Sophos XG: Web and application filtering

In this tutorial, we’ll see how to put filtering on outgoing streams with a Sophos XG firewall.

I will show you the two filter modules:

  • Web: which is an internet proxy
  • Application: level 7 filtering that allows to act the applications and actions available on a website

For both modules, you must create a filtering policy and then apply it to the firewall rule.

Create a Web Filtering Strategy

1. On the firewall interface, click Web 1 . The set of policies are displayed, by default Sophos proposes policies. Click Add Strategy 2 .

Strategies list

2. Enter a name for strategy 1 , a description (optional) and then click on Add Rule 2 .

Add rule

3. A new rule is added 1 , for the moment it blocks all the traffic. Click ALL web traffic 2 to edit it. We will block access to sites that are categorized in Sexually Explicit.

Edit rule

4. Remove 1 All web traffic then click Add new item 2 .

Edit rule

5. Click on Display a … 1 then choose Web Category 2 .

Filter elements

6. Check the box for Sexually Explicit category 1 and click Apply X to selected items 2 .

Select category

7. The added rule, we must now configure the action, click on the chevron 1 and click on the desired action for the HTTP and HTTPS filtering, in the example we choose Block 2 .

Rule action for http and https

8. Activate the rule by clicking OFF 1 to switch it to ON.

Switch ON

The following points are optional, in the following, we add a second filtering rule on social networks, by putting as Alert action, which allows to display a page to the user indicating that the navigation to this site is tolerated, he must click a button to confirm navigation.

9. Add a rule by choosing the Social Networking category.

Add rule

10. Configure the action by selecting Alert HTTP.

Action : warning

11. Do the same with the HTTPS action and activate the rule by switching it to ON.

Rule configured

12. Click Advanced Settings 1 and if desired, you can limit the size of the download items by selecting option 2 and indicating the maximum size 3 .

Advanced settings

13. When the policy is configured, click Save.

14. Click Ignore this step 1 , the next page discusses this topic.

ignore step

15. The strategy is added.

Strategie added

Now that the policy is created, we will see how to add a rule to the firewall and apply the strategy to filter the web browsing.

Add a rule to the firewall with Web filtering policy

In this part, we will see how to add an exit rule on the internet (Lan to Wan) by applying a web filtering strategy.

1. Go to Firewall 1 then click Add firewall rule 2 and Network / user rule 3 .

Add rule

2. Configure the rule:

1 Name the rule
2 Action Accept
3 Source : LAN
4 Destination : WAN
5 Enable HTTP control
6 Select Web Strategy
7 Enable traffic logging
8 Click on Save
Configure rule

To control the HTTPS flow, this involves SSL decryption and requires the deployment of a certificate. Web filtering will still be active on HTTPS streams, however, users will have a blank page in case of blocking.

For more security, it is also possible to limit the services in the rule, we could have configured only HTTP / HTTPS streams

3. The rule is added.

Rule added

On the right side of the rule, we can see the active controls

All flows in this rule will be filtered by the web strategy.

Application filtering

With the Sophos XG firewall, it is also possible to filter the application flow.

Before you start, first define the term application at the firewall, because it takes into account several parameters to complete an application:

  • Detection of applications with respect to the header of the outgoing agents on the internet, for example Skype uses a particular header that can detect usage.
  • Detection of remote applications or directly from the website, this part is interesting because it allows to rust functionality of some site such as blocking comments on Facebook or the impossibility of clicking on Like button. This allows access to the site by blocking functions, which is less frustrating for users.

Personally, I never had a collaborator who came to complain about the impossibility to start on facebook, conversely they complain about complete blockages of websites.

Overview of “Facebook” applications:

Facebook appli - sophos xg

1. On the administration click on Applications 1 to access the list of filters. Click Add 1 to create a filter.

Filter app

2. Name filter 1 and click Save 2 .

Create filter

3. The filter is created, it must now be modified to add applications, click on the icon 1 .

Edit filter

4. Click on Add 1 .

Add appli

5. Find the desired application 1 , select the 2 , set the action 3 and click Save 4 .

Configure app rule

In the example above, I blocked the download and send file on the site 1file, this allows to block access to the site but limit the use of services.

6. We see that the application is added to the strategy, click on Save 1 .

Save strategy

7. Edit the previously created rule and add the strategy in Application Control 1 and Save 2 .

8. In the rule preview, the APP badge is green.

Rule resume

Log visualizations

Log visualization is not the firewall interface by clicking Reports.

To have data, it is mandatory to implement web and application policies, because in their absence the flow does not pass in the proxy part of Sophos.

Example of reports on web filtering

Example of reports on application filtering