Sophos XG firewall as NIDS

Probably opnsense with suricata would be a better option

Hi l0rdraiden,

Thank you so much for your reply.

Do you mean replacing Sophos firewall with Suricata?

If possible, I'd like to install Suricata into Sophos firewall.

Thank you.

Suricata isn't a firewall. You can use this in addition to a sophos firewall.
Sophos includes a IPS/IDS system too. Here you find the snort-engine.
PS: you can't / shouldn't install something within Sophos Firewall.

Hi Dirk,

Thank you so much for your reply!!

Sophos firewall works as NIDS without add other hardware/software because it has Snort engine inside it.

Is my understanding correct?

I'd like to detect security alerts by receiving captured packets that is sent from network equipments through the Ethernet.

Thank you.

Only if the packets travel through the XG.

Ian

Hi rfcat_vk,

Thank you so much for your reply.

Sophos firewall has Snort engine inside it.

But, To work Sophos firewall as NIDS, packets have to pass through the firewall.

Thus, Sophos firewall can't meet my requirement.

Is it correct?

My requirement:

Detecting security alerts by receiving captured packets* that are sent from network equipment through the Ethernet.

  * packets that are sent from network equipment:   Mirrored and sent packet from remote network equipment

Thank you.