WS1100 to Sophos XG Web Protection

Hi, thanks for that, I have seen a couple of those, but I will have a look at the rest of them.

I was hoping that as Sophos are making the WS1100 Appliance End of life, they may have had a guide showing how to move to Sophos XG web protection  sort of documentation. Show where is section on a WS1100 is on the Sophos XG...   wishful thinking I guess.

thanks

Trev

Its more likely complicated than this. 

As XG uses a different approach compared to WS, its not that easy to move a existing configuration. Most likely you are doing a another approach in your setup. 

XG Firewall is a "firewall product", which naturally sits in the traffic as a layer 3 device. WS was a explicit proxy, which Clients call. 

Maybe you want to move to the DPI engine, (new in V18), which cannot work as a explicit proxy (the technology moving forward cannot be build around this concept). 

Hi, thanks for the information.

I appreciated there are differences, but they can achieve more or less the same goals?

The WS1100 web filter has sections for different aspects of web filtering, I just would like to know where those sections are represented in the Sophos XG Web filtering.

HTTPS exceptions

Certificate Validation

Add a Site to the Site list for Trust or Block

TCP listening Ports

How does the XG link to AD and get a list of users.

Sophos want users to move away from the WS1100 to the Sophos XG, so I though somewhere someone at Sophos may have created a "How To" guide 

Hello Tstan,

Please take a look at this KB that has a bit more information about migrating from SWA to XG.

Regards,

Thank you for that, I am looking through it now.. it does raise more questions, but helps thank you.

I have the XG running and tested some web filtering, but

I am now looking at integrating AD and have this follow up question:

Trying to migrate from a Sophos Web Appliance - SWA WS1100 to Sophos XG Firewall. Following this guide:

"How to integrate Sophos Firewall with Active Directory: KB-000035731"

We have a forest Domain with 2 subdomains. The XG is for all domains

Forest.com

          Domain1.forest.com

          Domain2.forest.com

On the XG - In Authentication > Servers  click Add to configure the Active Directory:

When adding the servers to the servers section in authentication on the XG,

Do I add the Forest DC or the Domain1 and Domain2 AD servers.

The SWA WS1100 uses the forest DC as the Active Directory Domain and for the Primary Domain Controller and imports all the users automatically from the other 2 sub domains.

Our users are on each of the Domain1 and Domain2 AD Servers not the Forest.DC, If I just add the Forest.com AD server will it automatically bring in the users from the 2 subdomains.

Thank you

Hello Tstan,

You can just add the forest.com as long as the trusts are there, by default the subdomain child/parent trust should be there.

In this case, since it works as in the SWA this should be the same in the XG.

Regards,

Hello Tstan,

You can just add the forest.com as long as the trusts are there, by default the subdomain child/parent trust should be there.

In this case, since it works as in the SWA this should be the same in the XG.

Regards,