XGS 2100 - Firewall SOPHOS - Free user manual and instructions

Brand	Sophos
Model	XGS 2100
Product type	Hardware firewall (network security appliance)
Form factor	1U rack (rack mounting included)
Dimensions (approximate)	44 x 30 x 4 cm (standard 1U chassis)
Weight (approximate)	4 kg
Power supply	Dual redundant power supply (mains, cable included)
Power consumption	Not specified
Network interfaces	8 RJ45 10/100/1000 Mbps ports (ports 1-8, with bypass pair on 1/2), 2 SFP 1 Gbps ports (F1-F2), 1 MGMT RJ45 10/100/1000 port, 1 COM RJ45/Micro USB port, 2 USB ports (front USB 3.0, rear USB 2.0), 1 Flexi Port modular slot
Supported throughput	Up to 1 Gbps (copper and SFP ports), hardware bypass up to 1 Gbps
Main functions	Firewall, routing, NAT, VPN, SSL inspection, IPS, application control, web filtering, WAN load balancing, high availability
Initial configuration	Via web console (https://10.0.1.1:4444) or serial CLI (38400 bps, 8 bits, no parity, 1 stop bit)
Bypass mode	Bypass port pair (1/2) enable/disable via CLI, with dedicated LED
LED indicators	Power (green/red), SSD (blinking blue), bypass (green solid), Ethernet activity/link (green solid/blinking), speed (orange/green/off), SFP/SFP+ (green, blue for 10G)
Operating temperature	Not specified
Operating humidity	Not specified
Maintenance and cleaning	Disconnect before cleaning, use a soft dry cloth, do not use abrasive or liquid products
Security	Built-in firewall with deep packet inspection, support for access control lists, firmware update via MySophos
Box contents	XGS 2100 appliance, quick start guide, safety instructions, 2 long mounting brackets, 2 short brackets, Micro USB cable, RJ45 Ethernet cable, power cable
Warranty	Not specified, contact Sophos
Technical support	www.sophos.com/en-us/support or reseller

Frequently Asked Questions - XGS 2100 SOPHOS

How to connect the Sophos XGS 2100 for the first time?

Connect the MGMT port to your internal network via a switch, then port 2 to your external network (WAN). Plug in the power and turn on the appliance. Configure your PC with IP address 10.0.1.2, subnet mask 255.255.255.0, and gateway 10.0.1.1. Access the web interface via https://10.0.1.1:4444 and log in with admin/admin.

What is the default IP address of the management interface?

The default IP address of the MGMT port is 10.0.1.1 with subnet mask 255.255.255.0. The LAN port (port 1) has address 172.16.16.16/24.

How to reset the administrator password?

The reset procedure is not described in this guide. Consult the Sophos documentation or contact technical support. By default, the password is admin for the web console and CLI.

What does the bypass mode do on the Sophos XGS 2100?

Bypass mode allows all traffic to pass through without analysis in case of failure or malfunction. It is enabled/disabled via CLI (set bypass enable/disable). The BP 1/2 LEDs light up green when the mode is active on port pair 1/2.

How to enable or disable bypass mode?

Log in via CLI using Telnet or SSH, select option 4 'Device console'. Execute the command set bypass enable to enable or set bypass disable to disable. The BP 1/2 LED turns on or off accordingly.

What ports are available and their speeds?

The appliance has 8 RJ45 Gigabit ports (10/100/1000), 2 SFP Gigabit ports (F1-F2), one MGMT Gigabit port, one COM port (RJ45 and Micro USB), two USB ports, and one Flexi Port modular slot. Ports 1/2 can be configured in bypass mode.

How to interpret the LED indicators on the Ethernet ports?

The left LED (ACT/LNK) solid green indicates a link, blinking green indicates network activity. The right LED indicates speed: orange for 1000 Mbps, green for 100 Mbps, off for 10 Mbps.

How to update the firmware of the Sophos XGS 2100?

Log in to the web interface, go to system settings and check for updates. The appliance must be registered on MySophos to download updates. Follow the on-screen instructions.

Can I use SFP+ modules on the SFP ports?

On the XGS 2100, ports F1-F2 are SFP 1 Gbps, not SFP+. Only the XGS 3100/3300 models have SFP+ ports. Use compatible Sophos Gigabit SFP modules.

What to do in case of power failure?

If the power is cut, the appliance turns off. When restored, bypass mode may activate automatically if configured. Check the power LEDs: solid green = OK, red = failure. Contact support if an LED remains red.

USER MANUAL XGS 2100 SOPHOS

XGS 2100/2300/3100/3300

For more information about your appliance, scan the QR code or visit www.sophos.com/get-started-firewall

Before you begin, please confirm that you have a working Internet connection and make sure you have the account information available that was provided by your ISP.

1. Before Deploying

Congratulations on the purchase of your Sophos XGS appliance. This Quick Start Guide describes in short steps how to connect your appliance and explains how to open the web-based Admin Console from your administration PC. The Admin Console allows you to configure every aspect of the appliance.

a) What is included in the box

XGS 2100/2300/3100/3300 (1U rack mount chassis)

This Quick Start Guide and Safety Instructions

2 long rack mount brackets

2 short rack mount brackets

Micro USB cable RJ45 Ethernet cable Power cable

* The displayed appliance images are of the XGS 3300 appliance, which is shown with some optional modules. XGS 2100/2300/3100 appliances will vary slightly.

ENGLISH

b) Appliance images: front and back
XGS 2100/2300

XGS 3100/3300

XGS 2100/2300/3100/3300

Interfaces (front)

LAN Ports Type Speed Comment
1-8 RJ45 10/100/1000 Mbps Ports	1/2 can be configured as a bypass pair.
F1-F2(XGS 2100/2300 only)	SFP 1 Gbps
F1-F2(XGS 3100/3300 only)	SFP+ 1/10 Gbps
F3-F4(XGS 3100/3300 only)	SFP 1 Gbps

ENGLISH

Other Ports Type Comment
COM RJ45/Micro USB	You can connect a serial console to either the RJ45 or micro USB COMport to access the CLI. Only one port can be used at any time. If both ports are connected then the micro USB port will take precedence.The required connection settings are:Bits per second: 38,400Data bits: 8Parity: N (none)Stop bits: 1
USB USB 3.0 [Type A]	You can connect a USB 2.0 or 3.0 compatible device to thisport [e.g. USB thumb drive, UPS, 3G/4G dongles].
MGMT RJ45 [10/100/1000 Mbps] We recommend using this dedicated port to connect your Admin PC.
USB (rear)	USB 2.0 (Type A)	You can connect a USB 2.0 compatible device to this port (e.g. keyboard).

Module Slots Type Comment
A	Flexi Port	Can be used for any Flexi Port module listed in the table below

Compatible Modules*	Comment
8 port GbE copper	Flexi Port
8 port GbE SFP	Flexi Port
4 port GbE copper – 2 Bypass groups	Flexi Port
4 port 10 GbE SFP+	Flexi Port
2 port GbE fiber (LC) Bypass + 4 port GbE SFP	Flexi Port
4 port 2.5 GbE copper PoE	Flexi Port
4 port GbE copper PoE + 4 port GbE copper	Flexi Port

* SFP/SFP+ transceivers are sold separately

ENGLISH

2. Mount and Connect the Appliance

Please follow the rack mounting instructions as described in the XGS Operating Instructions Guide or the separate instructions provided with your rack mount rails.

Connect the ports to the internal and external networks

1. Connect the MGMT port via a switch to the internal network. For this purpose, use the RJ45 Ethernet cable provided. Note that your Administration PC must also be connected to this network.
2. Connect Port 2 to the external network. The connection to the WAN depends on the type of Internet access.

XGS appliances are shipped with the following default settings:

Ethernet Port IP Address Zone
1/LAN 172.16.16.16/255.255.255.0 LAN
2/WAN DHCP WAN
MGMT 10.0.1.1/255.255.255.0 LAN
Admin Console Username Admin Console Password	CLI Console Password
admin admin admin
Default Gateway DNS DHCP Service
DHCP DHCP Enabled

* Available at www.sophos.com/firewall-documentation

3. Power Up the Appliance

Connect the power cable and turn on the appliance

Connect the appliance to the power supply using the power cable(s). Turn the appliance on. The power switch is on the back of the appliance next to the power connection. Once the appliance has booted completely, you will hear an acoustic signal: five beeps in a row.

4. Connect Your Administration PC

Please note: We recommend that you use the MGMT interface to connect the Administration PC and all other network interfaces for regular network traffic. Therefore, the following settings are for the MGMT port only. However, if required, you can also connect your Admin PC to any other LAN port. Please make sure that you use the correct IP address.

Administration PC connection properties:

Use the settings below to configure your (PC/laptop) network interface:

IP address: 10.0.1.2
• Netmask: Enter 255.255.255.0
- Default Gateway: Enter the IP address of the appliance's internal network card [MGMT]: 10.0.1.1
- DNS Server: Enable this option and enter the IP address of the internal network card (MGMT): 10.0.1.1

Connect your PC/laptop to the MGMT port of the appliance:

Start the browser and enter the IP address of the appliance's MGMT port that your PC is connected to: https://10.0.1.1:4444

Login with the default details below:

Username: admin

Password: admin

ENGLISH

graph TD
    A["Internet"] --> B["e.g., DSL modem"]
    B --> C["XGS Appliance"]
    C --> D["Switch"]
    D --> E["Internal network admin client PC"]
    style A fill:#f9f,stroke:#333
    style B fill:#ccf,stroke:#333
    style C fill:#cfc,stroke:#333
    style D fill:#fcc,stroke:#333
    style E fill:#cff,stroke:#333

ENGLISH

5. Set Up the Appliance

a) Start network configuration

Select 'Click to begin' on the 'Welcome' screen to start your basic appliance configuration. Change the interface IP addresses, default gateway, DNS settings and date/time zone to match your local network settings.

b) Register the appliance

If you have not previously registered your appliance on MySophos, you will see the registration screen "Register Your Firewall." The appliance requires Internet connectivity for it to be registered with MySophos. If you want to register later, click the check box "I do not want to register now" and proceed with section c).

If you have a serial number provided on your License Schedule please enter it into the first field and click "I have an existing serial number," otherwise click "I don't have a serial number [Start a Trial]."

If you are upgrading from an existing UTM/SG appliance and want to migrate your existing UTM license to your new firewall, click the respective button on the screen and browse for your UTM license to upload it to your firewall.

After clicking 'Continue', you will be redirected to the MySophos portal. If you already have a MySophos account, enter your login credentials under 'Log in to MySophos'. If you are a new user, sign up for a MySophos account by entering the details under 'Register for MySophos'.

Click 'Continue' to complete the registration process. Please wait while the process completes – it will take a few seconds. After successful registration, you will see a screen with the message, 'Your device is now registered'. Please note that you should proceed with the next step, i.e. 'Synchronize License' only after the appliance is successfully registered.

c) Synchronize license

Click 'Initiate License Synchronization' to get the license information from Sophos onto the appliance. After synchronization, you will see a screen with the message, "Synchronization with server was successful."

ENGLISH

6. Set Up Bypass Mode

Your XGS appliance can go into LAN Bypass Mode [Hardware Bypass Mode] in case of a power failure or hardware malfunction. In Bypass Mode, the firewall allows all traffic to pass through without any scanning. In this mode, one pair of interfaces are bridged allowing uninterrupted traffic flow.

Your XGS appliance comes with one pair of bypass ports as shown on the picture to the right.

After a power failure, the firewall automatically resumes normal functionality when power is restored. In case of a hardware failure, please contact Sophos Support.

By default, LAN Bypass Mode is disabled on your XGS appliance. You can enable/disable LAN Bypass Mode by following the steps given below.

1. Log in to the CLI Console via Telnet or SSH.
2. Choose 'Option 4. Device Console' and press 'Enter'.
3. View the LAN Bypass Mode status by executing the following command:
   console> show lanbypass
4. Enable or disable Bypass Mode by executing the following command:

console> set lanbypass

The LED on the front panel of the appliance (see picture to the right) turns on when Bypass Mode is enabled for the specific port pair.

Please note: Within initial SFOS releases Bypass Mode can only be enabled/disabled for all Bypass ports/pairs at once (LEDs for all available bypass pairs will turn ON/OFF synchronously).

Enabling/disabling Bypass Mode for each bypass port pair individually will be added in a future SFOS release. Please check the KBA at https://community.sophos.com/kb/en-us/127014 for further information.

ENGLISH

7. Appliance LED codes

Status LEDs
Power 1 Green Solid	Power Supply 1 Active.
	Red Solid Power Supply 1 Failure.
Power 2 Green Solid	Power Supply 2 Active.
	Red Solid Power Supply 2 Failure.
SSD Blue Flashing S	SSD reading/writing data.
BP 1/2 Green Solid	Bypass mode on Ports 1/2 enabled.
		Off Bypass mode on Ports 1/2 disabled and inactive.

LEDs on each RJ45 Ethernet connector
ACT/LNK(Left LED)	Green Solid 1. The Ethernet port has established link.
	Off 1. The adapter and switch are not receiving power.2. No connection between both ends of network.3. Network drivers have not been loaded or do not function correctly.
Speed(Right LED)	Amber On If Ethernet port is operating at 1000 Mbps.
	Green On If Ethernet port is operating at 100 Mbps.

ENGLISH

LEDs on each SFP connector

ACT/LNK Green Solid 1. The SFP connector is receiving power.
	2. Good connection between the SFP port and hub.
Flashing The adapter is sending or receiving network data.
Off 1. The adapter and switch are not receiving power.

LEDs on each SFP+ connector

ACT/LNK Green Solid 1. The SFP+ connector is receiving power.

Flashing The adapter is sending or receiving network data.

Off 1. The adapter and switch are not receiving power.

Speed Blue On If SFP+ connector is operating at 10,000 Mbps.

	Amber On If SFP+ connector is operating at 1,000 Mbps.
	Off Either the LED is not working or the SFP+ connector is operating at a speed below 1,000 Mbps.

8. Support and Documentation

For more information and technical support, please visit www.sophos.com/en-us/support or contact your local Sophos reseller.

Check our Getting Started resources to find out how you can get the most out of your purchase www.sophos.com/get-started-firewall

DEUTSCH

XGS 2100/2300/3100/3300

DEUTSCH

console> show lanbypass

console> set lanbypass

XGS 2100/2300/3100/3300

FRANÇAIS

console> show lanbypass

console> set lanbypass

XGS 2100/2300/3100/3300

ESPAÑOL

console> show lanbypass

console> set lanbypass

XGS 2100/2300/3100/3300

PORTUGUÊS DO BRASIL

6. Configurar o modo Bypass

console> show lanbypass

console> set lanbypass

XGS 2100/2300/3100/3300

console> show lanbypass

console> set lanbypass

XGS 2100/2300/3100/3300 (1U机架式)

快速安装指南和安全说明

2 个长的机架安装支架

2 个短的机架安装支架

XGS 2100/2300/3100/3300

中国

6. 设置旁路模式

United Kingdom Sales

Tel.: [phone]

Email: [e-mail]

North American Sales

Toll Free: 1-866-866-2802

Email: [e-mail]

Sales DACH

Australia and New Zealand Sales

Tel.: [phone]

Email: [e-mail]

Japan Sales

Tel.: [phone]

Email: [e-mail]

China Sales

Tel.: [phone]

Email: [e-mail]

Shanghai Sales

Tel.: [phone]

Email: [e-mail]

SOPHOS

© Copyright 2020. Sophos Ltd. All rights reserved.

Registered in England and Wales No. 209652C, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK

Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned are

trademarks or registered trademarks of their respective owners.

2020-12-17 QSG (DD)