In this video we will be looking at how to register and setup Sophos XG
firewalls in Sophos Central Firewall manager. Onboarding XG firewalls on CFM
is a straight forward as shown here. You start with the primary partner
administrator signing up for CFM access. Now this is a one-time activity. Then you
can send your request to the customer to manage their XG firewall. The customer is
notified over email and can login to My Sophos to approve the request, followed
with configuring Central Management settings in their XG firewall. The last
step in the process is you log into the Sophos central partner, launch the CFM
console, accept the firewall by adding a friendly name and a few other details.
Okay let's go through these steps in more detail:
We start inside the Sophos Central Partner Portal. This can be accessed at partnerportal.sophos.com
We click manage Sophos Central in the top panel to open the
Sophos Central partner account.
If you're a first-time user of Sophos Central Partner, you need to set up your
login information. An email is sent to you with a security code. We would enter
that security code here, and enter a six digit PIN if you want to use email as an
authentication method. After we've typed in the pin, select Next.
Sophos Central Partner also supports two-factor authentication. It's easy to
set up and use, choose the authentication type that's suitable and convenient to
you, either SMS text message or Google Authenticator. For the purpose of this
video we're going to use SMS text message. Select Next, enter the country,
and then type in the number of the mobile device we want to use, and then
select Next.
You will get an SMS text message with the security code that you can enter
here, and then select Finish. And this brings you to the dashboard of your Sophos
Central Partner account. As you see in the left navigation that's split into 'My
Customers,' 'Sophos Central,' 'Firewalls' 'Administration,' and 'My Business.' For CFM,
go to 'Firewall Approvals' under the firewall section in the left navigation.
You will need to request access to the Central Firewall Manager. This is a
one-time activity, and it's done by the primary administrator of the partner. Hit
the 'send request.' You can read through the terms and conditions and click
accept. The request is sent to the Sophos Business Systems for review and approval.
Once approved, you will receive an email like this one here. There's also a link
to a PDF guide that can refer you to more details. Once approved, you hit the
'check status' the screen refreshes to show you the Firewall Approvals page.
This page allows you to view and manage your firewall approvals. Under 'request
not sent' you will see the list of firewalls sold in your partner account.
If you don't see your firewalls here, contact your channel Account Manager. to
select the firewall, and click 'request to manage.' Doing this will send the request
to your customer, i.e. the person under whom the firewall is registered, and
inform them via email notification like the one we're about to see.
This is an example of the email the customer would receive. The customer can
log on to My Sophos, go to Network Protection > View Devices. Now we see where
the request has been submitted from the partner to the customer. The customer can
select the drop down box and either select all, or select an individual
firewall. The customer can read through the notes and then click OK. Now we see
that the firewall management status has been updated successfully.
The next step is for the customer to configure the firewall that they just
approved to be managed, so we'll go to 'system administration,' and then click
Central Management up at the top. We will enable the Central Management checkbox,
we will type in the domain us - e1.CFM.Sophos.com.
Go check the Device Management checkbox. The default is 'Central Management will
push configuration changes to the device.' Check if LAN port on the firewall is
open to accept configuration from the CFM. If you want to limit external access
only to the CFM, you can create a firewall rule. If the firewall is behind
a NAT device, then we need to change settings to 'device will fetch
configuration changes' from Central Management. Now because this firewall is
behind a NAT device, we're going to select the second option. Then we will
click Apply, and then OK.
Now we see that our setting changes have been applied successfully. Next you log
into the Sophos Central Partner, and notice that the firewall is visible under the
approved firewalls tab. Next we'll go to 'manage firewalls,'
hit the 'manage firewalls' button, and this will launch the CFM console this will bring you to
the CFM dashboard. We will go to a 'device discovery' up at the top. Here we'll see
the firewall with its IP address and serial number. If we click the plus icon
under 'manage' to add the firewall, this takes us to the add device wizard. We'll
see the device name, it's default is a serial number, we can change it or leave
it as is. We will type in the firewall administrator credentials, confirm the
password, and then also give it a description. Then hit Next.
We will confirm our communication details so the device will fetch
configuration from Central Management. Now at this point, we could select Done,
but for the purpose of the video we're going to take you through the rest of
the steps. So here is where we can update the firmware on a device, but since we're
on the latest firmware there's no need to select that. Hit Next. If we want to
upload any pre-existing configuration backup, this is where we can do that.
Next is templates. If we want to upload an existing template in CFM, this is
where we can apply it. Then at the summary page we will confirm all of our
information, and then we will select Finish. Then a message appears that the
device has been added successfully. We will refresh the page, and now we can see
that the device is managed. We will click into the details. We can
now see that it's connected, synchronized, and compatible. Thank you for watching
this video, and we hope you found it helpful.