos.

 

Has anyone got the antivirus/malware detection to work?

 

I'm trying to test it out using the payloads on wicar.org but the virus is not picked up by Sophos at all :-(

 

Windows defender and google chrome detect and delete it, but I wouldn't have expected it to even get past the gateway to be honest...

 

I have a horrible feeling I'm gonna have to sit down and read through the massive admin guide, but it's safe to say that Sophos XG is one very weird bit of software.

You must have somthing miss configured becouse testing wicar links below are blocked by my Sophos XG-

Fake virus test 1 http://www.eicar.org/download/eicar.com

Fake virus test 2 http://www.eicar.org/download/eicar_com.zip

Fake virus test 3 http://www.eicar.org/download/eicarcom2.zip

 

If you notice these test are from the HTTP section of the site, If your trying to test the HTTPS downloads you need to have "Decrypt & Scan HTTPS" enabled in your policy, For HTTP scanning you need to have Scan HTTP enabled in the policy. These settings are under the heading Malware Scanning. I do not have "Decrypt & Scan HTTPS" enabled right now because I don't want to deal with installing certs right now so I only scan HTTP at the moment.

Edited December 15, 2015 by itGeeks

[psykix 27]

Yeah, I did post again after that saying it was because the webfilter was not on.

 

By the way, even with the webfilter off and decrypt & scan on it still breaks video streaming sites.

 

Sucks!

[nrf 135]

so is the decrypt and scan doing it in batch perhaps?

and if it is scanning in realtime I wonder how much iron is required to do that at video bitrates without adding lumpiness to the stream

[CaffeinatedTech 0]

I've been configuring this in between work for the last day and discovered that the web filter is causing the Blizzard updater to fail.  Several people in the house play WoW and can't update unless I disable the web filter.  So I'm not going to create an exception for those machines like itGeeks' workaround for devices, these are PCs I want to protect.

 

I've been away from Sophos UTM for a while now, using pfsense instead.  I'm beginning to wander again however, as I can't get pfsense web filter to be as good as I want it.  I used UTM back when it was Astaro Security Gateway and during the transition to Sophos.  I stepped away from it originally because I found the QoS to be inferior.  Guess I'll go back to UTM 9 and check out what's new.

[itGeeks 187]

I've been configuring this in between work for the last day and discovered that the web filter is causing the Blizzard updater to fail.  Several people in the house play WoW and can't update unless I disable the web filter.  So I'm not going to create an exception for those machines like itGeeks' workaround for devices, these are PCs I want to protect.

 

I've been away from Sophos UTM for a while now, using pfsense instead.  I'm beginning to wander again however, as I can't get pfsense web filter to be as good as I want it.  I used UTM back when it was Astaro Security Gateway and during the transition to Sophos.  I stepped away from it originally because I found the QoS to be inferior.  Guess I'll go back to UTM 9 and check out what's new.

Do you know the url that's being used for the update? if you know the url or after you figure out what url is being used follow the directions below and please post back the results after you try it.

 

I had a similar issue with Playstation 4 updates for various games... this is what I did to fix.

 

Click on the PROTECTION > Web Protection > Web Content Filter

 

Scroll towards the bottom to the HTTP Scanning Rules section (there will be a default ALL include, or specifically SCAN entry)

 

Click ADD and give it a name, Blizard Updates exclude.

Both Source and Destination addresses can be asterisks.

The URL, you will need to determine the URL to specific to exempt - sorry, not a WoW user here... use the Web Filter logs to determine this.

Click SAVE and test again.

[nrf 135]

hmmm. thanks for that tidbit. with it I think I could replicate the url-specific exception rules of the 'drashna' variety on xg. does it support patterns?

I will also interpret this as an answer to my previous question about usability of the logs. if there is enough data there to set up these exceptions it would be great.

Edited December 16, 2015 by nrf

[CaffeinatedTech 0]

Do you know the url that's being used for the update? if you know the url or after you figure out what url is being used follow the directions below and please post back the results after you try it.

 

I had a similar issue with Playstation 4 updates for various games... this is what I did to fix.

 

Click on the PROTECTION > Web Protection > Web Content Filter

 

Scroll towards the bottom to the HTTP Scanning Rules section (there will be a default ALL include, or specifically SCAN entry)

 

Click ADD and give it a name, Blizard Updates exclude.

Both Source and Destination addresses can be asterisks.

The URL, you will need to determine the URL to specific to exempt - sorry, not a WoW user here... use the Web Filter logs to determine this.

Click SAVE and test again.

 

Yeah I see URLs in the logs, mostly akamai, but there are no deny entries.  It doesn't matter which content filter category is selected, the update fails.  I'll try to add those exceptions shortly and see what happens.