Hi. I'm Tao from Sophos Support.
Today I will explain how to configure
the MTR connector for Sophos Firewall.
Managed Threat Response or MTR
is a paid service provided by Sophos.
It monitors your Endpoints and Sophos Firewall
24 hours a day, 7 days a week.
With MDR enabled, Endpoint and Sophos Firewall will continuously send the reports to MTR
and analyze them to detect any threats.
If a threat is detected, the Sophos MTR team will be notified
and address the issue.
Sophos Central provides the interface for administrators
to check the MTR status within the MTR dashboard.
MTR also works with Sophos Firewall.
The firewall will actively send reports to Sophos Central,
then the MTR connector forwards those reports to MTR
so that they can be analyzed for ATP and IPS threat detection.
Additional resource for configuring MTR connector
are linked in the description.
Before we start configuration, we will go over the prerequisites.
The Sophos Firewall firmware must be on either
SFOS version 18.5 or 19.0
Version 18.0 is the minimum requirement for MTR
but since this will reach its end of support in the near future,
we don't recommend using this.
A Base Firewall license or higher is required for functionality.
Network Protection and Essential Orchestration must be active.
Network Protection allows the detection of threats in ATP and IPS reports and enables scanning.
Essential Orchestration allows us to turn on MTR connector in Sophos Central.
Lastly, ensure that you are licensed for
Intercept X Advanced with XDR and MTR Advanced or
Intercept X Advanced for Server with XDR and MTR advanced.
For more information about licensing,
refer to the resource linked in the description.
Now let's configure the Sophos Firewall.
Log into the Sophos Firewall web admin.
Navigated to Firewall Rules.
Here, enable IPS scanning on all firewall rules.
Now we'll go to System service.
Select the Service tab and ensure the IPS service is running.
With that verified, go to Advanced Protection and
enable Advanced Device protection.
Next, enable logging for IPS and ATP.
Again, navigate to System Service
and select the Log setting tab
then turn on logging for IPS
and ATP.
The next step is to register the Sophos Firewall to Sophos Central.
Select Sophos Central and then Register, to register the firewall.
Then turn on Sophos Central service.
Enable Send reports and logs to Sophos Central
and Manage from Sophos Central.
As stated before, this allows the forwarding of reports to MTR.
To complete the Sophos Firewall registration,
we will go back to Sophos Central,
navigate to Firewall Management,
then Firewall,
find the registered firewall and click Accept Service.
With the configuration complete,
we will verify the changes
and make sure the Sophos Firewall is connected to Sophos Central.
Now go to the Report Generator tab
and make sure your Sophos Central can generate a report of the firewall.
Finally we will check the connect status report.
Go to Sophos Central admin,
MTR dashboard.
If all prerequisites are met,
and the configuration has been completed successfully,
there will be a green check mark.
This indicates that the Sophos Firewall is connected to MTR.
I hope you found this video useful.
Give us a thumbs up on Techvids,
and let us know if we solved your issue.
Check out the documentation for this video in the video description.
For further assistance,
view and post questions on community.sophos.com
and go to techvids.sophos.com for more great videos like this one.
Thank you for watching!