XGS 2300 - Firewall SOPHOS - Free user manual and instructions

USER MANUAL XGS 2300 SOPHOS

XGS 2100/2300/3100/3300

SOPHOS SOPHOS Protection RESET M1.0 M2.0 M3.0 M4.0 M5.0 USB SSD RESET USB 5.0 USB 1.0 USB 2.0 USB 3.0 USB 4.0 USB 5.0

For more information about your appliance, scan the QR code or visit www.sophos.com/get-started-firewall

Before you begin, please confirm that you have a working Internet connection and make sure you have the account information available that was provided by your ISP.

1. Before Deploying

Congratulations on the purchase of your Sophos XGS appliance. This Quick Start Guide describes in short steps how to connect your appliance and explains how to open the web-based Admin Console from your administration PC. The Admin Console allows you to configure every aspect of the appliance.

a) What is included in the box

XGS 2100/2300/3100/3300 (1U rack mount chassis)

This Quick Start Guide and Safety Instructions

2 long rack mount brackets

2 short rack mount brackets

Micro USB cable RJ45 Ethernet cable Power cable

* The displayed appliance images are of the XGS 3300 appliance, which is shown with some optional modules. XGS 2100/2300/3100 appliances will vary slightly.

ENGLISH

b) Appliance images: front and back
XGS 2100/2300

Multi-function LCD display and navigation COM: Micro USB, RJIS, 2 x USB 3.0, MGMT port LAN 1-8: 8 x GbE copper - 1 bypass pair (ports 1/2) F1-F2 2 x SFP fiber ports 1 x expansion bay [shown with optional module]

XGS 3100/3300

Multi-function LCD display and Navigation COM: Micro USB, RJ45, 2 x USB 3.0, MGMT port LAN 1-8: 8 x G&E copper - 1 bypass pair [ports 1/2] SOPHOS F1-F2 2 x SFP+ fiber ports F3-F4: 2 x SFP fiber ports 1 x expansion bay [shown with optional module]

XGS 2100/2300/3100/3300

Power switch Power supply Mounting pins for external power supply Connector for external redundant power supply [available as an option] USB

Interfaces (front)

LAN Ports Type Speed Comment
1-8 RJ45 10/100/1000 Mbps Ports	1/2 can be configured as a bypass pair.
F1-F2(XGS 2100/2300 only)	SFP 1 Gbps
F1-F2(XGS 3100/3300 only)	SFP+ 1/10 Gbps
F3-F4(XGS 3100/3300 only)	SFP 1 Gbps

ENGLISH

Other Ports Type Comment
COM RJ45/Micro USB	You can connect a serial console to either the RJ45 or micro USB COMport to access the CLI. Only one port can be used at any time. If both ports are connected then the micro USB port will take precedence.The required connection settings are:Bits per second: 38,400Data bits: 8Parity: N (none)Stop bits: 1
USB USB 3.0 [Type A]	You can connect a USB 2.0 or 3.0 compatible device to thisport [e.g. USB thumb drive, UPS, 3G/4G dongles].
MGMT RJ45 [10/100/1000 Mbps] We recommend using this dedicated port to connect your Admin PC.
USB (rear)	USB 2.0 (Type A)	You can connect a USB 2.0 compatible device to this port (e.g. keyboard).

Module Slots Type Comment
A	Flexi Port	Can be used for any Flexi Port module listed in the table below

Compatible Modules*	Comment
8 port GbE copper	Flexi Port
8 port GbE SFP	Flexi Port
4 port GbE copper – 2 Bypass groups	Flexi Port
4 port 10 GbE SFP+	Flexi Port
2 port GbE fiber (LC) Bypass + 4 port GbE SFP	Flexi Port
4 port 2.5 GbE copper PoE	Flexi Port
4 port GbE copper PoE + 4 port GbE copper	Flexi Port

* SFP/SFP+ transceivers are sold separately

ENGLISH

2. Mount and Connect the Appliance

Please follow the rack mounting instructions as described in the XGS Operating Instructions Guide or the separate instructions provided with your rack mount rails.

Connect the ports to the internal and external networks

1. Connect the MGMT port via a switch to the internal network. For this purpose, use the RJ45 Ethernet cable provided. Note that your Administration PC must also be connected to this network.
2. Connect Port 2 to the external network. The connection to the WAN depends on the type of Internet access.

XGS appliances are shipped with the following default settings:

Ethernet Port IP Address Zone
1/LAN 172.16.16.16/255.255.255.0 LAN
2/WAN DHCP WAN
MGMT 10.0.1.1/255.255.255.0 LAN
Admin Console Username Admin Console Password	CLI Console Password
admin admin admin
Default Gateway DNS DHCP Service
DHCP DHCP Enabled

* Available at www.sophos.com/firewall-documentation

3. Power Up the Appliance

Connect the power cable and turn on the appliance

Connect the appliance to the power supply using the power cable(s). Turn the appliance on. The power switch is on the back of the appliance next to the power connection. Once the appliance has booted completely, you will hear an acoustic signal: five beeps in a row.

4. Connect Your Administration PC

Please note: We recommend that you use the MGMT interface to connect the Administration PC and all other network interfaces for regular network traffic. Therefore, the following settings are for the MGMT port only. However, if required, you can also connect your Admin PC to any other LAN port. Please make sure that you use the correct IP address.

Administration PC connection properties:

Use the settings below to configure your (PC/laptop) network interface:

IP address: 10.0.1.2
• Netmask: Enter 255.255.255.0
- Default Gateway: Enter the IP address of the appliance's internal network card [MGMT]: 10.0.1.1
- DNS Server: Enable this option and enter the IP address of the internal network card (MGMT): 10.0.1.1

Connect your PC/laptop to the MGMT port of the appliance:

Start the browser and enter the IP address of the appliance's MGMT port that your PC is connected to: https://10.0.1.1:4444

Login with the default details below:

Username: admin

Password: admin

ENGLISH

graph TD
    A["Internet"] --> B["e.g., DSL modem"]
    B --> C["XGS Appliance"]
    C --> D["Switch"]
    D --> E["Internal network admin client PC"]
    style A fill:#f9f,stroke:#333
    style B fill:#ccf,stroke:#333
    style C fill:#cfc,stroke:#333
    style D fill:#fcc,stroke:#333
    style E fill:#cff,stroke:#333

ENGLISH

5. Set Up the Appliance

a) Start network configuration

Select 'Click to begin' on the 'Welcome' screen to start your basic appliance configuration. Change the interface IP addresses, default gateway, DNS settings and date/time zone to match your local network settings.

b) Register the appliance

If you have not previously registered your appliance on MySophos, you will see the registration screen "Register Your Firewall." The appliance requires Internet connectivity for it to be registered with MySophos. If you want to register later, click the check box "I do not want to register now" and proceed with section c).

If you have a serial number provided on your License Schedule please enter it into the first field and click "I have an existing serial number," otherwise click "I don't have a serial number [Start a Trial]."

If you are upgrading from an existing UTM/SG appliance and want to migrate your existing UTM license to your new firewall, click the respective button on the screen and browse for your UTM license to upload it to your firewall.

After clicking 'Continue', you will be redirected to the MySophos portal. If you already have a MySophos account, enter your login credentials under 'Log in to MySophos'. If you are a new user, sign up for a MySophos account by entering the details under 'Register for MySophos'.

Click 'Continue' to complete the registration process. Please wait while the process completes – it will take a few seconds. After successful registration, you will see a screen with the message, 'Your device is now registered'. Please note that you should proceed with the next step, i.e. 'Synchronize License' only after the appliance is successfully registered.

c) Synchronize license

Click 'Initiate License Synchronization' to get the license information from Sophos onto the appliance. After synchronization, you will see a screen with the message, "Synchronization with server was successful."

Sophos XG Firewall Thank you for your firewall SOPHOS Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you! Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to my firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thankyou to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall

ENGLISH

6. Set Up Bypass Mode

Your XGS appliance can go into LAN Bypass Mode [Hardware Bypass Mode] in case of a power failure or hardware malfunction. In Bypass Mode, the firewall allows all traffic to pass through without any scanning. In this mode, one pair of interfaces are bridged allowing uninterrupted traffic flow.

Your XGS appliance comes with one pair of bypass ports as shown on the picture to the right.

After a power failure, the firewall automatically resumes normal functionality when power is restored. In case of a hardware failure, please contact Sophos Support.

By default, LAN Bypass Mode is disabled on your XGS appliance. You can enable/disable LAN Bypass Mode by following the steps given below.

1. Log in to the CLI Console via Telnet or SSH.
2. Choose 'Option 4. Device Console' and press 'Enter'.
3. View the LAN Bypass Mode status by executing the following command:
   console> show lanbypass
4. Enable or disable Bypass Mode by executing the following command:

console> set lanbypass

The LED on the front panel of the appliance (see picture to the right) turns on when Bypass Mode is enabled for the specific port pair.

Please note: Within initial SFOS releases Bypass Mode can only be enabled/disabled for all Bypass ports/pairs at once (LEDs for all available bypass pairs will turn ON/OFF synchronously).

Enabling/disabling Bypass Mode for each bypass port pair individually will be added in a future SFOS release. Please check the KBA at https://community.sophos.com/kb/en-us/127014 for further information.

7/2/2 7/2/2 4 5 1/LAM 3/DH2 1 Bypass pair 1 ports 1/2

SOPHOS SOPHOS Protection BIP1/2 Bypass LEDs - Bypass ports 1/2

ENGLISH

7. Appliance LED codes

Status LEDs
Power 1 Green Solid	Power Supply 1 Active.
	Red Solid Power Supply 1 Failure.
Power 2 Green Solid	Power Supply 2 Active.
	Red Solid Power Supply 2 Failure.
SSD Blue Flashing S	SSD reading/writing data.
BP 1/2 Green Solid	Bypass mode on Ports 1/2 enabled.
		Off Bypass mode on Ports 1/2 disabled and inactive.

LEDs on each RJ45 Ethernet connector
ACT/LNK(Left LED)	Green Solid 1. The Ethernet port has established link.
	Off 1. The adapter and switch are not receiving power.2. No connection between both ends of network.3. Network drivers have not been loaded or do not function correctly.
Speed(Right LED)	Amber On If Ethernet port is operating at 1000 Mbps.
	Green On If Ethernet port is operating at 100 Mbps.

ENGLISH

LEDs on each SFP connector

ACT/LNK Green Solid 1. The SFP connector is receiving power.
	2. Good connection between the SFP port and hub.
Flashing The adapter is sending or receiving network data.
Off 1. The adapter and switch are not receiving power.

LEDs on each SFP+ connector

ACT/LNK Green Solid 1. The SFP+ connector is receiving power.

Flashing The adapter is sending or receiving network data.

Off 1. The adapter and switch are not receiving power.

Speed Blue On If SFP+ connector is operating at 10,000 Mbps.

	Amber On If SFP+ connector is operating at 1,000 Mbps.
	Off Either the LED is not working or the SFP+ connector is operating at a speed below 1,000 Mbps.

8. Support and Documentation

For more information and technical support, please visit www.sophos.com/en-us/support or contact your local Sophos reseller.

Check our Getting Started resources to find out how you can get the most out of your purchase www.sophos.com/get-started-firewall

DEUTSCH

XGS 2100/2300/3100/3300

Sophos XG Firewall

SOPHOG Thank you! Thank you to your website Thank you to your website to the course of your website. Thank you to your website to your website for your course.

DEUTSCH

console> show lanbypass

console> set lanbypass

XGS 2100/2300/3100/3300

Sophos XG Firewall Thank you for your firewall SOPHOS Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you for your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you to your firewall Thank you! Thank you to your firewall

FRANÇAIS

console> show lanbypass

console> set lanbypass

7/04/1 4 5 1/LAM 3/DH2 1 Pair Bypass 1 ports 1/2

SOPHOS SOPHOS Protection BEX1 M Bn Bf1/2 Voyants Bypass - Ports Bypass 1/2 COM

FRANÇAIS

XGS 2100/2300/3100/3300

Sophos XG Firewall Thank you for your firewall SOPHOS Thank you for your firewall Thank you for your firewall to the following: Thank you to your firewall to the following: Thank you to your firewall to your firewall.

ESPAÑOL

console> show lanbypass

console> set lanbypass

XGS 2100/2300/3100/3300

Sophos XG Firewall Thank you for your firewall SOPHOS Thank you! Thank you for your firewall Thank you for your firewall to consider your firewall's personal information. Thank you for your firewall to provide your security information. Thank you for your firewall to your personal information.

PORTUGUÊS DO BRASIL

6. Configurar o modo Bypass

console> show lanbypass

console> set lanbypass

XGS 2100/2300/3100/3300

console> show lanbypass

console> set lanbypass

XGS 2100/2300/3100/3300 (1U机架式)

快速安装指南和安全说明

2 个长的机架安装支架

2个短的机架安装支架

XGS 2100/2300/3100/3300

Sophos XG Firewall

Scanned screenshot of a software interface with Chinese text and a small logo, likely for configuration or settings.

SOPHOG SOPHOG Thank you! Thank you! at your right to order your license: Please check your license to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have your right to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you to you for your right to you have you who can be able to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the left you who can be able to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right to pay the right you who can be able to pay the right you who can be able to pay the right you who can be able to pay the right you who can be able to pay the right you who can be able to pay the right you who can be able you who can be able you who can be able you who can be able you who can be able you who can be able you who can be able you who can be able you who can be able you who can be able you who can be able you who can be able you who can be able you who can be able you who can be able you who can be able you who can be able you who CAN BE A P O R E S O N T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O U T O V I N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N N M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M

中国

6. 设置旁路模式

United Kingdom Sales

Tel.: [phone]

Email: [e-mail]

North American Sales

Toll Free: 1-866-866-2802

Email: [e-mail]

Sales DACH

Australia and New Zealand Sales

Tel.: [phone]

Email: [e-mail]

Japan Sales

Tel.: [phone]

Email: [e-mail]

China Sales

Tel.: [phone]

Email: [e-mail]

Shanghai Sales

Tel.: [phone]

Email: [e-mail]

SOPHOS

© Copyright 2020. Sophos Ltd. All rights reserved.

Registered in England and Wales No. 209652C, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK

Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned are

trademarks or registered trademarks of their respective owners.

2020-12-17 QSG (DD)