This article guides the configuration of IPsec Site-to-Site VPN between two Sophos Firewall XGS devices using firmware v22, in order to establish a secure connection between two network systems located at two different sites.

Objectives of the lab:

• Successfully establish an IPsec tunnel between the two firewalls.
• Allow the two LAN networks at the two sites to access and exchange data with each other.
• Ensure that all traffic transmitted through the Internet is securely encrypted.
• Check and verify the operating status of the VPN Tunnel.
• Clearly understand the operation mechanism of Phase 1 (IKE SA) and Phase 2 (IPsec SA) in the VPN establishment process.

Deployment environment:

• 02 Sophos Firewall XGS (Virtual Appliance).
• Installed on the Proxmox VE virtualization platform.
• Both ends use static WAN IP addresses, provided by a real firewall/router to simulate a real environment.

The enterprise has two sites using two Sophos Firewall XGS devices connecting to the Internet through a Viettel router with WAN IP addresses 123.123.123.11 and 123.123.123.15 respectively.

Each site has its own LAN network which is 100.100.100.0/24 and 200.200.200.0/24.

Currently these two networks cannot access each other through the Internet.

The requirement is to allow the two LAN networks to communicate securely and stably.

The solution is to deploy an IPsec Site-to-Site VPN to encrypt and connect the two systems through the Internet.

• Prepare configuration information
• Create Network Object (Host/Subnet)
• Configure IPsec Site-to-Site VPN
• Create Firewall Rule to allow LAN VPN traffic

Step 2: Add Local and Remote LAN Network

Go to Hosts and services → IP Host → Add to add the local and remote LAN network as shown in the image below.

Go to Site to site → IPsec → Add

• IP Version: IPv4 → The tunnel uses IPv4 addresses to establish IKE and transmit ESP data.
• Connection Type: Policy-based → Only the subnets declared in Local subnet and Remote subnet are allowed to pass through the tunnel.
• Gateway Type: Respond only → This firewall does not initiate the connection, it only responds when the other side initiates it.
• Profile: IKEv2 → A newer VPN standard, more stable and secure than IKEv1.
• Authentication: Preshared Key (PSK) → Both firewalls use the same shared secret password.

• Listening interface: 123.123.123.11 → This is the WAN IP of this firewall, the firewall will wait for VPN connections at this IP.
• Gateway address: 123.123.123.15 → This is the WAN IP of the other firewall, the VPN will connect to this IP.
• Local Subnet: LOCAL_VLAN_100 → The internal network on this side that is allowed to pass through the VPN.
• Remote Subnet: VPN_VLAN_200 → The internal network on the other side.

• Rule name: VPN_SF_TO_SF1
• Action: Accept → Allow traffic to pass
• Log firewall traffic: Check → Log traffic for verification when necessary

• Source zones: LAN, VPN → Meaning traffic can originate from the internal network or from the VPN side.
• Source networks: LOCAL_VLAN_100, VPN_VLAN_200 → Only these networks are allowed to use this rule.
• Destination zones: LAN, VPN → Allow two-way access between LAN and VPN.
• Destination networks: LOCAL_VLAN_100, VPN_VLAN_200
• Services: Any → Allow all services (ping, RDP, SMB, HTTP…)

Go to Site to site VPN → IPsec → Check Active and Connection to enable the configuration.

Go to Hosts and services → IP Host → Add to add the local and remote LAN network as shown below.

Go to Site-to-Site VPN → IPsec and select Add.

Create the connection with the parameters below.

Go to Rules and Policies → Firewall rules → Add as shown below.

• Go to Site to site → IPsec → Check Active and Connection to start the connection.
• From a computer in LAN 100.100.100.0/24, ping a computer in LAN 200.200.200.0/24 → ping successful.
• Conversely, from a computer in LAN 200.200.200.0/24, ping a computer in LAN 100.100.100.0/24 → ping successful.

This article aims to:

• Guide how to monitor and filter Sophos Firewall logs on Sophos Central.
• Guide how to export reports for operational and reporting purposes.
• Help administrators quickly detect incidents and security threats.

Through this, the system can be monitored effectively and operate more securely.

Sophos Central helps administrators monitor and manage all Sophos Firewall devices through a single web interface, without needing to log in to each device individually.

To monitor, track, and export overview reports for Firewall devices, do the following:

On Sophos Central, select:

My Products → Firewall Management → Report Generator

Report Generator is a tool that allows administrators to monitor, track, and create customized reports for Sophos Firewall.

• Firewalls: choose the Firewall that needs to export the report.
• Report Template: choose the available template that suits the monitoring needs, details include:
  • Antivirus: Malware or suspicious objects that have been blocked.
  • Bandwidth usage: Bandwidth usage by each application.
  • Cloud app risks and usage: Cloud applications being used and related risks.
  • Firewall: Number of connections between specific IP addresses.
  • IPS: Attacks detected/blocked by the IPS system.
  • Log viewer and search: Detailed firewall logs (table-only format).
  • SD-WAN: Summary of SLA performance for each SD-WAN profile, including trend charts.
  • SD-WAN SLA trend: SLA trends by gateway (jitter, latency, packet loss).
  • SD-WAN Bandwidth usage: Bandwidth statistics by gateway and over time.
  • Security posture assessment (SPA): Overall evaluation of the system’s security level.
  • (You can select up to 10 components such as: Bandwidth, Web usage, Threat geo activity…)
  • (Recommended to use)
  • Synchronized app: Statistics of applications identified by Synchronized App Control.
  • Threat geo activity: Threats blocked by country.
  • Threats and events blocked: All threats/events that have been blocked.
  • VPN usage: Usage level of VPN connections.
  • Web usage: Website access statistics.
  • Web user risk: Web activity of users accessing high-risk websites.
  • X-Ops: Advanced threat activities detected/blocked by the firewall, including traffic in MDR.
  • Zero-day protection: Suspicious files/emails sent to the Sandstorm analysis module.

• Time Frame: choose the appropriate time period based on the monitoring requirements.
• Query: optional query to filter data according to monitoring needs.

After that, click Schedule to schedule report delivery:

• Template Name: set the name of the report template.
• Export scheduling: enable/disable automatic report exporting according to schedule.
• Time frame: choose the data time range included in each report.
• Export frequency: choose the report export interval.
• Export format: choose the exported file format (PDF, CSV, HTML).
• Export notification / delivery: choose how the report email will be sent.
• Send this export to other Sophos admins?: choose whether to share the report with other administrators.

After completing the configuration, click Save.

A notification will appear indicating that the Template and Schedule have been created successfully.

According to the configured schedule, Sophos will automatically export the report file based on the configured settings.

This article guides how to configure IPSec VPN Site-to-Site between two firewall devices: Fortinet Firewall and Sophos Firewall, in order to securely connect LAN networks at two different sites through the Internet.

After the configuration is completed, the following LAN networks can connect and access each other:

192.168.20.0/24 – Site B

172.16.16.0/24 – Site A

10.10.10.0/24 – Site B

Site A – Fortinet Firewall

• The Internet line is connected to the WAN port of the Fortinet device.
• WAN IP: 192.168.1.2
• Internal LAN network: 172.16.16.0/24
• The LAN is configured on the LAN interface of Fortinet.

Site B – Sophos Firewall

• The Internet line is connected to interface a (WAN) of the Sophos Firewall.
• WAN IP: 192.168.1.3
• The internal LAN network consists of two subnets: 10.10.10.0/24,192.168.20.0/24

• The VPN connection uses IPSec Site-to-Site.
• Authentication uses a Pre-shared Key.
• IKEv2 is used.

• Fortinet (192.168.1.2)
• Sophos (192.168.1.3)

LAN network 172.16.16.0/24 (Fortinet) ⬄ LAN networks 10.10.10.0/24 and 192.168.20.0/24 (Sophos) can connect and communicate with each other directly.

• Create VPN Tunnels
• Create Static Route
• Create Firewall Policy

• Create subnet
• Create IPSec Profile
• Create IPSec Connection
• Create Firewall Rule

translate this post to english exactly: I – Tổng quan về Activate và Renew License Sophos Firewall Bài viết hướng dẫn cách activate và renew license Sophos Firewall thông qua Sophos Central. Sophos Central là nền tảng quản lý tập trung cho phép quản lý thiết bị, license và đồng bộ trạng thái license từ cloud về firewall. II – Hướng dẫn Activate License Sophos Firewall 1. Tạo tài khoản Sophos Central Nếu chưa có tài khoản Sophos Central, tham khảo: https://thegioifirewall.com/sophos-central-huong-dan-tao-tai-khoan-sophos-central-trial/ Đăng nhập Sophos Central bằng tài khoản Super Admin. 2. Claim thiết bị Sophos Firewall – Vào Account → Licensing Firewall licenses – Chọn Firewall licenses  – Chọn Claim firewall  – Nhập Serial Number thiết bị  Sau khi claim thành công, thiết bị sẽ hiển thị trong danh sách quản lý. 3. Apply License cho thiết bị – Chọn thiết bị → Apply subscriptions – Nhập License Key – Preview subscription → Apply license 4. Đồng bộ License về Firewall – Vào Sophos Firewall → Administrator → Device access – Nhấn Synchronize III – Lưu ý khi Renew License Sophos Firewall Đối với các lần gia hạn (renew) license trong tương lai, cần lưu ý – License Number: chỉ dùng để tracking và support, không dùng để activate. – License Key: bắt buộc để kích hoạt hoặc renew license. 1. Cơ chế đồng bộ license khi renew: Trong hầu hết các trường hợp, nếu Sophos Firewall đã được liên kết đúng Sophos Central account, license sau khi renew sẽ tự động đồng bộ xuống thiết bị mà không cần thao tác thủ công. Tuy nhiên, nếu license không tự đồng bộ và vẫn hiển thị trạng thái Expired, bạn có thể thực hiện các bước sau: Kiểm tra license trong Sophos Central hoặc Sophos Partner Portal để xác định License Key tương ứng Thực hiện apply License Key thủ công cho thiết bị Firewall (theo hướng dẫn ở Mục II.3) 2. Trường hợp không nhận được License Key: Nếu email gia hạn không chứa License Key, khuyến nghị: Kiểm tra lại thông tin license trong Sophos Portal Hoặc liên hệ Sophos Support / Partner để xác nhận chính xác License Key trước khi apply

I – Overview of Activate and Renew License Sophos Firewall

This article guides how to activate and renew a Sophos Firewall license through Sophos Central.
Sophos Central is a centralized management platform that allows management of devices, licenses, and synchronization of license status from the cloud to the firewall.

II – Guide to Activate Sophos Firewall License

1. Create a Sophos Central account

If you do not have a Sophos Central account yet, refer to:
https://thegioifirewall.com/sophos-central-huong-dan-tao-tai-khoan-sophos-central-trial/

Log in to Sophos Central using a Super Admin account.

2. Claim the Sophos Firewall device

• Go to Account → Licensing Firewall licenses
• Select Firewall licenses
• Select Claim firewall
• Enter the device Serial Number

After a successful claim, the device will appear in the management list.

3. Apply License to the device

• Select the device → Apply subscriptions
• Enter the License Key
• Preview subscription → Apply license

4. Synchronize License to the Firewall

• Go to Sophos Firewall → Administrator → Device access
• Click Synchronize

III – Notes when Renewing Sophos Firewall License

For future license renewals, please note:

• License Number: only used for tracking and support, not used for activation.
• License Key: required to activate or renew the license.

1. License synchronization mechanism when renewing

In most cases, if the Sophos Firewall has been properly linked to the Sophos Central account, the license after renewal will automatically synchronize to the device without requiring manual action.

However, if the license does not automatically synchronize and still shows Expired status, you can perform the following steps:

Check the license in Sophos Central or Sophos Partner Portal to determine the corresponding License Key

Manually apply the License Key to the Firewall device (according to the instructions in Section II.3)

2. Case when the License Key is not received

If the renewal email does not contain the License Key, it is recommended to:

Check the license information again in the Sophos Portal

Or contact Sophos Support / Partner to confirm the correct License Key before applying it.

translate this post to english exactly:https://vacif.com/moi-nhat-2026-huong-dan-activate-renew-license-sophos-firewall/

Here is the exact English translation of the post from:
[MỚI NHẤT 2026] – HƯỚNG DẪN ACTIVATE & RENEW LICENSE SOPHOS FIREWALL

[LATEST 2026] – GUIDE TO ACTIVATE & RENEW SOPHOS FIREWALL LICENSE

I – Overview of Activate and Renew Sophos Firewall License

This article guides how to activate and renew the Sophos Firewall license through Sophos Central.

Sophos Central is a centralized management platform that allows managing devices, licenses, and synchronizing license status from the cloud to the firewall. 

II – Guide to Activate Sophos Firewall License

1. Create a Sophos Central account

If you do not yet have a Sophos Central account, refer to:
https://thegioifirewall.com/sophos-central-huong-dan-tao-tai-khoan-sophos-central-trial/

Log in to Sophos Central using a Super Admin account.

2. Claim the Sophos Firewall device

• Go to Account → Licensing → Firewall licenses
• Select Firewall licenses
• Select Claim firewall
• Enter the device Serial Number

After claiming successfully, the device will appear in the management list.

3. Apply License to the device

• Select the device → Apply subscriptions
• Enter the License Key
• Preview subscription → Apply license

4. Synchronize License to the Firewall

• Go to Sophos Firewall → Administrator → Device access
• Click Synchronize

III – Notes when Renewing Sophos Firewall License

For future license renewals, please note:

• License Number: only used for tracking and support, not used for activation.
• License Key: required to activate or renew the license.

1. License synchronization mechanism when renewing

In most cases, if the Sophos Firewall has been correctly linked to the Sophos Central account, the license after renewal will automatically synchronize to the device without requiring manual operations.

However, if the license does not automatically synchronize and still shows the Expired status, you can perform the following steps:

• Check the license in Sophos Central or Sophos Partner Portal to determine the corresponding License Key
• Manually apply the License Key to the Firewall device (according to the instructions in Section II.3) 

2. Case when the License Key is not received

If the renewal email does not contain the License Key, it is recommended to:

• Check the license information again in the Sophos Portal
• Or contact Sophos Support / Partner to confirm the correct License Key before applying it. 

If you want, I can also help you rewrite this translation to sound more natural for a blog post in English (keeping the meaning but making it read like native technical documentation).

translate this post to english exactly: https://vacif.com/en/moi-nhat-2026-sophos-firewall-huong-dan-theo-doi-xuat-report-tu-sophos-firewall-v22/

Here is the exact English translation of the post from:
https://vacif.com/moi-nhat-2026-sophos-firewall-huong-dan-theo-doi-xuat-report-tu-sophos-firewall-v22/ (translated literally line‑by‑line where appropriate):

[Latest 2026] Sophos Firewall: Guide to Monitoring & Exporting Reports From Sophos Firewall V22

Table of Contents

• I – Overview of monitoring and exporting reports from Sophos Firewall V22
• II – Details on monitoring and exporting reports from Sophos Firewall V22
  • 1. Introduction to Report & Log features of Sophos Firewall
  • 1.1 – Dashboards
  • 1.2 – Application & Webs
  • 1.3 – Networks & Threat
  • 1.4 – VPN
  • 1.5 – Email
  • 1.6 – Compliance
  • 1.7 – Custom
  • 1.8 – Log Viewer
    2. How to export a Report on Sophos Firewall

I – Overview of Monitoring and Exporting Reports From Sophos Firewall V22

This article aims to:

• Guide how to view and filter logs on Sophos Firewall.
• Guide reading and exporting reports for operation and reporting.
• Help administrators quickly detect issues and security threats.

Through this, help the system be monitored effectively and operate more securely. 

II – Details on Monitoring and Exporting Reports From Sophos Firewall V22

1. Introduction to Report & Log Features of Sophos Firewall

1.1 – Dashboards

View information about network traffic passing through the firewall and security threats. The main dashboard types include:

• Traffic dashboard: classification by network traffic
• Security dashboard: blocked activities and threats: malware, IPS, spam, attack sources
• Executive report: summary information for managers: highlighted traffic & threats
• User threat quotient (UTQ): ranks users based on security risk score 

1.2 – Application & Webs

View information about application and Internet usage on your network.

Types of monitoring in this section include:

• User app risks & usage
• Cloud applications usage
• Blocked user apps
• Synchronized applications
• Web risks & usage
• Blocked web attempts
• Search engine statistics
• Web content details
• Web server usage
• Web server protection 

1.3 – Networks & Threat

View information about network usage and related threats, including:

• Intrusion attacks
• Active threat response (Threat events detected by MDR and Sophos X‑Ops)
• Wireless usage
• Security Heartbeat status
• Zero‑day protection details 

1.4 – VPN

View information about remote users connecting to your network through IPsec VPN, SSL VPN, and Clientless Access. 

1.5 – Email

View information about email traffic and protection against viruses/spam in the system. 

1.6 – Compliance

View information about compliance reports for standards such as HIPAA, GLBA, SOX, FISMA, PCI, NERC CIP v3, CIPA, and Event levels. 

1.7 – Custom

Create reports based on specified criteria, including:

• Web Report: search web activity or virus logs
• Mail Report: search email, spam and virus activity
• FTP Report: search FTP activity
• User Report: statistics on high‑risk application usage and website access
• Web Server Report: search web server activity (time, user, URI) and protection events 

1.8 – Log Viewer

The Log Viewer displays event logs and updates automatically in real‑time. Administrators can select specific log types to monitor (such as Admin, Firewall, IPS, Malware, VPN, Web filter, etc.). 

2. How to Export Reports on Sophos Firewall

During system administration, administrators need comprehensive report files reflecting system usage and key threats. Therefore, in this guide the Executive Report is selected to perform report exporting.

To export a scheduled report:

• Select Show Reports Settings
• Choose Report Scheduling, then click Add
• Enter the following information:
  • Name: Name of the report schedule
  • Description: (optional)
  • To email address: email address that receives the report (can enter multiple emails)
  • Report type: Choose type (e.g., Report group)
  • Report group: Choose suitable report group (e.g., Executive Report)
  • Email frequency: Choose Daily or Weekly and the time to send the report via email
• After entering complete information, click Save

When the schedule runs as configured, Sophos will email the report file to the specified email address according to the schedule. 

If you want this translation formatted more naturally for an English technical article or documentation, feel free to ask!

translate this entire post to english exactly: https://vacif.com/en/moi-nhat-2026-sophos-firewall-huong-dan-theo-doi-xuat-report-tu-sophos-firewall-v22/

Below is the direct English translation of the article from
VACIF:
“[Mới nhất 2026] Sophos Firewall: Hướng Dẫn Theo Dõi & Xuất Report Từ Sophos Firewall V22”.
The structure and wording are kept as close as possible to the original text. 

[Latest 2026] Sophos Firewall: Guide to Monitoring & Exporting Reports from Sophos Firewall V22

Table of Contents

• I – Overview of monitoring and exporting reports from Sophos Firewall V22
• II – Details of monitoring and exporting reports from Sophos Firewall V22

I – Overview of Monitoring and Exporting Reports from Sophos Firewall V22

This article aims to:

• Guide how to view and filter logs on Sophos Firewall.
• Guide how to read and export reports for operation and reporting purposes.
• Help administrators quickly detect incidents and security threats.

Through this, the system can be monitored effectively and operated more securely. 

II – Details of Monitoring and Exporting Reports from Sophos Firewall V22

1 – Introduction to the Report & Log features of Sophos Firewall

1.1 – Dashboards

The dashboard allows administrators to quickly monitor network traffic and security threats occurring on the system.

Some common dashboards include:

• Traffic dashboard – classifies traffic passing through the firewall.
• Security dashboard – statistics on blocked activities and threats such as malware, IPS attacks, spam, and attack sources.
• Executive report – summary reports for management including highlighted traffic and threats.
• User Threat Quotient (UTQ) – evaluates user risk scores based on their activities on the network.

1.2 – Applications & Webs

This section provides information about application usage and web access activities within the network.

Monitoring items include:

• User app risks & usage
• Cloud app risks & usage
• Blocked user apps
• Synchronized apps
• Web risks & usage
• Blocked web attempts
• Search engine statistics
• Web content details
• Web server usage
• Web server protection

1.3 – Networks & Threat

Displays information related to network usage and security threats, including:

• Intrusion attacks
• Active Threat Response (threat events detected by MDR and Sophos X-Ops)
• Wireless usage
• Security Heartbeat status
• Zero-day protection details

1.4 – VPN

Displays information about remote users connecting to the network through VPN, including:

• IPsec VPN
• SSL VPN
• Clientless Access

1.5 – Email

Provides information about email traffic and spam/virus protection within the system.

1.6 – Compliance

Displays compliance reports related to standards such as:

• HIPAA
• GLBA
• SOX
• FISMA
• PCI
• NERC CIP v3
• CIPA
• Event levels

1.7 – Custom

Administrators can create custom reports based on specific criteria, including:

• Web Report – search web activity or virus logs
• Mail Report – search email activity, spam, and viruses
• FTP Report – search FTP activity
• User Report – statistics of high-risk application usage and website access
• Web Server Report – search web server activity (time, user, URI) and protection events

1.8 – Log Viewer

The Log Viewer displays system event logs and automatically updates in real time.

Administrators can select specific log types to monitor, such as:

• Admin
• Firewall
• IPS
• Malware
• VPN
• Web filter
• And other log categories.

2 – How to Export Reports on Sophos Firewall

During system administration, administrators often need report files summarizing system usage and security threats.

Therefore, in this guide the Executive Report is used as an example to export reports.

To export a scheduled report:

1. Select Show Report Settings.
2. Choose Report Scheduling, then click Add.
3. Enter the following information:

• Name – name of the report schedule
• Description – optional description
• To email address – email address receiving the report (multiple emails can be entered)
• Report type – select the report type (for example: Report group)
• Report group – choose the appropriate report group (for example: Executive Report)
• Email frequency – choose Daily or Weekly and the time to send the report via email

4. After completing the information, click Save.

Once the schedule runs according to the configuration, Sophos will automatically send the report file to the configured email address. 

If you want, I can also help you:

• Rewrite this into natural English technical documentation, or
• Convert it into a polished blog article for international readers.

translate this to english accurately:Application risk meter là cách thức mà Firewall sẽ tính điểm dựa trên mức độ rủi ro và số lần truy cập (hits) của từng ứng dụng. Chỉ số rủi ro ứng dụng được xác định dựa trên điểm trung bình của toàn bộ lưu lượng ứng dụng

Translation (accurate):

Application Risk Meter is the method by which the Firewall calculates a score based on the risk level and the number of accesses (hits) of each application.
The application risk index is determined based on the average score of all application traffic.

translate this article sentence by sentence accurately without leaving out details, follow their structure and style: https://vacif.com/moi-nhat-2026-sophos-firewall-huong-dan-theo-doi-xuat-report-tu-sophos-firewall-v22/

Below is the accurate sentence-by-sentence English translation following the original structure and style of the article
from VACIF:
VACIF – “[Mới nhất 2026] Sophos Firewall: Hướng Dẫn Theo Dõi & Xuất Report Từ Sophos Firewall V22”. 

[Latest 2026] Sophos Firewall: Guide to Monitoring & Exporting Reports from Sophos Firewall V22

Table of Contents

• I – Overview of monitoring and exporting reports from Sophos Firewall V22
• II – Details of monitoring and exporting reports from Sophos Firewall V22

I – Overview of monitoring and exporting reports from Sophos Firewall V22

This article aims to:

• Guide how to view and filter logs on Sophos Firewall.
• Guide how to read and export reports for operational and reporting purposes.
• Help administrators quickly detect incidents and security threats.

Through that, the system can be monitored effectively and operate more securely. 

II – Details of monitoring and exporting reports from Sophos Firewall V22

1 – Introduction to the Report & Log features of Sophos Firewall

1.1 – Dashboards

Dashboards allow administrators to view information about network traffic passing through the firewall and security threats.

Some main dashboard types include:

• Traffic dashboard: classifies traffic based on network traffic.
• Security dashboard: statistics of blocked activities and threats such as malware, IPS attacks, spam, and attack sources.
• Executive report: summary information for management, including highlighted traffic and threats.
• User Threat Quotient (UTQ): ranks users based on their security risk score.

1.2 – Application & Webs

Displays information about application usage and Internet activity within the network.

Monitoring items in this section include:

• User app risks & usage
• Cloud app risks & usage
• Blocked user apps
• Synchronized apps
• Web risks & usage
• Blocked web attempts
• Search engine statistics
• Web content details
• Web server usage
• Web server protection

1.3 – Networks & Threat

Displays information about network usage and related threats, including:

• Intrusion attacks
• Active threat response (threat events detected by MDR and Sophos X-Ops)
• Wireless usage
• Security Heartbeat status
• Zero-day protection details

1.4 – VPN

Displays information about remote users connecting to the network via VPN, including:

• IPsec VPN
• SSL VPN
• Clientless access

1.5 – Email

Displays information about email traffic and virus/spam protection in the system.

1.6 – Compliance

Displays compliance reports related to standards such as:

• HIPAA
• GLBA
• SOX
• FISMA
• PCI
• NERC CIP v3
• CIPA
• Event levels

1.7 – Custom

Allows administrators to create reports based on specific criteria, including:

• Web Report: search web activity or virus logs
• Mail Report: search email, spam, and virus activity
• FTP Report: search FTP activity
• User Report: statistics of high-risk application usage and website access
• Web Server Report: search web server activity (time, user, URI) and protection events

1.8 – Log Viewer

The Log Viewer displays system event logs and automatically updates in real time.

Administrators can choose specific log types to monitor, such as:

• Admin
• Firewall
• IPS
• Malware
• VPN
• Web filter
• and other log types.

2 – How to export reports on Sophos Firewall

During system administration, administrators often need report files summarizing system usage and important threats.

Therefore, in this guide the Executive Report is selected to perform report exporting.

To export a scheduled report:

1. Select Show Report Settings.
2. Choose Report Scheduling, then click Add.
3. Enter the following information:

• Name: name of the report schedule
• Description: optional description
• To email address: email address receiving the report (multiple emails can be entered)
• Report type: select the type (for example: Report group)
• Report group: choose the appropriate report group (for example: Executive Report)
• Email frequency: choose Daily or Weekly and the time to send the report via email

4. After completing the information, click Save.

When the schedule runs according to the configuration, Sophos will automatically send the report file to the specified email address according to the schedule. 

If you want, I can also make a cleaner “technical documentation style” English version (the one above is intentionally very literal to match the original Vietnamese structure).

translate this to english accurately Các nhóm Setting có thể theo dõi trong phần này, bao gồm: User app risks & usage: Thống kê việc sử dụng các ứng dụng và mức độ rủi ro tương ứng. Cloud applications usage: Thống kê việc sử dụng các ứng dụng đám mây Blocked user apps: Các lần truy cập ứng dụng bị chặn. Synchronized applications: Các ứng dụng được phân loại và đồng bộ từ endpoint lên firewall. Web risks & usage: Hoạt động truy cập web trong mạng và các rủi ro liên quan. Blocked web attempts: Các lần truy cập web bị chặn Search engine: Thống kê hành vi tìm kiếm của người dùn Web content: Các kết quả khớp của bộ lọc nội dung và các thông tin liên quan. Web server usage: Lưu lượng Application, Web, Internet và FTP. Web server protection: Trạng thái bảo mật của các Web Server, bao gồm các cuộc tấn công và nguồn tấn công. User data transfer: User traffic FTP usage: FTP activity FTP protection: Malicious FTP activity

The setting groups that can be monitored in this section include:

• User app risks & usage: Statistics on the usage of applications and their corresponding risk levels.
• Cloud applications usage: Statistics on the usage of cloud applications.
• Blocked user apps: Instances where application access was blocked.
• Synchronized applications: Applications that are classified and synchronized from endpoints to the firewall.
• Web risks & usage: Web access activity within the network and related risks.
• Blocked web attempts: Instances where web access attempts were blocked.
• Search engine: Statistics of users’ search behavior.
• Web content: Matches from the content filtering system and related information.
• Web server usage: Traffic of Applications, Web, Internet, and FTP.
• Web server protection: Security status of Web Servers, including attacks and attack sources.
• User data transfer: User traffic.
• FTP usage: FTP activity.
• FTP protection: Malicious FTP activity.

translate this to english accurately: Các nhóm Setting có thể theo dõi trong phần này, bao gồm: Intrusion attacks: Các lượt tấn công Active threat response: Threat events và các máy bị xâm nhập được phát hiện bởi MDR (Managed Detection and Response) và Sophos X-Ops Wireless: Access point và SSID được sử dụng Security Heartbeat: Tình trạng sức khỏe của máy trạm trong mạng dựa trên kết nối giữa máy trạm và Firewall. Zero-day protection: Bảo vệ nâng cao trước các cuộc tấn công mới.

The setting groups that can be monitored in this section include:

• Intrusion attacks: Attack attempts.
• Active threat response: Threat events and compromised machines detected by MDR (Managed Detection and Response) and Sophos X-Ops.
• Wireless: Access points and SSIDs being used.
• Security Heartbeat: The health status of endpoints within the network based on the connection between the endpoint and the Firewall.
• Zero-day protection: Advanced protection against new attacks.

translate this to english accurately: Xem thông tin về remote user (người dùng kết nối từ xa) vào hệ thống mạng của bạn thông qua IPSEC VPN, SSL VPN và Clientless access Các nhóm Setting có thể theo dõi trong phần này, bao gồm: VPN: Lưu lượng phát sinh từ remote users qua IPsec, L2TP hoặc PPTP SSL VPN: Lưu lượng phát sinh từ remote users thông qua SSL VPN Client. Clientless Access: Lưu lượng phát sinh từ remote users thông qua trình duyệt web. 1.5 – Email

View information about remote users (users connecting remotely) to your network system through IPsec VPN, SSL VPN, and Clientless Access.

The setting groups that can be monitored in this section include:

• VPN: Traffic generated by remote users through IPsec, L2TP, or PPTP.
• SSL VPN: Traffic generated by remote users through the SSL VPN Client.
• Clientless Access: Traffic generated by remote users through a web browser.

1.5 – Email

translate this to english accurately: Xem thông tin về email traffic (lưu lượng email) trong hệ thống mạng Các nhóm Setting có thể theo dõi trong phần này, bao gồm: Email Usage: Email traffic trong hệ thống mạng của mình Email Protection: Email Traffic bị Virus và Spam trong hệ thống mạng của mình

View information about email traffic in the network system.

The setting groups that can be monitored in this section include:

• Email Usage: Email traffic within the network system.
• Email Protection: Email traffic in the network system that contains viruses and spam.

translate this to english accurately: 1.6 – Compliance Xem thông tin về việc tuân thủ các quy định/quy chuẩn: Các nhóm Quy chuẩn có thể theo dõi trong phần này, bao gồm: HIPAA: Security Report tuân thủ chuẩn HIPAA GLBA: Security Report tuân thủ chuẩn GLBA SOX: Security Report tuân thủ chuẩn SOX FISMA: Security Report tuân thủ chuẩn FISMA PCI: Security Report tuân thủ chuẩn PCI NERC CIP v3: Security Report tuân thủ chuẩn NERC CIP v3 CIPA: Security Report tuân thủ chuẩn CIPA Events: Network Event và các mức độ nghiêm trọng tương ứng

1.6 – Compliance
View information about compliance with regulations/standards.

The standard groups that can be monitored in this section include:

• HIPAA: Security Report compliant with the HIPAA standard.
• GLBA: Security Report compliant with the GLBA standard.
• SOX: Security Report compliant with the SOX standard.
• FISMA: Security Report compliant with the FISMA standard.
• PCI: Security Report compliant with the PCI standard.
• NERC CIP v3: Security Report compliant with the NERC CIP v3 standard.
• CIPA: Security Report compliant with the CIPA standard.
• Events: Network events and their corresponding severity levels.

translate this to english accurately: Các loại Report có thể tạo trong phần này, bao gồm: Web Report: Tìm kiếm hoạt động duyệt web hoặc virus. Có thể lọc theo user, domain và các tiêu chí khác Mail Report: Tìm kiếm lưu lượng Email, Spam và Virus. Có thể lọc theo protocol, user và các tiêu chí khác. FTP Report: Tìm kiếm hoạt động FTP và Virus. Có thể lọc theo kiểu truyền, user, file hoặc source IP User Report: Thống kê mức độ sử dụng: ứng dụng rủi ro cao, website không hiệu quả, virus phát hiện. Có thể lọc theo username, source host. Web Server Report: Tìm kiếm hoạt động Web Server (time, user, URI) và cả các sự kiện bảo vệ Web Server.

The types of reports that can be created in this section include:

• Web Report: Search for web browsing activity or viruses. Can be filtered by user, domain, and other criteria.
• Mail Report: Search for Email traffic, Spam, and Viruses. Can be filtered by protocol, user, and other criteria.
• FTP Report: Search for FTP activity and viruses. Can be filtered by transfer type, user, file, or source IP.
• User Report: Statistics on usage levels such as high-risk applications, ineffective websites, and detected viruses. Can be filtered by username and source host.
• Web Server Report: Search for Web Server activity (time, user, URI) as well as Web Server protection events.

translate this to english accurately: Để truy cập, ở góc phải phía trên Sophos Firewall, nhấn Log viewer Để truy cập, ở góc phải phía trên Sophos Firewall, nhấn Log viewer

To access it, click Log Viewer in the top-right corner of the Sophos Firewall interface.

To access it, click Log Viewer in the top-right corner of the Sophos Firewall interface.

Cửa sổ Log Viewer mới sẽ xuất hiện, và quản trị viên có thể xem log Realtime ở đây

A new Log Viewer window will appear, and administrators can view logs in real time here.

translate this article fully sentence by sentence accurately without leaving out or changing details, following exact structure and style:, images is replace with [images] text,

Sure — please paste the article text here.

I cannot reliably access and extract the entire page content structure and images from the link alone in a way that guarantees:

• sentence-by-sentence translation
• no missing details
• exact structure
• accurate placement of [images]

Once you paste the article text, I will translate it with these rules:

1. Keep the exact headings and numbering (I, II, 1.1, 1.2, etc.).
2. Translate sentence-by-sentence accurately without changing meaning.
3. Do not remove or summarize any details.
4. Replace every image with [images] exactly where it appears.
5. Keep bullet lists and formatting identical to the original.

You can paste the article in multiple messages if it is long, and I will translate it section by section.

Below is the full sentence-by-sentence English translation, preserving the original structure, headings, lists, tables, and order.
Every image from the article is replaced with [images] exactly where it appears.
Source: 

[Latest 2026] Sophos Firewall: Guide to Configuring VPN Site-to-Site Between Fortinet Firewall and Sophos Firewall Firmware V22

I – Overview of the article

This article guides how to configure IPSec VPN Site-to-Site between two firewall devices: Fortinet Firewall and Sophos Firewall, in order to securely connect LAN networks at two different sites through the Internet. 

After the configuration is completed, the following LAN networks can connect and access each other:

• 172.16.16.0/24 – Site A
• 10.10.10.0/24 – Site B
• 192.168.20.0/24 – Site B

II – Network diagram

[images]

Explanation of the network diagram

 Site A – Fortinet Firewall

• The Internet line is connected to the WAN port of the Fortinet device.
• WAN IP: 192.168.1.2
• Internal LAN network: 172.16.16.0/24
• The LAN is configured on the LAN interface of Fortinet.

 Site B – Sophos Firewall

• The Internet line is connected to interface a (WAN) of the Sophos Firewall.
• WAN IP: 192.168.1.3
• The internal LAN network consists of two subnets:
  • 10.10.10.0/24
  • 192.168.20.0/24

Notes about the diagram

• The VPN connection uses IPSec Site-to-Site.
• Authentication uses a Pre-shared Key.
• IKEv2 is used.

III – Configuration scenario

We will perform the configuration of IPSec VPN Site-to-Site between:

• Fortinet (192.168.1.2)
• Sophos (192.168.1.3)

Objective

LAN network 172.16.16.0/24 (Fortinet) ⬄ LAN networks 10.10.10.0/24 and 192.168.20.0/24 (Sophos) can connect and communicate with each other directly.

IV – Configuration steps

On the Fortinet device:

• Create VPN Tunnels
• Create Static Route
• Create Firewall Policy

On the Sophos device:

• Create subnet
• Create IPSec Profile
• Create IPSec Connection
• Create Firewall Rule

V – Detailed guide to configuring VPN site-to-site between Fortinet Firewall and Sophos Firewall Firmware V22

1. On the Fortinet device

1.1 – Create VPN Tunnels

Go to:

VPN → IPsec Tunnels → Create New → Custom

Name: S2S-LAB

Template Type: Custom

Use Custom to manually configure Phase 1 / Phase 2.

Selector 1

• Local Address: 172.16.16.0/24
• Remote Address: 10.10.10.0/24

Selector 2

• Local Address: 172.16.16.0/24
• Remote Address: 192.168.20.0/24

Click OK to create the VPN Tunnel.

Go to: Network → Static Routes → Create New

Go to: Hosts and Services → Add

Go to: SYSTEM > Profiles → IPsec Profiles → Add

Go to: CONFIGURE → Site-to-site VPN →  IPsec → Add

• Listening interface: Port 2 – 192.168.1.3
• Gateway address: 192.168.1.2 (WAN Fortinet)
• Local Subnet: 10.10.10.0/24 , 192.168.20.0/24
• Remote Subnet: 172.16.16.0/24

Sophos: VPN → IPsec Connections → Status: Connected

Fortinet: Monitor → IPsec Monitor → Tunnel: UP (Incoming / Outgoing Data present)

Test:

• 172.16.16.x → 10.10.10.x
• 172.16.16.x → 192.168.20.x

• Ensure system time is synchronized (NTP) to avoid IKEv2 errors caused by time mismatch.
• PSK, encryption algorithms, and DH groups must match on both sides — mismatches will cause Phase 1/2 failures.
• Disable NAT on policies entering the VPN; enabling NAT will alter the source and packets will not match the selector.
• Each Local/Remote subnet pair requires one selector (Phase 2). Do not combine multiple subnets if the device does not support it.
• If the tunnel is UP but ping does not work, check: Static Route, policy order, and the ARP/Route table on both sides.

This article aims to:

• Guide how to view and filter logs on Sophos Firewall.
• Guide reading and exporting reports for operation and reporting.
• Help administrators quickly detect issues and security threats.

Through this, help the system be monitored effectively and operate more securely.

View information about network traffic passing through the firewall and security threats.

The main dashboard types include:

User threat quotient (UTQ): ranks users based on security risk score

Traffic dashboard: classification by network traffic

Security dashboard: blocked activities and threats: malware, IPS, spam, attack sources

Executive report: summary information for managers: highlighted traffic & threats

1.2 – Application & Webs

View information about application and Internet usage on your network.

Application Risk Meter is the method by which the Firewall calculates a score based on the risk level and the number of accesses (hits) of each application.
The application risk index is determined based on the average score of all application traffic.

The setting groups that can be monitored in this section include:

• User app risks & usage: Statistics on the usage of applications and their corresponding risk levels.
• Cloud applications usage: Statistics on the usage of cloud applications.
• Blocked user apps: Instances where application access was blocked.
• Synchronized applications: Applications that are classified and synchronized from endpoints to the firewall.
• Web risks & usage: Web access activity within the network and related risks.
• Blocked web attempts: Instances where web access attempts were blocked.
• Search engine: Statistics of users’ search behavior.
• Web content: Matches from the content filtering system and related information.
• Web server usage: Traffic of Applications, Web, Internet, and FTP.
• Web server protection: Security status of Web Servers, including attacks and attack sources.
• User data transfer: User traffic.
• FTP usage: FTP activity.
• FTP protection: Malicious FTP activity.

Displays information about network usage and related threats

Các nhóm Setting có thể theo dõi trong phần này, bao gồm:

• Intrusion attacks: Attack attempts.
• Active threat response: Threat events and compromised machines detected by MDR (Managed Detection and Response) and Sophos X-Ops.
• Wireless: Access points and SSIDs being used.
• Security Heartbeat: The health status of endpoints within the network based on the connection between the endpoint and the Firewall.
• Zero-day protection: Advanced protection against new attacks.

View information about remote users (users connecting remotely) to your network system through IPsec VPN, SSL VPN, and Clientless Access.

The setting groups that can be monitored in this section include:

• VPN: Traffic generated by remote users through IPsec, L2TP, or PPTP.
• SSL VPN: Traffic generated by remote users through the SSL VPN Client.
• Clientless Access: Traffic generated by remote users through a web browser.

View information about email traffic in the network system.

The setting groups that can be monitored in this section include:

• Email Protection: Email traffic in the network system that contains viruses and spam.
• Email Usage: Email traffic within the network system.

View information about compliance with regulations/standards:

The standard groups that can be monitored in this section include:

• HIPAA: Security Report compliant with the HIPAA standard.
• GLBA: Security Report compliant with the GLBA standard.
• SOX: Security Report compliant with the SOX standard.
• FISMA: Security Report compliant with the FISMA standard.
• PCI: Security Report compliant with the PCI standard.
• NERC CIP v3: Security Report compliant with the NERC CIP v3 standard.
• CIPA: Security Report compliant with the CIPA standard.
• Events: Network events and their corresponding severity levels.

Tạo báo cáo bao gồm các tiêu chí được chỉ định.

The types of reports that can be created in this section include:

• Web Report: Search for web browsing activity or viruses. Can be filtered by user, domain, and other criteria.
• Mail Report: Search for Email traffic, Spam, and Viruses. Can be filtered by protocol, user, and other criteria.
• FTP Report: Search for FTP activity and viruses. Can be filtered by transfer type, user, file, or source IP.
• User Report: Statistics on usage levels such as high-risk applications, ineffective websites, and detected viruses. Can be filtered by username and source host.
• Web Server Report: Search for Web Server activity (time, user, URI) as well as Web Server protection events.

The Log Viewer displays system event logs and automatically updates in real time.

To access it, click Log Viewer in the top-right corner of the Sophos Firewall interface.

A new Log Viewer window will appear, and administrators can view logs in real time here.

Administrators can choose specific log types to monitor, such as:

• Admin
• Active Threat Response
• Application filter
• Authentication
• Email
• Firewall
• IPS
• Malware
• Security Heartbeat
• SSL/TLS inspection
• SD-WAN
• System
• VPN
• Web content policy
• Web filter
• Web server protection
• Zero-day protection

During system administration, administrators often need report files summarizing system usage and important threats.

Therefore, in this guide the Executive Report is selected to perform report exporting.

To export a scheduled report, select Show Report Settings.

Choose Report Scheduling, then click Add.

Enter the following information:

• Name: name of the report schedule
• Description: optional description
• To email address: email address receiving the report (multiple emails can be entered)
• Report type: select the type (for example: Report group)
• Report group: choose the appropriate report group (for example: Executive Report)
• Email frequency: choose Daily or Weekly and the time to send the report via email

After completing the information, click Save.

translate this post to english exactly: I – Tổng quan về Activate và Renew License Sophos Firewall Bài viết hướng dẫn cách activate và renew license Sophos Firewall thông qua Sophos Central. Sophos Central là nền tảng quản lý tập trung cho phép quản lý thiết bị, license và đồng bộ trạng thái license từ cloud về firewall. II – Hướng dẫn Activate License Sophos Firewall 1. Tạo tài khoản Sophos Central Nếu chưa có tài khoản Sophos Central, tham khảo: https://thegioifirewall.com/sophos-central-huong-dan-tao-tai-khoan-sophos-central-trial/ Đăng nhập Sophos Central bằng tài khoản Super Admin. 2. Claim thiết bị Sophos Firewall – Vào Account → Licensing Firewall licenses – Chọn Firewall licenses  – Chọn Claim firewall  – Nhập Serial Number thiết bị  Sau khi claim thành công, thiết bị sẽ hiển thị trong danh sách quản lý. 3. Apply License cho thiết bị – Chọn thiết bị → Apply subscriptions – Nhập License Key – Preview subscription → Apply license 4. Đồng bộ License về Firewall – Vào Sophos Firewall → Administrator → Device access – Nhấn Synchronize III – Lưu ý khi Renew License Sophos Firewall Đối với các lần gia hạn (renew) license trong tương lai, cần lưu ý – License Number: chỉ dùng để tracking và support, không dùng để activate. – License Key: bắt buộc để kích hoạt hoặc renew license. 1. Cơ chế đồng bộ license khi renew: Trong hầu hết các trường hợp, nếu Sophos Firewall đã được liên kết đúng Sophos Central account, license sau khi renew sẽ tự động đồng bộ xuống thiết bị mà không cần thao tác thủ công. Tuy nhiên, nếu license không tự đồng bộ và vẫn hiển thị trạng thái Expired, bạn có thể thực hiện các bước sau: Kiểm tra license trong Sophos Central hoặc Sophos Partner Portal để xác định License Key tương ứng Thực hiện apply License Key thủ công cho thiết bị Firewall (theo hướng dẫn ở Mục II.3) 2. Trường hợp không nhận được License Key: Nếu email gia hạn không chứa License Key, khuyến nghị: Kiểm tra lại thông tin license trong Sophos Portal Hoặc liên hệ Sophos Support / Partner để xác nhận chính xác License Key trước khi apply

I – Overview of Activate and Renew License Sophos Firewall

This article guides how to activate and renew a Sophos Firewall license through Sophos Central.
Sophos Central is a centralized management platform that allows management of devices, licenses, and synchronization of license status from the cloud to the firewall.

II – Guide to Activate Sophos Firewall License

1. Create a Sophos Central account

If you do not have a Sophos Central account yet, refer to:
https://thegioifirewall.com/sophos-central-huong-dan-tao-tai-khoan-sophos-central-trial/

Log in to Sophos Central using a Super Admin account.

2. Claim the Sophos Firewall device

• Go to Account → Licensing Firewall licenses
• Select Firewall licenses
• Select Claim firewall
• Enter the device Serial Number

After a successful claim, the device will appear in the management list.

3. Apply License to the device

• Select the device → Apply subscriptions
• Enter the License Key
• Preview subscription → Apply license

4. Synchronize License to the Firewall

• Go to Sophos Firewall → Administrator → Device access
• Click Synchronize

III – Notes when Renewing Sophos Firewall License

For future license renewals, please note:

• License Number: only used for tracking and support, not used for activation.
• License Key: required to activate or renew the license.

1. License synchronization mechanism when renewing

In most cases, if the Sophos Firewall has been properly linked to the Sophos Central account, the license after renewal will automatically synchronize to the device without requiring manual action.

However, if the license does not automatically synchronize and still shows Expired status, you can perform the following steps:

Check the license in Sophos Central or Sophos Partner Portal to determine the corresponding License Key

Manually apply the License Key to the Firewall device (according to the instructions in Section II.3)

2. Case when the License Key is not received

If the renewal email does not contain the License Key, it is recommended to:

Check the license information again in the Sophos Portal

Or contact Sophos Support / Partner to confirm the correct License Key before applying it.

translate this post to english exactly:https://vacif.com/moi-nhat-2026-huong-dan-activate-renew-license-sophos-firewall/

Here is the exact English translation of the post from:
[MỚI NHẤT 2026] – HƯỚNG DẪN ACTIVATE & RENEW LICENSE SOPHOS FIREWALL

[LATEST 2026] – GUIDE TO ACTIVATE & RENEW SOPHOS FIREWALL LICENSE

I – Overview of Activate and Renew Sophos Firewall License

This article guides how to activate and renew the Sophos Firewall license through Sophos Central.

Sophos Central is a centralized management platform that allows managing devices, licenses, and synchronizing license status from the cloud to the firewall. 

II – Guide to Activate Sophos Firewall License

1. Create a Sophos Central account

If you do not yet have a Sophos Central account, refer to:
https://thegioifirewall.com/sophos-central-huong-dan-tao-tai-khoan-sophos-central-trial/

Log in to Sophos Central using a Super Admin account.

2. Claim the Sophos Firewall device

• Go to Account → Licensing → Firewall licenses
• Select Firewall licenses
• Select Claim firewall
• Enter the device Serial Number

After claiming successfully, the device will appear in the management list.

3. Apply License to the device

• Select the device → Apply subscriptions
• Enter the License Key
• Preview subscription → Apply license

4. Synchronize License to the Firewall

• Go to Sophos Firewall → Administrator → Device access
• Click Synchronize

III – Notes when Renewing Sophos Firewall License

For future license renewals, please note:

• License Number: only used for tracking and support, not used for activation.
• License Key: required to activate or renew the license.

1. License synchronization mechanism when renewing

In most cases, if the Sophos Firewall has been correctly linked to the Sophos Central account, the license after renewal will automatically synchronize to the device without requiring manual operations.

However, if the license does not automatically synchronize and still shows the Expired status, you can perform the following steps:

• Check the license in Sophos Central or Sophos Partner Portal to determine the corresponding License Key
• Manually apply the License Key to the Firewall device (according to the instructions in Section II.3) 

2. Case when the License Key is not received

If the renewal email does not contain the License Key, it is recommended to:

• Check the license information again in the Sophos Portal
• Or contact Sophos Support / Partner to confirm the correct License Key before applying it. 

If you want, I can also help you rewrite this translation to sound more natural for a blog post in English (keeping the meaning but making it read like native technical documentation).

translate this post to english exactly: https://vacif.com/en/moi-nhat-2026-sophos-firewall-huong-dan-theo-doi-xuat-report-tu-sophos-firewall-v22/

Here is the exact English translation of the post from:
https://vacif.com/moi-nhat-2026-sophos-firewall-huong-dan-theo-doi-xuat-report-tu-sophos-firewall-v22/ (translated literally line‑by‑line where appropriate):

[Latest 2026] Sophos Firewall: Guide to Monitoring & Exporting Reports From Sophos Firewall V22

Table of Contents

• I – Overview of monitoring and exporting reports from Sophos Firewall V22
• II – Details on monitoring and exporting reports from Sophos Firewall V22
  • 1. Introduction to Report & Log features of Sophos Firewall
  • 1.1 – Dashboards
  • 1.2 – Application & Webs
  • 1.3 – Networks & Threat
  • 1.4 – VPN
  • 1.5 – Email
  • 1.6 – Compliance
  • 1.7 – Custom
  • 1.8 – Log Viewer
    2. How to export a Report on Sophos Firewall

I – Overview of Monitoring and Exporting Reports From Sophos Firewall V22

This article aims to:

• Guide how to view and filter logs on Sophos Firewall.
• Guide reading and exporting reports for operation and reporting.
• Help administrators quickly detect issues and security threats.

Through this, help the system be monitored effectively and operate more securely. 

II – Details on Monitoring and Exporting Reports From Sophos Firewall V22

1. Introduction to Report & Log Features of Sophos Firewall

1.1 – Dashboards

View information about network traffic passing through the firewall and security threats. The main dashboard types include:

• Traffic dashboard: classification by network traffic
• Security dashboard: blocked activities and threats: malware, IPS, spam, attack sources
• Executive report: summary information for managers: highlighted traffic & threats
• User threat quotient (UTQ): ranks users based on security risk score 

1.2 – Application & Webs

View information about application and Internet usage on your network.

Types of monitoring in this section include:

• User app risks & usage
• Cloud applications usage
• Blocked user apps
• Synchronized applications
• Web risks & usage
• Blocked web attempts
• Search engine statistics
• Web content details
• Web server usage
• Web server protection 

1.3 – Networks & Threat

View information about network usage and related threats, including:

• Intrusion attacks
• Active threat response (Threat events detected by MDR and Sophos X‑Ops)
• Wireless usage
• Security Heartbeat status
• Zero‑day protection details 

1.4 – VPN

View information about remote users connecting to your network through IPsec VPN, SSL VPN, and Clientless Access. 

1.5 – Email

View information about email traffic and protection against viruses/spam in the system. 

1.6 – Compliance

View information about compliance reports for standards such as HIPAA, GLBA, SOX, FISMA, PCI, NERC CIP v3, CIPA, and Event levels. 

1.7 – Custom

Create reports based on specified criteria, including:

• Web Report: search web activity or virus logs
• Mail Report: search email, spam and virus activity
• FTP Report: search FTP activity
• User Report: statistics on high‑risk application usage and website access
• Web Server Report: search web server activity (time, user, URI) and protection events 

1.8 – Log Viewer

The Log Viewer displays event logs and updates automatically in real‑time. Administrators can select specific log types to monitor (such as Admin, Firewall, IPS, Malware, VPN, Web filter, etc.). 

2. How to Export Reports on Sophos Firewall

During system administration, administrators need comprehensive report files reflecting system usage and key threats. Therefore, in this guide the Executive Report is selected to perform report exporting.

To export a scheduled report:

• Select Show Reports Settings
• Choose Report Scheduling, then click Add
• Enter the following information:
  • Name: Name of the report schedule
  • Description: (optional)
  • To email address: email address that receives the report (can enter multiple emails)
  • Report type: Choose type (e.g., Report group)
  • Report group: Choose suitable report group (e.g., Executive Report)
  • Email frequency: Choose Daily or Weekly and the time to send the report via email
• After entering complete information, click Save

When the schedule runs as configured, Sophos will email the report file to the specified email address according to the schedule. 

If you want this translation formatted more naturally for an English technical article or documentation, feel free to ask!

translate this entire post to english exactly: https://vacif.com/en/moi-nhat-2026-sophos-firewall-huong-dan-theo-doi-xuat-report-tu-sophos-firewall-v22/

Below is the direct English translation of the article from
VACIF:
“[Mới nhất 2026] Sophos Firewall: Hướng Dẫn Theo Dõi & Xuất Report Từ Sophos Firewall V22”.
The structure and wording are kept as close as possible to the original text. 

[Latest 2026] Sophos Firewall: Guide to Monitoring & Exporting Reports from Sophos Firewall V22

Table of Contents

• I – Overview of monitoring and exporting reports from Sophos Firewall V22
• II – Details of monitoring and exporting reports from Sophos Firewall V22

I – Overview of Monitoring and Exporting Reports from Sophos Firewall V22

This article aims to:

• Guide how to view and filter logs on Sophos Firewall.
• Guide how to read and export reports for operation and reporting purposes.
• Help administrators quickly detect incidents and security threats.

Through this, the system can be monitored effectively and operated more securely. 

II – Details of Monitoring and Exporting Reports from Sophos Firewall V22

1 – Introduction to the Report & Log features of Sophos Firewall

1.1 – Dashboards

The dashboard allows administrators to quickly monitor network traffic and security threats occurring on the system.

Some common dashboards include:

• Traffic dashboard – classifies traffic passing through the firewall.
• Security dashboard – statistics on blocked activities and threats such as malware, IPS attacks, spam, and attack sources.
• Executive report – summary reports for management including highlighted traffic and threats.
• User Threat Quotient (UTQ) – evaluates user risk scores based on their activities on the network.

1.2 – Applications & Webs

This section provides information about application usage and web access activities within the network.

Monitoring items include:

• User app risks & usage
• Cloud app risks & usage
• Blocked user apps
• Synchronized apps
• Web risks & usage
• Blocked web attempts
• Search engine statistics
• Web content details
• Web server usage
• Web server protection

1.3 – Networks & Threat

Displays information related to network usage and security threats, including:

• Intrusion attacks
• Active Threat Response (threat events detected by MDR and Sophos X-Ops)
• Wireless usage
• Security Heartbeat status
• Zero-day protection details

1.4 – VPN

Displays information about remote users connecting to the network through VPN, including:

• IPsec VPN
• SSL VPN
• Clientless Access

1.5 – Email

Provides information about email traffic and spam/virus protection within the system.

1.6 – Compliance

Displays compliance reports related to standards such as:

• HIPAA
• GLBA
• SOX
• FISMA
• PCI
• NERC CIP v3
• CIPA
• Event levels

1.7 – Custom

Administrators can create custom reports based on specific criteria, including:

• Web Report – search web activity or virus logs
• Mail Report – search email activity, spam, and viruses
• FTP Report – search FTP activity
• User Report – statistics of high-risk application usage and website access
• Web Server Report – search web server activity (time, user, URI) and protection events

1.8 – Log Viewer

The Log Viewer displays system event logs and automatically updates in real time.

Administrators can select specific log types to monitor, such as:

• Admin
• Firewall
• IPS
• Malware
• VPN
• Web filter
• And other log categories.

2 – How to Export Reports on Sophos Firewall

During system administration, administrators often need report files summarizing system usage and security threats.

Therefore, in this guide the Executive Report is used as an example to export reports.

To export a scheduled report:

1. Select Show Report Settings.
2. Choose Report Scheduling, then click Add.
3. Enter the following information:

• Name – name of the report schedule
• Description – optional description
• To email address – email address receiving the report (multiple emails can be entered)
• Report type – select the report type (for example: Report group)
• Report group – choose the appropriate report group (for example: Executive Report)
• Email frequency – choose Daily or Weekly and the time to send the report via email

4. After completing the information, click Save.

Once the schedule runs according to the configuration, Sophos will automatically send the report file to the configured email address. 

If you want, I can also help you:

• Rewrite this into natural English technical documentation, or
• Convert it into a polished blog article for international readers.

translate this to english accurately:Application risk meter là cách thức mà Firewall sẽ tính điểm dựa trên mức độ rủi ro và số lần truy cập (hits) của từng ứng dụng. Chỉ số rủi ro ứng dụng được xác định dựa trên điểm trung bình của toàn bộ lưu lượng ứng dụng

Translation (accurate):

Application Risk Meter is the method by which the Firewall calculates a score based on the risk level and the number of accesses (hits) of each application.
The application risk index is determined based on the average score of all application traffic.

translate this article sentence by sentence accurately without leaving out details, follow their structure and style: https://vacif.com/moi-nhat-2026-sophos-firewall-huong-dan-theo-doi-xuat-report-tu-sophos-firewall-v22/

Below is the accurate sentence-by-sentence English translation following the original structure and style of the article
from VACIF:
VACIF – “[Mới nhất 2026] Sophos Firewall: Hướng Dẫn Theo Dõi & Xuất Report Từ Sophos Firewall V22”. 

[Latest 2026] Sophos Firewall: Guide to Monitoring & Exporting Reports from Sophos Firewall V22

Table of Contents

• I – Overview of monitoring and exporting reports from Sophos Firewall V22
• II – Details of monitoring and exporting reports from Sophos Firewall V22

I – Overview of monitoring and exporting reports from Sophos Firewall V22

This article aims to:

• Guide how to view and filter logs on Sophos Firewall.
• Guide how to read and export reports for operational and reporting purposes.
• Help administrators quickly detect incidents and security threats.

Through that, the system can be monitored effectively and operate more securely. 

II – Details of monitoring and exporting reports from Sophos Firewall V22

1 – Introduction to the Report & Log features of Sophos Firewall

1.1 – Dashboards

Dashboards allow administrators to view information about network traffic passing through the firewall and security threats.

Some main dashboard types include:

• Traffic dashboard: classifies traffic based on network traffic.
• Security dashboard: statistics of blocked activities and threats such as malware, IPS attacks, spam, and attack sources.
• Executive report: summary information for management, including highlighted traffic and threats.
• User Threat Quotient (UTQ): ranks users based on their security risk score.

1.2 – Application & Webs

Displays information about application usage and Internet activity within the network.

Monitoring items in this section include:

• User app risks & usage
• Cloud app risks & usage
• Blocked user apps
• Synchronized apps
• Web risks & usage
• Blocked web attempts
• Search engine statistics
• Web content details
• Web server usage
• Web server protection

1.3 – Networks & Threat

Displays information about network usage and related threats, including:

• Intrusion attacks
• Active threat response (threat events detected by MDR and Sophos X-Ops)
• Wireless usage
• Security Heartbeat status
• Zero-day protection details

1.4 – VPN

Displays information about remote users connecting to the network via VPN, including:

• IPsec VPN
• SSL VPN
• Clientless access

1.5 – Email

Displays information about email traffic and virus/spam protection in the system.

1.6 – Compliance

Displays compliance reports related to standards such as:

• HIPAA
• GLBA
• SOX
• FISMA
• PCI
• NERC CIP v3
• CIPA
• Event levels

1.7 – Custom

Allows administrators to create reports based on specific criteria, including:

• Web Report: search web activity or virus logs
• Mail Report: search email, spam, and virus activity
• FTP Report: search FTP activity
• User Report: statistics of high-risk application usage and website access
• Web Server Report: search web server activity (time, user, URI) and protection events

1.8 – Log Viewer

The Log Viewer displays system event logs and automatically updates in real time.

Administrators can choose specific log types to monitor, such as:

• Admin
• Firewall
• IPS
• Malware
• VPN
• Web filter
• and other log types.

2 – How to export reports on Sophos Firewall

During system administration, administrators often need report files summarizing system usage and important threats.

Therefore, in this guide the Executive Report is selected to perform report exporting.

To export a scheduled report:

1. Select Show Report Settings.
2. Choose Report Scheduling, then click Add.
3. Enter the following information:

• Name: name of the report schedule
• Description: optional description
• To email address: email address receiving the report (multiple emails can be entered)
• Report type: select the type (for example: Report group)
• Report group: choose the appropriate report group (for example: Executive Report)
• Email frequency: choose Daily or Weekly and the time to send the report via email

4. After completing the information, click Save.

When the schedule runs according to the configuration, Sophos will automatically send the report file to the specified email address according to the schedule. 

1. Create a Sophos Central account

If you do not yet have a Sophos Central account, refer to:
https://thegioifirewall.com/sophos-central-huong-dan-tao-tai-khoan-sophos-central-trial/

Log in to Sophos Central using a Super Admin account.

Go to Account → Licensing → Firewall licenses

Select Firewall licenses

Select Claim firewall

Enter the device Serial Number

After claiming successfully, the device will appear in the management list.

Select the device → Apply subscriptions

Enter the License Key

Preview subscription → Apply license

For future license renewals, please note:

• License Number: only used for tracking and support, not used for activation.
• License Key: required to activate or renew the license.

1. License synchronization mechanism when renewing

In most cases, if the Sophos Firewall has been correctly linked to the Sophos Central account, the license after renewal will automatically synchronize to the device without requiring manual operations.

However, if the license does not automatically synchronize and still shows the Expired status, you can perform the following steps:

• Check the license in Sophos Central or Sophos Partner Portal to determine the corresponding License Key
• Manually apply the License Key to the Firewall device (according to the instructions in Section II.3)

2. Case when the License Key is not received

If the renewal email does not contain the License Key, it is recommended to:

• Check the license information again in the Sophos Portal
• Or contact Sophos Support / Partner to confirm the correct License Key before applying it.

If you want, I can also help you rewrite this translation to sound more natural for a blog post in English (keeping the meaning but making it read like native technical documentation).

Sophos Endpoint 100 là gói bảo vệ thiết bị đầu cuối được thiết kế riêng cho doanh nghiệp vừa và nhỏ, mang toàn bộ sức mạnh của giải pháp bảo mật đạt giải thưởng quốc tế Sophos Endpoint vào một gói đơn giản, giá cố định. Với khả năng triển khai nhanh, quản lý dễ dàng và mức chi phí minh bạch, Sophos Endpoint 100 giúp doanh nghiệp rút ngắn thời gian ra quyết định, giảm thiểu rào cản đầu tư và tối ưu hiệu quả bảo vệ.

Tên gọi “Sophos Endpoint 100” thể hiện rõ đối tượng sử dụng: gói dịch vụ này phù hợp cho tổ chức có tối đa 100 nhân viên, cung cấp bảo mật toàn diện, đáng tin cậy và hỗ trợ dự đoán chi phí chính xác. Nếu quý doanh nghiệp đang tìm kiếm giải pháp bảo mật thiết bị đầu cuối nhanh chóng – đơn giản – hiệu quả, Sophos Endpoint 100 chính là lựa chọn lý tưởng để an tâm vận hành và phát triển.

• Phòng chống mã độc
• Bảo vệ thời gian thực
• Hỗ trợ đa nền tảng ( Windows/Mac)
• Bảo vệ truy cập Website, Quản lý thiết bị ngoại vi
• Phát hiện các luồng dữ liệu độc hại truy cập ra ngoài
• Phần mềm chống xâm nhập cho máy trạm ( HIPS )
• Tính năng chống thất thoát dữ liệu ( DLP )
• Kiểm tra việc tải dữ liệu, Phát hiện các luồng dữ liệu nguy hiểm
• Ngăn chặn tấn công khai thác từ hacker
• Chống virus mã hóa ransomware
• Phân tích nguyên nhân gốc của các tấn công
• Đồng bộ hóa với tường lửa để nâng cao khả năng tự động đáp trả, cách ly
• Quản trị qua Sophos Cloud

• Phòng chống mã độc công nghệ Trí tuệ nhân tạo Deep Learning
• Bảo vệ thời gian thực
• Hỗ trợ đa nền tảng ( Windows/Linux)
• Bảo vệ truy cập Website, Quản lý thiết bị ngoại vi, Quản lý ứng dụng
• Phát hiện các luồng dữ liệu độc hại truy cập ra ngoài
• Phần mềm chống xâm nhập cho máy chủ ( HIPS )
• Tính năng chống thất thoát dữ liệu ( DLP )
• Kiểm tra việc tải dữ liệu, Phát hiện các luồng dữ liệu nguy hiểm
• Ngăn chặn tấn công khai thác từ hacker
• Chống virus mã hóa ransomware
• Phân tích nguyên nhân gốc của các tấn công
• Đồng bộ hóa với tường lửa để nâng cao khả năng tự động đáp trả, cách ly
• Tính năng Server Lockdown, chỉ cho phép các ứng dụng thuộc danh sách định sẵn hoạt động
• Tính năng kiểm tra sự thay đổi file trên máy chủ File Integrity Monitoring
• Tính năng bảo vệ chủ động tích cực – Active Adversary Protection
• Quản trị qua Sophos Cloud

Với gói Sophos Endpoint 100 sẽ giúp quý khách luôn đi trước các cuộc tấn công ransomware, cùng khả năng tích hợp XDR và ​​MDR, Sophos sẽ bảo vệ doanh nghiệp khỏi các mối đe dọa hiện đại, đồng thời thúc đẩy chu kỳ bán hàng.

• Quý khách có thể tham khảo giải pháp Sophos Endpoint 100 ngay tại Website Sophos: tham khảo ngay tại đây hoặc liên hệ ngay cho VACIF để được tư vấn nhanh nhất!

• Sophos Endpoint từng đoạt giải thưởng, được công nhận là Nhà dẫn đầu trong Gartner Magic Quadrant 16 lần.

Microsoft Teams hiện đang là nền tảng phổ biến cho các cuộc họp trực tuyến (Meeting) và làm việc từ xa. Để đảm bảo chất lượng đường truyền cho các cuộc họp Teams, việc thiết lập QoS (Quality of Service) trên firewall là rất cần thiết.

Trong bài viết này, chúng ta sẽ thực hiện cấu hình QoS ưu tiên lưu lượng Microsoft Teams trên thiết bị Sophos Firewall.

• Yêu cầu trước khi thực hiện
• Thiết bị Sophos Firewall đã hoạt động bình thường.
• Quyền truy cập quản trị Sophos Central hoặc trực tiếp trên Firewall.
• Đường truyền internet ổn định.
• Các bước thực hiện

Bước 1: Đăng nhập Firewall Sophos và tạo application Team

• Đăng nhập vào Firewall Sophos.

• Tiếp theo chọn Application->Application Filter -> Add để tạo Microsoft Teams .

• Nhập name là: Mircrosoft Teams

Nhấn add để vào Application filter policy rules

• Ở chỗ Category chọn: Conferencing -> Select individual application -> Mircrosoft Teams -> Action chọn: Allow -> Schedule chọn: All the time -> Save.

• Xong phần thì nó sẽ hiện ra như thế này rồi mình nhấn Save.

Bước 2: Tạo Traffic Shaping Policy

• Chọn vào System service->Traffic Shaping-> Add

          Sau khi nhấn add->nhập những thông tin như này theo thứ tự ở trên hình ảnh

• Name : Team_QoS
• Policy association: Rules
• Rule Type: Guarantee
• Limit upload/download separately: Enable
• Priority: 0 – [ Real Time – e.g. VoIP] (highest)
• Guarantee – limit upload: ( 400-500) KBps
• Guarantee – limit download: (400-500) KBps
• Bandwidth usage type: Individual
• Save

 Sau khi nhập những bước trên xong thì chúng ta sẽ tạo 1 cái rule để Bước 1 và Bước 2 có thể chạy

Bước 3: Tạo Rule Policy để chạy QoS

Muốn tạo được Rule Policy thì ta vào phần Protect->Rule and policies->Firewall rules-> Add firewall rule->New firewall rules

          Sau khi nhấn New firewall rule thì firewall sẽ hiện ra trang edit firewall rule để mình điền thông rule

• Rule name: Allow_Teams_Meeting
• Action: Accept
• Tích vào Log firewall traffic
• Rule group: None

• Source Zone: LAN
• Source networks and devices: Khuyến khích chọn IP và subnet cố định, không nên để any ở mục này. Ở đây tôi sẽ để IP của máy mình.
• Destination Zones: WAN
• Destination networks: Any
• Service: Any

Kéo xuống dưới sẽ thấy phần Other security features trong phần này thì điền như sau:

• Identify and control applications (App control): Chọn Mircrosoft Teams mà nãy mình đã tạo ở Application (Bước 1).
• Shape traffic: Chọn Teams-Qos mà nãy mình đã tạo ở Traffic Shaping Policy (Bước 2).
• Tích vào Apply application-base traffic shaping policy
• Cuối cùng là chọn Save.

Khi xong hết những cấu hình ở trên thì tiếp theo mình sẽ vào bước test xem cấu hình của mình đã chạy hay chưa.

• Kết quả

Ở đây em sẽ test với mức băng thông mình đã quy định là 400KBps ở trên bước 2, mình sẽ vào Teams để download 1 file mà mình đã tạo.

Tiếp theo tôi sẽ tang băng thông lên thành 4000KBps tức là 4MBps để xem băng thông.

Nếu mà kết quả như trên mình đã làm thành công với QoS rồi nhé. Chúc các bạn thành công nhé.

2.Overview.

Bài viết này sẽ giúp bạn cấu hình IPSec site-to-site giữa Head office và Branch office trên Sophos Firewall. Ví dụ như mô hình mạng ở trên mô tả kết nối giữa trụ sở chính(HQ-Site) và chi nhánh văn phòng(Branch-Site).

3.Cấu hình.

3.1. Cấu hình trên Firewall HQ_Site.

a. Thêm Local và Remote LAN Network.

Đến phần Hosts and services > IP Host > Add để thêm local and remote LAN network như hình ở bên dưới.

b.Tạo kết nối IPsec VPN đến Firewall Branch_Site.

Đến phần Site-to-Site VPN > IPsec và chọn Add. Tạo kết nối với thông số bên dưới.

Đặt tên cho kết nối VPN và chọn Connection type là Site-to-Site đối với Policy-Based VPN. Tích chọn Active on save, tạo firewall rule sau. Chọn Gateway type là Respond only bởi vì khởi tạo từ chi nhánh sẽ được phản hồi từ trụ sở chính.

Chọn Profile, có thể tạo Profile ở Profiles -> IPSec Pprofiles hoặc có thể chọn những Profiles được định nghĩa sẵn trên Sophos Firewall.

Chọn Authentication type là Preshared key và nhập cùng preshared key trên cả 2 firewall.

Chọn Listening interface là PortB và Gateway address là WAN IP address của Firewall phía Branch-Site. Tương tự chọn Local subnet là local_network_192.168.100.0 và Remote subnet là remote_network_192.168.200.0

Chú ý: Listening interface phải ở trong WAN zone để tạo kết nối VPN.

Nhấn save, theo dõi trạng thái kết nối.

c.Tạo 1 firewall rule để cho phép traffic đi vào và đi ra qua kết nối VPN trên HQ_Site.

Đến phần Rules and Policies -> Firewall rules chọn New firewall rule.

Nhấn save.

3.2.Cấu hình trên Firewall Branch_Site.

a.Thêm Local và Remote LAN Network.

Đến phần Hosts and services > IP Host > Add để thêm local and remote LAN network như hình ở bên dưới.

b.Tạo kết nối IPsec VPN đến Firewall HQ_Site.

Đến phần Site-to-Site VPN > IPsec Connections và chọn Add. Tạo kết nối với thông số bên dưới.

          Nhấn save, theo dõi trạng thái kết nối.

c.Tạo 1 firewall rule để cho phép traffic đi vào và đi ra qua kết nối VPN trên Branch_Site.

          Nhấn save.

          Đến phần Site-to-Site VPN > IPsec Connections, kiểm tra trạng thái kết nối.

4.Kiểm tra kết nối.

 Lấy 1 máy tính trong LAN ở HQ_Site ping đến máy tính trong LAN ở Branch_Site.

Và ngược lại, Lấy 1 máy tính trong LAN ở Branch_Site ping đến máy tính trong LAN ở HQ_Site.

• Xác định đúng dịch vụ và cổng sử dụng
• Có địa chỉ IP nội bộ của máy chủ dịch vụ
• Kiểm tra firewall rule cho phép lưu lượng đi qua
• Cân nhắc biện pháp bảo mật nếu mở cổng ra Internet

II.TÌNH HUỐNG CẤU HÌNH.
Yêu cầu:
Cho phép người dùng bên ngoài truy cập vào máy chủ nội bộ qua Remote Desktop (port 3389) thông qua IP WAN của doanh nghiệp.
Thông tin tình huống cấu hình:

• IP WAN của doanh nghiệp: 123.20.40.173
• Máy chủ nội bộ cần truy cập: 192.168.206.104
• Dịch vụ cần NAT: Remote Desktop (port 3389)

Sơ đồ tình huống cấu hình:

III.HƯỚNG DẪN CẤU HÌNH.
3.1.Thêm IP Host.
Để NAT port dịch vụ ra bên ngoài, trước hết các bạn cần định nghĩa IP của máy chủ nội bộ và dịch vụ cần mở. Các bạn click vào menu Host and services trên Dashboard, tại mục IP host các bạn click chọn Add.
Trong bảng thông tin này, các bạn cần điền:

• Name: Đặt tên cho host cần mở port
• Type: chọn IP
• IP address: Nhập IP nội bộ của host

3.2.Định nghĩa dịch vụ
Tiếp theo, bạn cần định nghĩa các dịch vụ sẽ sử dụng.
Trên Sophos Firewall, các dịch vụ phổ biến như HTTP, HTTPS, FTP, SMTP,… đã được cấu hình sẵn, vì vậy bạn có thể sử dụng trực tiếp mà không cần tạo mới.
Tuy nhiên, nếu bạn sử dụng các port khác không có sẵn, hãy làm theo các bước sau để tạo dịch vụ mới:
Vào tab Services và click chọn Add

• Name: Đặt tên cho dịch vụ bạn đang sử dụng
• Type: Chọn loại dịch vụ phù hợp (TCP hoặc UDP)
• Destination Port: Nhập số port của dịch vụ
• Source Port: Để mặc định (1:65535), trừ khi có yêu cầu cụ thể

Lưu ý: Hãy chọn đúng giao thức (TCP hoặc UDP) tùy theo yêu cầu của dịch vụ
Sau khi điền đầy đủ, nhấn Save để lưu.

3.3.Tạo NAT Rule
Tiến hành tạo NAT Policy để ánh xạ port từ IP WAN về máy chủ nội bộ.
Để tạo vào PROTECT > Rules and policies > NAT rules > Add NAT rule > New NAT rule.

Cấu hình các thông số như sau:

Sau khi điền đầy đủ, nhấn Save để lưu rule.

3.4.Tạo Firewall Rule
Mặc định, Sophos Firewall sẽ chặn các lưu lượng truy cập từ Internet vào mạng nội bộ (LAN).
Vì vậy, sau khi cấu hình NAT policy, bạn cần tạo thêm một Firewall Rule để cho phép lưu lượng sử dụng dịch vụ (VD: Remote Desktop) được đi vào.
Để tạo vào PROTECT > Rules and policies > Add firewall rule > New firewall rule.

Cấu hình các thông số như sau

Sau khi điền đầy đủ, nhấn Save để lưu rule.

3.5.Kiểm tra NAT port.
Sau khi cấu hình xong, bạn có thể kiểm tra xem port đã mở thành công chưa bằng cách:
Truy cập trang:
https://www.yougetsignal.com/tools/open-ports/
Nhập port 3389, nhấn Check.
Nếu hiển thị “Port is open”, nghĩa là NAT thành công.

Tiếp theo, thử kết nối từ bên ngoài:
Mở Remote Desktop (mstsc.exe)
Nhập: WAN_IP:3389 hoặc Tên miền_DDNS:3389
Nếu truy cập được vào máy nội bộ, cấu hình đã hoàn tất.

Lưu ý bảo mật

• Port 3389 là mục tiêu tấn công phổ biến ⇒ KHÔNG nên mở công khai toàn bộ Internet
• Nên:
  • Hạn chế IP được phép truy cập
  • Kết hợp VPN hoặc ZTNA
  • Thay đổi port mặc định nếu có thể
  • Giám sát đăng nhập & ghi log

Trong môi trường doanh nghiệp hiện đại, nhu cầu truy cập từ xa vào hệ thống nội bộ là rất phổ biến. Tuy nhiên, không phải lúc nào người dùng cũng có thể cài đặt phần mềm VPN. Vì vậy, tính năng Clientless VPN trên Sophos XGS Firewall là một giải pháp lý tưởng. Nó cho phép người dùng truy cập các dịch vụ nội bộ như Remote Desktop (RDP), HTTP/S, SSH… trực tiếp qua trình duyệt web, thông qua cổng VPN Portal bảo mật bằng SSL.

Bài viết này sẽ hướng dẫn cấu hình chức năng Clientless VPN với giao thức RDP, nhằm giúp người dùng từ xa có thể truy cập máy chủ nội bộ nhanh chóng và an toàn mà không cần cài thêm phần mềm.

Mục tiêu: Cho phép người dùng truy cập máy chủ nội bộ (Windows Server) thông qua RDP bằng trình duyệt web, sử dụng tính năng Clientless VPN trên Sophos XGS.

Máy chủ cần truy cập: 192.168.20.21 – đã bật tính năng RDP

Người dùng: Nhân viên được cấp tài khoản (tài khoản local hoặc từ AD/LDAP)

Truy cập từ xa: Thông qua portal SSL VPN tại địa chỉ
https://<WAN_IP hoặc Domain>:445

Yêu cầu bảo mật:

• Xác thực người dùng trước khi hiển thị bookmark RDP
• Không cài đặt phần mềm, sử dụng giao diện HTML5
• Giới hạn quyền truy cập theo user cụ thể

• Vào menu: Remote Access VPN → Clientless SSL VPN policy → Bookmarks
• Nhấn Add để tạo kết nối mới.

• Name: đặt tên (ví dụ: WINDOW_SERVERS)
• Type: chọn RDP
• URL: nhập IP máy cần truy cập (ví dụ: 192.168.20.21)
• Port: 3389
• Protocol security: chọn TLS
• Nhấn Save.

• Chuyển sang tab: Policies
• Nhấn Add để tạo chính sách truy cập.

• Name: đặt tên cho policy (ví dụ: ALLOW_RDP_WIN_SVR)
• Policy members: chọn user/group được cấp quyền
• Published bookmarks: chọn bookmark đã tạo ở bước 2
• Nhấn Save

• Vào menu: Administration → Device Access → Local service ACL
• Ở dòng VPN Protal, tick chọn zone WAN

• Trên trình duyệt, truy cập: https://<WAN-IP hoặc domain>:8443 (Mặc định port truy cập VPN Portal của Sophos là 445, ở đây do mình đã đổi port)

• Sau khi đăng nhập, chọn tab Clientless Access
• Nhấn vào biểu tượng RDP tương ứng để kết nối từ trình duyệt

“Error: protocol security negotiation failure”,
thì cần tắt xác thực NLA (Network Level Authentication) trên Windows Server.

1. Nhấn Windows + R
2. Gõ lệnh: SystemPropertiesRemote → nhấn Enter
3. Trong cửa sổ System Properties, tab Remote
4. Bỏ chọn dòng:
   “Allow connections only from computers running Remote Desktop with Network Level Authentication”
5. Nhấn Apply → OK