Sophos Firewall v22 bolstered Secure by Design, taking it to a whole new level with major updates to the architecture and new features like the Health Check to help identify high-risk configurations.
Sophos Firewall v22 MR1 added several enhancements, including a new set of NDR detections for active threats.
Now Sophos Firewall v22 MR2 adds several additional capabilities to help with generative AI application control, detection of post-quantum cryptography, enhanced Chromebook support, and more. Read on for the full details.
Detection and control of Post-Quantum Cryptography
A new type of “quantum-safe” encryption called PQC is emerging to protect against future attacks by quantum computers. Unfortunately, PQC encryption can potentially be used by attackers to evade detection.
Sophos Firewall can now spot when this new encryption is being used and control it and block it where needed. Intrusion prevention (IPS) now detects and blocks pure and hybrid PQC key exchange algorithms based on ML-KEM, while Web Protection prevents web sessions from negotiating unsupported PQC algorithms. This helps enforce cryptographic policies and control unauthorized encrypted communications.
Generative AI application control
One challenge many organizations are facing is safe adoption of generative AI, which simply means providing access to the apps you want while blocking access to the apps you don’t.
It sounds simple, but many firewalls struggle to correctly identify the latest emerging AI apps at the network layer, allowing their use to slip through. Sophos Firewall, however, has a huge advantage when working with Sophos Endpoint and using Synchronized Security.
Sophos Endpoint has the unique advantage of running on the user’s device and can easily detect every app being used with absolute accuracy. Thanks to Synchronized Security App Control, it can share that information seamlessly with the firewall to be used in app control policies.
With Sophos Firewall v22 MR2, Sophos Firewall takes advantage of the latest enhancements to Sophos Endpoint’s detection of generative AI apps. It can now more accurately identify generative AI applications and immediately shares that information with Sophos Firewall to enhance visibility, reporting, and policy control.
Enhanced Chromebook support
A new version of the Chromebook User ID extension is now available. It supports Manifest V3, the latest version of the Chrome extension platform. All users must uninstall the previous Sophos Chromebook User ID extension and install the new extension.
For more information, please review: Sophos Chromebook User ID SSO extension with Manifest V3 support is available.
Let’s Encrypt
As you may know, Let’s Encrypt provides free security certificates that keep website connections trusted and encrypted. This update adds support for their latest certificates so everything remains compatible going forward. It also improves the email alerts by including the firewall’s name and serial number, making it much easier to tell exactly which firewall an alert is related to.
Specifically:
• Added support for the new Let’s Encrypt root and intermediate certificates YE Root, YE1, YE2, YR Root, YR1, and YR2 to ensure compatibility with the latest Let’s Encrypt certificate chains.
• Enhanced Let’s Encrypt email notifications to include the firewall hostname and serial number, making it easier to identify and manage firewalls.
STAS authentication
The default STAS setting for Restrict client traffic during identity probe has been changed to “No.” This minimizes disruption by allowing client traffic to continue while the firewall checks for a match between the user and destination address. If you are currently using STAS, you need to check this setting before updating to MR2: Learn more.
Note: eDirectory authentication End-of-Life notification
Sophos Firewall will discontinue its support for Novell eDirectory authentication servers in the upcoming SFOS 23.0. If your firewall uses eDirectory authentication, you must migrate to a supported authentication type before you upgrade to SFOS 23.0 or later. Learn more.
Sophos Firewall Config Studio v2.6
The product team has also released Sophos Firewall Config Studio v2.6, a powerful browser-based tool that simplifies how you view, analyze, compare, and edit firewall configurations. This new release adds support for the following capabilities:
• Merge templates: Combine baseline configurations with industry-specific templates to quickly create customized firewall configurations that align with your deployment requirements.
• Enhanced global search: Quickly locate configuration objects and navigate directly to them with a single click.
• Improved configuration report: Configuration reports now display referenced object values and details within Firewall, NAT, and TLS rules, providing greater visibility and context during configuration reviews
• Migration insights: Config Studio now provides migration conversion insights, including the overall percentage of configuration successfully migrated.
• Multi-file configuration diff: Upload and compare multiple configuration files to identify changes across different points in time.
• Backup-restore compatibility, Flexi module and port speed reference: Quickly verify backup-restore compatibility and port layouts across different Sophos Firewall models. The tool also provides compatibility information for Flexi Port modules on 1U and 2U appliances, along with supported port speeds and standards, helping you identify which firewall models and modules support interfaces such as 25G, 40G, 100G connectivity.
To use the tool, click Sophos Firewall Config Studio. For more details, refer to the What’s New overview of Sophos Firewall Config Studio.
Issues resolved
• Overall, v22.0 MR2 resolved 50+ important reliability, stability, and security fixes
Release notes
Check out the full release notes.
Keep your firmware up to date
It’s extremely important to ensure your firewall firmware is kept up to date as every release integrates important security and stability fixes. Since all firmware updates are free for licensed Sophos Firewall customers with a valid support license (included with the Xstream Protection bundle), there’s no reason not to take advantage of all the great enhancements in every release.
About Author
