In this video we will be taking a look at how to add RED devices to an XG
firewall. Adding a RED device to an XG firewall is pretty simple. It's three
basic steps of enabling the RED provisioning service on the firewall,
creating a RED interface for each RED device I want to add, then finishing up
with creating the necessary firewall access rules so the users in the remote
office can have access to the network resources in my local network. Before we
can begin to configure a RED device in the firewall we must first enable, or
register if you will, the firewall to use the RED provisioning service of Sophos.
I'm going to click on System Services in the configure section of the left-hand
navigation bar and then click on RED tab from the options across the top. Click on
the slider button to turn the RED service on fill in an organization name,
city, country, and email address. Make sure it is an email address that you have
access to, as unlock codes will be sent to this email address. We will talk more
about that later. Then click on Apply. this XG firewall is now registered
with the RED provisioning service of Sophos. After the screen refreshes you
can see that you have two configuration options you can now set. Force TLS 1.2 is
used to force the communication of the RED device to use transport layer
security, or TLS 1.2. If you want to use this feature click the checkbox to
enable, and then Apply. The second configuration option you have on the
screen is automatic device deauthorization. I recommend using this as
it will automatically deauthorize a RED device from connecting back to this
firewall if it has been offline more than amount of minutes you have defined.
An example of why you want to use this feature is: let's say you have a RED
device at a remote location that was stolen that stolen RED device has now
powered up and connected to an internet connection. Based on its provisioning it
would make a connection back into your network, giving the person on the other
side of the red device access into your network. Not to say that would happen, but
that would be an excellent example of the use of this feature. To enable this feature
click on the checkbox next to enable. You will
see that the deauthorized after setting now appears. The default setting is 60
minutes, and the range you can set here is from 5 minutes
to 1440 minutes. After adjusting the time to your liking, click Apply. I'm now going
to configure my RED device in this XG firewall. In the configure section of the
left-hand navigation bar click on Network. In the Interfaces tab click on
the add interface button and select RED. For branch name enter the name of the
remote office that this RED device will be deployed at. Click on the drop-down
arrow to select the model of RED device you are deploying. The RED ID is a 15
character string on the label on the bottom of the read device. You can click
on the drop down arrow for tunnel ID if you want to assign the tunnel ID, or if
you leave it set to the default of automatic, the XG firewall will assign a
tunnel ID consecutively starting from 1. The unlock code is an 8 character string
that is generated when a RED device is added to a Sophos XG firewall. The unlock
code is generated during the deployment of a RED device and is emailed
instantly to the address you entered when you activated the RED provisioning
service. This is a security feature which ensures that a RED device cannot simply
be removed and installed elsewhere. If this RED device has been deployed
before, you must enter the unlock code here. Enter the host name of the Sophos
XG firewall. The host name must be a publicly resolvable DNS name or IP
address for the Sophos XG firewall. the RED device will use this name or
the IP address to connect back to the XG firewall. If you have a secondary
firewall IP or DNS name you can enter that in for the second firewall IP host
name field. This will allow for failover if the primary connection is not
available or allow for low balancing between the two connections. Enter a
description for the RED interface in the description field.
By default the XG firewall provides the RED's configuration data automatically via
Sophos' RED provisioning service, so the RED device will receive
its configuration via the internet. If the RED device does not have an internet
connection you can provide the configuration manually via USB stick. For
your uplink connection select DHCP if the RED device will pull an IP address
from your internet service provider, or if you have static IP information from
your ISP, select static and enter the information here. You can also use a 3G
UMTS connection for failover. To enable, click the check box and then fill in the
newly added fields. Next is very important as I need to decide what type
of tunnel will be created between the RED device and the firewall. Standard
unified means all the remote office network traffic is routed through the
firewall. The firewall will serve as a DHCP server and as a default gateway. The
XG firewall will have complete control over the network traffic of the
remote office. It can apply firewall rules to traffic between the local and
remote LANs, as well as protect the traffic with all the firewall protection
services you have subscribed to on this firewall. In standard split mode only
traffic to select local networks is routed through the firewall. Select the
local networks from the drop-down list in the split network box or create new
networks which can be accessed by the RED device. The XG firewall controls the
traffic to these networks from the remote network, it also serves as a DHCP
server and as the default gateway. All of the remote traffic is sent directly
through the local internet connection and would not have the protection of the
firewall protection services you have subscribed to on the firewall.
Transparent split mode, the firewall does not control the network traffic of the
remote network, nor does it serve as a DHCP server, nor has the default gateway.
The firewall will pull an IP address from the remote network DHCP server to
become part of that network. You can select local networks that remote users
have access to from the drop-down list in the split network box. It's important
to note that only standard unified mode supports VLANs. Standard split and
transparency split do not support VLANs. Also if you use a 3G UMTS failover
connection you cannot use the transparent split mode.
For this example I'm going to use standard unify. Before I start filling
the next field I want to decide what IP address to use for the RED device, and
what DHCP scope to use for remote users. Since I'm using standard unified mode
for this video the firewall will be the DHCP server and default gateway. I'm
going to use my DHCP range for the remote users of 192.168.1.1 through
.20 and the IP address from RED device will be 192.168.1.40. Now I'm
going into the IP address of 192.168.1.40 for the RED device. Decide which zone
you want to place this RED device on your network. I'm going to select the
LAN zone. Next I'm going to enter the DHCP range I mentioned earlier of 192.168.1 through 192.168.1.20
You can control the devices that will have access to use
this RED device by MAC address. In order to do this you will need to create a MAC
list in Host and Services in the system section of the left-hand navigation bar
then select the MAC host tab from the options across the top. Then click on Add.
I did this earlier and I will show a screenshot here so I don't lose the
settings we have entered so far. If I had not created a MAC host list earlier all
you would see here next to the MAC filter type would be the words 'no
configured MAC address list found' like you see in this screenshot. So with a MAC
host list created you see three options here. If I wanted to whitelist or
blacklist a list of MAC addresses by clicking on one of the radio buttons you
can see a drop-down is presented that I can click on to select from different
MAC host list that I had created. I'm going to select none as those examples
that I created are full of dummy MAC addresses. Finally the last option I have
to configure is if I want to enable tunnel compression. Of course I want my
throughput to be as good as it can be so I'm going to enable it, then click Save.
I'm now going to plug in my RED device and I'm going to show you the boot
sequence of the device through a console connection. At the end here you can see
that the link and that the RED device is in a
forwarding state. I'm now going to go back to my firewall and navigate to my
interfaces screen. I can scroll down to see my RED interface or I can click on
RED at the top just to see my RED interfaces. And you can see that the link
to my RED device is up and in a scene on the remote simulated way an IP address
of 10.2.2.2. Now that my RED device has been added and the tunnel link is up I
want to show you that unlock code I talked about earlier. As soon as this RED
device was activated, an unlock code was emailed but you can also view that code
from the firewall user interface. I'm gonna click on reds1 to edit this REDs
device. You can see the unlock code here. Now remember if I was to delete this RED
device from this firewall and redeploy it somewhere else, in order to use this
RED device again I would have to enter in this unlock code, so make sure you
don't lose it. If you do, there's no way to unlock this RED device without the
assistance of Sophos technical support. The last thing we need to do is often
overlooked and that is creating the firewall access rules needed for users
connecting over the RED device to access resources on my local network. I'm going
to click on firewall in the Protect section of the left-hand navigation bar.
You can see from the firewall rules that I currently have defined in my firewall
that I do not have access rules from the RED interface to the LAN, or the WAN. I'm
going to quickly jump over to a command prompt window. I want to show that I am
pulling an IP address from a RED device and that I do not have access to my
local LAN or the WAN. I'm going to do an IP config so you can see I'm getting an
IP address for my RED DHCP. I'm pulling IP address 192.168.1.3. Now I'll try
to ping my local network, LAN, by pinging IP address 172.16.16.16 and
you can see the requests are timing out. I'm going to go back over to my firewall
and I'm now going to create a firewall access rule for the RED interface to the
LAN and an access rule for the RED interface to the WAN. I'm going to click
on add firewall rule, and select User/Network rule. I'm going to name
this RED to LAN, and pick rule position at the top. For Source Zone I'm going to use
LAN and for Source Networks I'm going to use the reds1 interface. In Destination
Zone I'm going to select LAN. I'm going to uncheck match known users.
I'm going to select to scan HTTP and FTP and then select General Policy for
Intrusion Prevention and Allow All for both Web Policy and Application Control.
I will check the checkbox for log traffic so any triggers to this rule
will show up in the logs. And then finally click Save. And for the RED
interface to WAN rule I'm gonna click on add firewall rule and select User/Network
rule. I'm going to name this one RED to WAN. And pick Rule Position to top.
For Source Zone I'm going to use LAN and for Source Networks I'm going to use the
reds1 one interface. And Destination Zone I'm going to select WAN and I'm going to
uncheck match known users.
I'm going to select scan HTTP and FTP and then select General Policy for
Intrusion Prevention and Allow All for both Web Policy and Application Control.
And again I'm gonna select the checkbox so that any triggers to this rule will
show up in the logs. Click Save, and now you can see I have my two rules. I'm
going back to the command prompt window I'll ping 172.16.16.16 again,
and now you can see the replies from that IP. From a browser window I'm gonna
launch Sophos's web page. Now you can see I have access to the WAN as well.
Early in the video I explained the feature of automatic device
deauthorization in System Services of the configuration section of the left-hand
navigation bar, and the RED tab across the top. That means that after a RED
device has been offline for a defined amount of time the XG firewall will
automatically deauthorize that device. This is a safety mechanism to ensure
that if a RED device is ever lost or stolen that someone does not power it up
with a live internet connection and then have that RED device connect back to
your network. I purposely powered off my RED device for more than 60 minutes
which is my setting for Deauthorize After. I'm now going to power on my RED
device and I'm gonna show you the RED interface in Network on the left-hand
navigation bar, and Interfaces option across the top. Let me click on RED to
just see my RED interfaces. You can see here that the interface is showing RED
is deauthorized. Click on the icon to the right that
allows you to enable or disable the interface, edit or delete the interface.
Simply toggle the slider button to enable the interface and then click OK
to confirm. I'm going to quickly change screens to refresh this view.
And now you can see that my RED device is back up and online. thanks for
watching this video, and I hope that you found it helpful.