This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Setting up Sophos XG on Protectli FW6c headless using console

Hi, I just decided to take the plunge into building my own firewall appliance after using a Cisco ASA 5505 (and pixes before that ) for my home network.

I purchased a ProtectLi FW6c based on a number of reviews and forum comments. (https://protectli.com/product/fw6c/). I got the i5 version so I could take advantage of the higher horsepower of a faster processor.

While I have bits of PC components sprinkled around my house (spare monitor, Bluetooth keyboard/mouse), we mostly use laptops so i didn't really have an easy way to setup the device and firewall using the standard hdmi/mouse/keyboard so I decided to try headless using the console port.

I already had the a USB to serial adapter for use with my Cisco ASA so I used that. Reminder - you can find the USB device by searching for *USB* in /dev. You then do a "screen" against this device with the serial speed at the end.

Out of the box, the Proectli BIOS is set for the console to be at 115200. This is a bit of a change as I am used to my console ports being set to 9600, but I made this adjustment (after a bit of internet searching) and was able to access the bios.

I downloaded the Sophos ISO image and moved it to a USB using Etcher (https://www.balena.io/etcher/)

Once I configured the BIOS to boot from the USB port I saw the flash drive start to flash and it looked like things were moving. However, once the Sophos install script loaded, my text was scrambled. After a bit of additional digging on this forum, I found that Sophos assumes that the serial port is operating at 38400. After a bit of tinkering in the proectli BIOS, I got the console port set to 38400 and was then able to see the installation prompt from Sophos XG.

XG installed without a hitch, but then my text became scrambled again once the firewall booted from the internal ssd drive - I'm guessing it is expecting yet a another different console port speed, but I didn't spend any time investigating this as I was now able to connect to the web management interface of the new firewall.

I was able to get things passing traffic without too much additional effort, but I did notice that the throughput through the box was pretty low. It turned out that the default IPS and web filtering settings were slowing things down considerably.

I'm at a point that things are working fairly well, but I have limited advanced firewall features enabled to avoid too much of a performance hit. Any recommendations for enabling features without too much impact?

Thanks!

Bryan

This thread was automatically locked due to age.

0 rfcat_vk over 6 years ago

Hi,

a difficult installation.

Check

1/. MTU

2/. NICs are set auto negotiate

3/. the BIOS does not have power saving enabled.

4/. check which of the IPS DDOS is causing your issue and disable it at this stage.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Aditya Patel over 6 years ago

Hello Bryan,

Along with the system check, please provide us details on the memory assigned to the device. Also, if IPS is causing the latency in the network. I would recommend to check the CPU and memory utilization.
Cancel
Vote Up 0 Vote Down

Cancel
0 Bryan Pate over 6 years ago in reply to rfcat_vk

Thanks for the response. Im pretty sure the MTU is set to 1500 and the NICs are set to auto. I will have to look at the bios to see if any power saving options are enabled before looking at IDS features.
Cancel
Vote Up 0 Vote Down

Cancel
0 Bryan Pate over 6 years ago in reply to Bryan Pate

CPU and memory usage were low (5% and ~3GB out of 8GB). I gradually turned services back on and the firewall seems to be maxing at about 15% CPU and 3.5GB of memory used when I saturate my ISP connection. I may do some tweaking over time, but this seems good for now.

I think the main issue is that the default ruleset had some pretty restrictive web policies and had match known user checked.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to Bryan Pate

Hi Bryan,

if this a home user XG, the maximum CPU is 4 cores and 6gb of ram.

Also the IPS is LAN to WAN for normal user firewall rules.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Aditya Patel over 6 years ago in reply to Bryan Pate

Hello Bryan,

Glad to hear you were able to resolve the issue. The system usage is nominal so you may gradually add restrictions and monitor if the issue resurfaces again or not.
Cancel
Vote Up 0 Vote Down

Cancel