Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 1438 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Converting SG configuration for import in XG firewall

Dennis Groppe

Hello,

I am currently preparing a XG310 as replacement for our ageing SG310. We have a quite extensive ruleset in the web protection with whitelist for hundreds of websites and seperated configurations for about 10 different LDAP-groups.

So I read about possibilites in exporting setting from SG to XG firewalls. My Sophos partner company told me, that there is no longer the Conversion Appliance Sophos offered to partners for a while but that they (our technical partner company) can sent a SG config file to Sophos and get back a converted XG config file. These XG config file should be inported to XG310 and would make it possible to get the web filter configuration transferred by using Import/Export function of the XG firewall.

My partner send the SG config to Sophos but only got the reply, that conversation would be possible "directly"?! We should import the abf file from the SG to the XG firewall. But the Sophos supporter did not explain, how this should be done, even after asking again. If I try an restore with the abf file on the XG, it only says that this is no valid config file for restoring (which I had expected, too).

Then I tried as another way the export function in SG. But this gives me a CSV-like output and XG likes XML-like files for Import. So this is no use either, as it appears.

What are the possibilities to get my web filter working as before without manuelly copy-pasting all of the whitelist-entrys from SG to XG? Configuring the whole web filter by hands could cost me a lot of time, I'm afraid. Any help is appreciated!



This thread was automatically locked due to age.
  • 0

    Hi Dennis,

    We recently migrated an SG to XG.  It was a very complicated setup, with 10 public IP aliases, 200 user VPNs, 2 S2S VPNs, 20 Wifi APs, email filtering, many port forwards, many firewall rules and web filtering rules.  We found ourselves in the same situation as yourself, ie no easy way to migrate.  I the end we divided the work between several people and just sat down and typed. 

    It was useful, though, to review all configurations - some were no longer needed, some could not be replicated on the XG; some XG features do not exist in the SG.  For example, the UTM was a proxy; the XG does not need to proxy to filter content.

    Good luck.

    Adrian

  • +1

    There are ways to integrate this via API. See: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/128124/lazyness-at-your-service-automated-load-of-object-through-api-from-csv

    Or build a python / powershell script to translate your own setup into XML. 

    I am always pointing out: SFOS interact with multiple instances different: Firewalls is one good example. UTM was a modular approach (Webfilter had no interaction with firewall), SFOS uses firewall rules to attach the webfilter. How should this possibly be translated to SFOS without the need of exclude and redo everything. 

    So try to get it into a csv or something like that from the utm. Export a URL list or exception from SFOS. Then check the entries.xml about the syntax. Get a tool, which translates the content of the exception to the syntax of xml. 

  • 0 in reply to LuCar Toni

    Thank you very much for your thoughts. I must admit I forgot to auswer here.

    Meanwhile, I made a whole new policies for our needs and put the topic of coversion of the SG files away. When I had started with my configurations I found the web filter in XG quite a different approach from SG, too, as LuCar Toni explained it. So now I'm sure it was a good idea to make it "XG from the scratch".

    It was a good opportunity to not just transfer all the old webfilter whitelist entry, many of them were gone, not valid, not relevant anymore, and so on. After all, I used only about 1/4 of them for my new XG. So it was not so much typing-work to to.